@opendatalabs/personal-server-ts-lite 1.34.2 → 1.35.0

package/dist/additions-worker.bundle.js

@@ -24051,12 +24051,12 @@ function describe(description) {
   return ch2;
 }
 // @__NO_SIDE_EFFECTS__
-function meta(metadata) {
+function meta(metadata2) {
   const ch2 = new $ZodCheck({ check: "meta" });
   ch2._zod.onattach = [
     (inst) => {
       const existing = globalRegistry.get(inst) ?? {};
-      globalRegistry.add(inst, { ...existing, ...metadata });
+      globalRegistry.add(inst, { ...existing, ...metadata2 });
     }
   ];
   ch2._zod.check = () => {
@@ -29642,6 +29642,288 @@ var DerivativeStatusSchema = external_exports.object({
   retryAfterSeconds: nullable2(external_exports.number())
 });
 
+// ../core/dist/sync/tombstone.js
+var TOMBSTONE_DATA_HASH_LABEL = "vana.data-point.tombstone.v1";
+var TOMBSTONE_METADATA_HASH_LABEL = "vana.data-point.tombstone.metadata.v1";
+var TOMBSTONE_DATA_HASH = keccak256(stringToHex(TOMBSTONE_DATA_HASH_LABEL));
+var TOMBSTONE_METADATA_HASH = keccak256(stringToHex(TOMBSTONE_METADATA_HASH_LABEL));
+function isTombstoneRecord(record2) {
+  return record2.dataHash.toLowerCase() === TOMBSTONE_DATA_HASH && record2.metadataHash.toLowerCase() === TOMBSTONE_METADATA_HASH;
+}
+
+// ../core/dist/sync/data-point-id.js
+function computeDataPointId(ownerAddress, scope) {
+  return keccak256(encodeAbiParameters([
+    { name: "ownerAddress", type: "address" },
+    { name: "scope", type: "string" }
+  ], [ownerAddress.toLowerCase(), scope]));
+}
+
+// ../core/dist/lineage/lineage.js
+var LINEAGE_KEY = "$lineage";
+var BYTES32_HEX = /^0x[0-9a-fA-F]{64}$/;
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+var StoredLineageMalformedError = class extends Error {
+  constructor(detail) {
+    super(`Stored $lineage is malformed: ${detail}`);
+    this.name = "StoredLineageMalformedError";
+  }
+};
+function readStoredLineage(data) {
+  if (!isRecord2(data) || !(LINEAGE_KEY in data))
+    return null;
+  const value = data[LINEAGE_KEY];
+  if (!isRecord2(value)) {
+    throw new StoredLineageMalformedError("not an object");
+  }
+  const sources = value.sources;
+  if (!Array.isArray(sources) || !sources.every((id) => typeof id === "string" && BYTES32_HEX.test(id))) {
+    throw new StoredLineageMalformedError("sources is not a list of bytes32 ids");
+  }
+  if (typeof value.writtenAt !== "string") {
+    throw new StoredLineageMalformedError("writtenAt is not a string");
+  }
+  return {
+    sources: sources.map((id) => id.toLowerCase()),
+    writtenAt: value.writtenAt
+  };
+}
+
+// ../core/dist/storage/adapters/interface.js
+var StoredBlobConflictError = class extends Error {
+  key;
+  constructor(key) {
+    super(`Storage key ${key} already holds different bytes`);
+    this.key = key;
+    this.name = "StoredBlobConflictError";
+  }
+};
+
+// ../core/dist/publication/publish.js
+var NeedsFencedPublicationError = class extends Error {
+  scope;
+  reason;
+  retryable;
+  code = "NEEDS_FENCED_PUBLICATION";
+  constructor(scope, reason, retryable = true) {
+    super(`Needs fenced publication for ${scope}: ${reason}`);
+    this.scope = scope;
+    this.reason = reason;
+    this.retryable = retryable;
+    this.name = "NeedsFencedPublicationError";
+  }
+};
+var sameHash = (a2, b2) => a2.toLowerCase() === b2.toLowerCase();
+function metadata(scope, collectedAt, sizeBytes) {
+  return keccak256(stringToHex(JSON.stringify({ scope, collectedAt, sizeBytes })));
+}
+async function publishVersion(options) {
+  const { envelope, storageAdapter } = options;
+  const { scope } = envelope;
+  const password = Array.from(deriveScopeKey(options.masterKey, scope), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const plaintext = new TextEncoder().encode(JSON.stringify(envelope));
+  const lineage = readStoredLineage(envelope.data);
+  function candidate(env, bytes, hash3) {
+    return {
+      dataHash: hash3,
+      metadataHash: metadata(scope, env.collectedAt, bytes.byteLength),
+      sizeBytes: bytes.byteLength,
+      lineage: readStoredLineage(env.data)
+    };
+  }
+  return publishPreparedVersion({
+    ...options,
+    scope,
+    storageAdapter,
+    async prepare() {
+      const encrypted = await encryptWithPassword(plaintext, password);
+      return {
+        encrypted,
+        wanted: {
+          ...candidate(envelope, encrypted, keccak256(plaintext)),
+          lineage
+        },
+        async verifyStored(bytes) {
+          const clear = await decryptWithPassword(bytes, password);
+          const env = DataFileEnvelopeSchema.parse(JSON.parse(new TextDecoder().decode(clear)));
+          if (env.scope !== scope || !Number.isFinite(Date.parse(env.collectedAt)))
+            throw new Error("Publication envelope scope/timestamp mismatch");
+          return candidate(env, bytes, keccak256(clear));
+        }
+      };
+    }
+  });
+}
+async function publishPreparedVersion(options) {
+  const { scope, storageAdapter, fencedPublication, signer } = options;
+  const isDeleted = (row) => Boolean(row.deletedAt) || isTombstoneRecord(row);
+  let fence = await fencedPublication?.read({
+    ownerAddress: options.ownerAddress,
+    scope
+  });
+  let head = fence ? fence.head : options.head;
+  await options.checkHead?.(head ?? null);
+  function requireFence(reason) {
+    if (!fence)
+      throw new NeedsFencedPublicationError(scope, reason);
+    return fence;
+  }
+  function checkDeletion() {
+    if (!head || !isDeleted(head))
+      return;
+    requireFence("publication crosses a deletion");
+    if (options.acknowledgedDeletionVersion !== BigInt(head.expectedVersion))
+      throw new NeedsFencedPublicationError(scope, "tombstone was not acknowledged by this publication");
+  }
+  checkDeletion();
+  const { encrypted, wanted, verifyStored } = await options.prepare();
+  const wantedHash = wanted.dataHash;
+  const keyUrl = (version5) => storageAdapter.urlForKey(`${scope}/${version5}`);
+  async function readCandidate(version5) {
+    const bytes = await storageAdapter.download(keyUrl(version5));
+    return verifyStored(bytes);
+  }
+  async function commit(version5, value, mode) {
+    const request = {
+      ownerAddress: options.ownerAddress,
+      scope,
+      dataHash: value.dataHash,
+      metadataHash: value.metadataHash,
+      expectedVersion: String(version5),
+      signature: await signer.signAddData({
+        ownerAddress: options.ownerAddress,
+        scope,
+        dataHash: value.dataHash,
+        metadataHash: value.metadataHash,
+        expectedVersion: version5
+      })
+    };
+    const lineage = value.lineage;
+    let lineageFields;
+    if (lineage) {
+      if (!signer.signLineageAttestation || !fencedPublication && !options.lineageGateway)
+        throw new Error(`Cannot register derivative ${scope}: lineage registration needs a gateway URL (lineageGateway is not configured)`);
+      lineageFields = {
+        lineage: lineage.sources,
+        lineageSignature: await signer.signLineageAttestation({
+          ownerAddress: options.ownerAddress,
+          scope,
+          expectedVersion: version5,
+          dataHash: value.dataHash,
+          sources: lineage.sources
+        })
+      };
+    }
+    let id;
+    if (fencedPublication) {
+      const previous = requireFence("registration/adoption");
+      const result = await fencedPublication.commit({
+        ...request,
+        ...lineageFields,
+        mode,
+        fence: previous
+      });
+      const registered = result.fence.head;
+      if (result.fence.generation !== previous.generation || !registered || isDeleted(registered) || registered.expectedVersion !== String(version5) || !sameHash(registered.dataHash, value.dataHash) || !sameHash(registered.metadataHash, value.metadataHash) || registered.id !== result.dataPointId)
+        throw new Error("Gateway returned inconsistent publication evidence");
+      fence = result.fence;
+      head = registered;
+      id = result.dataPointId;
+    } else if (mode === "adopt") {
+      id = head?.id;
+    } else {
+      const result = lineageFields ? await options.lineageGateway.registerDataPoint({
+        ...request,
+        ...lineageFields
+      }) : await options.gateway.registerDataPoint(request);
+      id = result.dataPointId;
+    }
+    if (!id)
+      throw new Error(`Gateway registerDataPoint did not return a dataPointId for ${scope} version ${version5}`);
+    return {
+      version: version5,
+      url: keyUrl(version5),
+      dataPointId: id,
+      sizeBytes: value.sizeBytes,
+      dataHash: value.dataHash,
+      metadataHash: value.metadataHash
+    };
+  }
+  let version4 = head === void 0 ? options.preferredVersion : BigInt(head?.expectedVersion ?? "0") + 1n;
+  let rebased = false;
+  for (let step = 0; step < 4; step++) {
+    checkDeletion();
+    if (head && !isDeleted(head) && sameHash(head.dataHash, wantedHash)) {
+      version4 = BigInt(head.expectedVersion);
+      const url2 = keyUrl(version4);
+      if (!await storageAdapter.exists(url2)) {
+        requireFence("healing a committed version's missing bytes");
+        if (!sameHash(wanted.metadataHash, head.metadataHash))
+          throw new Error("Missing committed blob cannot be healed: metadata commitment mismatch");
+        try {
+          await storageAdapter.upload(`${scope}/${version4}`, encrypted);
+        } catch (error51) {
+          if (!(error51 instanceof StoredBlobConflictError))
+            throw error51;
+        }
+      }
+      const value2 = await readCandidate(version4);
+      if (!sameHash(value2.dataHash, head.dataHash) || !sameHash(value2.metadataHash, head.metadataHash))
+        throw new Error("Adopted publication commitment mismatch");
+      return commit(version4, value2, "adopt");
+    }
+    if (fence)
+      version4 = BigInt(head?.expectedVersion ?? "0") + 1n;
+    if (head && BigInt(head.expectedVersion) >= version4)
+      version4 = BigInt(head.expectedVersion) + 1n;
+    let value = wanted;
+    try {
+      await storageAdapter.upload(`${scope}/${version4}`, encrypted);
+    } catch (error51) {
+      if (!(error51 instanceof StoredBlobConflictError))
+        throw error51;
+      value = await readCandidate(version4);
+      if (!sameHash(value.dataHash, wantedHash))
+        requireFence("resuming an occupied unregistered version");
+    }
+    try {
+      const result = await commit(version4, value, "register");
+      if (sameHash(value.dataHash, wantedHash))
+        return result;
+      version4++;
+    } catch (error51) {
+      if (fencedPublication || !(error51 instanceof Error) || !/Gateway error: 409\b/.test(error51.message))
+        throw error51;
+      if (rebased)
+        throw error51;
+      rebased = true;
+      head = await options.readHead();
+      await options.checkHead?.(head);
+      checkDeletion();
+      const next = parseGatewayNextVersion(error51.message);
+      if (!head && next === null)
+        throw error51;
+      const observedNext = BigInt(head?.expectedVersion ?? "0") + 1n;
+      if (next !== null && BigInt(next) > observedNext)
+        requireFence("gateway version hint advances beyond the observed registry head");
+      version4 = observedNext;
+    }
+  }
+  throw new Error(`Publication contention for ${scope}; retry next cycle`);
+}
+function parseGatewayNextVersion(message) {
+  const nextValid = message.match(/next valid version is (\d+)/i);
+  if (nextValid)
+    return Number(nextValid[1]);
+  const effectiveMax = message.match(/effective max \((\d+)/i);
+  if (effectiveMax)
+    return Number(effectiveMax[1]) + 1;
+  const storedValue = message.match(/strictly greater than the stored value (\d+)/i);
+  return storedValue ? Number(storedValue[1]) + 1 : null;
+}
+
 // ../core/dist/additions/version-inventory.js
 var uint256 = external_exports.string().regex(/^(0|[1-9][0-9]{0,77})$/).refine((value) => BigInt(value) < 2n ** 256n);
 var hash2 = external_exports.string().regex(/^0x[0-9a-fA-F]{64}$/).transform((value) => value.toLowerCase());
@@ -29763,7 +30045,7 @@ function createVersionInventoryClient(options) {
   async function list(scope, readOptions = {}) {
     const maxPages = external_exports.number().int().positive().parse(readOptions.maxPages ?? 1e3);
     let after = "0";
-    let head = null;
+    let head2 = null;
     const versions = [];
     for (let count = 0; count < maxPages; count++) {
       const result = await page(scope, {
@@ -29771,12 +30053,12 @@ function createVersionInventoryClient(options) {
         signal: readOptions.signal,
         budget: readOptions.budget
       });
-      if (count > 0 && JSON.stringify(head) !== JSON.stringify(result.data.head))
+      if (count > 0 && JSON.stringify(head2) !== JSON.stringify(result.data.head))
         throw new Error("Gateway inventory head changed during traversal");
-      head = result.data.head;
+      head2 = result.data.head;
       versions.push(...result.data.versions);
       if (!result.pagination.hasMore)
-        return { head, versions };
+        return { head: head2, versions };
       const next = result.pagination.nextAfter;
       if (next === null)
         throw new Error("Gateway inventory missing next cursor");
@@ -29818,12 +30100,25 @@ function createVersionInventoryClient(options) {
     }
     throw new Error("Gateway scope page budget exceeded");
   }
-  return { page, list, listScopes };
+  async function head(scope, signal) {
+    const current = (await page(scope, { limit: 1, signal })).data.head;
+    return current ? {
+      expectedVersion: current.expectedVersion,
+      deletedAt: current.deletedAt
+    } : null;
+  }
+  return { page, list, listScopes, head };
+}
+
+// ../core/dist/replication/namespace.js
+var REPLICA_SCOPE_PREFIX = "pdpp_replica_v1";
+function isReplicaScope(scope) {
+  return scope === REPLICA_SCOPE_PREFIX || scope.startsWith(`${REPLICA_SCOPE_PREFIX}.`);
 }
 
 // ../core/dist/policy/reserved-scopes.js
 function isSystemScope(scope) {
-  return scope.startsWith("vana.system.");
+  return scope.startsWith("vana.system.") || isReplicaScope(scope);
 }
 
 // ../core/dist/additions/durable.js
@@ -29851,14 +30146,27 @@ function additionsLedgerScope(scope) {
   const literal2 = `${ADDITIONS_SUMMARY_SCOPE}.${scope}`;
   return new TextEncoder().encode(literal2).byteLength <= 256 ? literal2 : `vana.system.additions-hash.${keccak256(stringToHex(scope)).slice(2)}`;
 }
+var AdditionsRecoveryError = class extends Error {
+  code;
+  constructor(code, message = code) {
+    super(message);
+    this.code = code;
+    this.name = "AdditionsRecoveryError";
+  }
+};
 var InaccessibleLedger = class extends Error {
 };
+var CheckpointSearchExceeded = class extends AdditionsBudgetExceeded {
+};
+var CHECKPOINT_READ_LIMIT = 256;
 var BoundedWorkUnavailable = class extends Error {
 };
 var ReadBudget = class _ReadBudget extends AdditionsBudget {
   limited;
+  checkpoints;
   constructor(options, parent) {
     super(options.byteBudget, options.timeBudgetMs, options.signal, parent);
+    this.checkpoints = parent?.checkpoints ?? { reads: 0, rejected: /* @__PURE__ */ new Map() };
     this.limited = options.byteBudget !== void 0 || options.timeBudgetMs !== void 0;
   }
   /** A failed source unit cannot spend the bytes held for its durable prefix. */
@@ -29891,6 +30199,27 @@ function sameInventory(a2, b2) {
 function settled(slot) {
   return slot.status === "confirmed" || slot.status === "finalized";
 }
+function eligible(slot) {
+  return !slot.isTombstone && ["confirmed", "finalized", "pending", "submitting"].includes(slot.status);
+}
+function sourceWindow(snapshot) {
+  const end = BigInt(snapshot.head?.expectedVersion ?? "0");
+  const rows = snapshot.versions.filter((slot) => BigInt(slot.expectedVersion) <= end);
+  const after = BigInt(rows.filter((slot) => slot.isTombstone && settled(slot)).at(-1)?.expectedVersion ?? "0");
+  return {
+    end,
+    after,
+    relevant: rows.filter((slot) => BigInt(slot.expectedVersion) > after)
+  };
+}
+function findCheckpointRegistration(snapshot, version4, commitment) {
+  if (!snapshot.head || snapshot.head.deletedAt !== null)
+    return void 0;
+  const { end, after } = sourceWindow(snapshot);
+  if (BigInt(version4) > end || BigInt(version4) <= after)
+    return void 0;
+  return snapshot.versions.find((row) => row.expectedVersion === version4 && eligible(row) && row.dataHash.toLowerCase() === commitment.dataHash.toLowerCase() && row.metadataHash.toLowerCase() === commitment.metadataHash.toLowerCase());
+}
 function sourceData(data) {
   if (data === null || typeof data !== "object" || Array.isArray(data))
     return null;
@@ -29908,19 +30237,31 @@ function createDurableAdditions(options) {
     if (!budget.limited)
       budget.check(encrypted.byteLength);
     const password = hex3(deriveScopeKey(options.masterKey, scope));
-    const plaintext = budget.limited && options.boundedWork ? await options.boundedWork.decrypt(encrypted, password, budget) : await decryptWithPassword(encrypted, password);
+    let plaintext;
+    try {
+      plaintext = budget.limited && options.boundedWork ? await options.boundedWork.decrypt(encrypted, password, budget) : await decryptWithPassword(encrypted, password);
+    } catch (error51) {
+      if (error51 instanceof AdditionsRecoveryError || error51 instanceof AdditionsBudgetExceeded || budget.signal?.aborted)
+        throw error51;
+      throw new AdditionsRecoveryError("decrypt_failed");
+    }
     budget.check(plaintext.byteLength);
     if (keccak256(plaintext).toLowerCase() !== slot.dataHash.toLowerCase())
-      throw new Error("Additions content commitment mismatch");
+      throw new AdditionsRecoveryError("data_hash_mismatch", "Additions content commitment mismatch");
     budget.check(plaintext.byteLength * 3);
-    const envelope = DataFileEnvelopeSchema.parse(JSON.parse(new TextDecoder().decode(plaintext)));
+    let envelope;
+    try {
+      envelope = DataFileEnvelopeSchema.parse(JSON.parse(new TextDecoder().decode(plaintext)));
+    } catch {
+      throw new AdditionsRecoveryError("invalid_envelope");
+    }
     const metadataHash = keccak256(stringToHex(JSON.stringify({
       scope,
       collectedAt: envelope.collectedAt,
       sizeBytes: encrypted.byteLength
     })));
     if (envelope.scope !== scope || !Number.isFinite(Date.parse(envelope.collectedAt)) || metadataHash.toLowerCase() !== slot.metadataHash.toLowerCase())
-      throw new Error("Additions metadata commitment mismatch");
+      throw new AdditionsRecoveryError("metadata_hash_mismatch", "Additions metadata commitment mismatch");
     budget.check();
     return envelope;
   }
@@ -29931,21 +30272,50 @@ function createDurableAdditions(options) {
     const head = snapshot.head;
     if (!head || head.deletedAt !== null)
       return null;
-    const slot = snapshot.versions.find((row) => row.expectedVersion === head.expectedVersion && !row.isTombstone && row.dataHash === head.dataHash && row.metadataHash === head.metadataHash);
+    const slot = findCheckpointRegistration(snapshot, head.expectedVersion, head);
     if (!slot)
       throw new Error("Additions head missing from inventory");
     return { snapshot, envelope: await readEnvelope(scope, slot, budget) };
   }
-  async function readDocument(scope, budget) {
+  async function readDocument(scope, budget, source, search) {
+    const { relevant, after } = sourceWindow(source);
     const systemScope = additionsLedgerScope(scope);
     const snapshot = await inventory.list(systemScope, budget.readOptions);
     if (!snapshot.head || snapshot.head.deletedAt !== null)
       return null;
-    const boundary = snapshot.versions.filter((row) => row.isTombstone).at(-1)?.expectedVersion ?? "0";
+    const boundary = snapshot.versions.filter((row) => row.isTombstone && settled(row) && BigInt(row.expectedVersion) <= BigInt(snapshot.head.expectedVersion)).at(-1)?.expectedVersion ?? "0";
     let inaccessible = false;
-    for (const slot of [...snapshot.versions].reverse()) {
-      if (BigInt(slot.expectedVersion) <= BigInt(boundary) || BigInt(slot.expectedVersion) > BigInt(snapshot.head.expectedVersion) || slot.isTombstone)
+    const sourceFingerprint = fingerprintVersionInventory(source);
+    for (let index = snapshot.versions.length - 1; index >= 0; index--) {
+      budget.check();
+      const slot = snapshot.versions[index];
+      if (BigInt(slot.expectedVersion) <= BigInt(boundary) || BigInt(slot.expectedVersion) > BigInt(snapshot.head.expectedVersion) || search && BigInt(slot.expectedVersion) >= BigInt(search.before) || !eligible(slot))
         continue;
+      const identity = JSON.stringify([
+        systemScope,
+        slot.expectedVersion,
+        slot.dataHash.toLowerCase(),
+        slot.metadataHash.toLowerCase(),
+        sourceFingerprint
+      ]);
+      const rejected = budget.checkpoints.rejected.get(identity);
+      if (rejected !== void 0) {
+        inaccessible ||= rejected === "inaccessible";
+        continue;
+      }
+      if (budget.checkpoints.reads >= CHECKPOINT_READ_LIMIT) {
+        try {
+          options.onRecoveryDiagnostic?.({
+            scope,
+            version: slot.expectedVersion,
+            code: "checkpoint_search_exhausted"
+          });
+        } catch {
+        }
+        throw new CheckpointSearchExceeded("Retained checkpoint search exhausted");
+      }
+      budget.check(identity.length * 2 + 64);
+      budget.checkpoints.reads++;
       let envelope;
       try {
         envelope = await readEnvelope(systemScope, slot, budget);
@@ -29953,18 +30323,30 @@ function createDurableAdditions(options) {
         if (error51 instanceof AdditionsBudgetExceeded || budget.signal?.aborted)
           throw error51;
         inaccessible = true;
+        budget.checkpoints.rejected.set(identity, "inaccessible");
         continue;
       }
       const parsed = documentSchema.safeParse(envelope.data);
-      if (!parsed.success || parsed.data.owner !== owner || parsed.data.network !== options.network || parsed.data.scope !== scope)
+      if (!parsed.success || parsed.data.owner !== owner || parsed.data.network !== options.network || parsed.data.scope !== scope) {
+        budget.checkpoints.rejected.set(identity, "invalid");
         continue;
+      }
       const ledger = parsed.data.ledger === null ? null : readScopeFirstSeenLedger(parsed.data.ledger);
-      if (parsed.data.ledger !== null && (!ledger || ledger.scope !== scope))
+      if (parsed.data.ledger !== null && (!ledger || ledger.scope !== scope)) {
+        budget.checkpoints.rejected.set(identity, "invalid");
+        continue;
+      }
+      const candidate = { ...parsed.data, ledger };
+      if (candidate.slots.length > relevant.length || !candidate.slots.every((row, i2) => eligible(relevant[i2]) && sameCommitment(row, relevant[i2])) || candidate.through !== (candidate.slots.at(-1)?.expectedVersion ?? String(after))) {
+        budget.checkpoints.rejected.set(identity, "invalid");
+        continue;
+      }
+      if (search && candidate.slots.length <= search.longerThan)
         continue;
       return {
-        ...parsed.data,
-        ledger,
-        ...slot.expectedVersion !== snapshot.head.expectedVersion ? { repairHead: true } : {}
+        document: candidate,
+        publicationVersion: slot.expectedVersion,
+        repairHead: slot.expectedVersion !== snapshot.head.expectedVersion
       };
     }
     if (inaccessible)
@@ -29976,48 +30358,44 @@ function createDurableAdditions(options) {
     if (budget.limited) {
       if (!options.boundedWork)
         throw new BoundedWorkUnavailable("Bounded checkpoint publication unavailable");
-      const proof = await options.boundedWork.publish(scope, data, budget);
+      const proof2 = await options.boundedWork.publish(scope, data, budget);
       budget.check();
       const check3 = await inventory.list(scope, budget.readOptions);
-      const slot = check3.versions.find((row) => row.expectedVersion === proof.expectedVersion && row.dataHash === proof.dataHash && row.metadataHash === proof.metadataHash);
+      const slot = findCheckpointRegistration(check3, proof2.expectedVersion, proof2);
       if (!slot)
         throw new Error("Bounded checkpoint registration was replaced");
-      const envelope2 = await readEnvelope(scope, slot, budget);
-      if (JSON.stringify(envelope2.data) !== JSON.stringify(data))
+      const envelope = await readEnvelope(scope, slot, budget);
+      if (JSON.stringify(envelope.data) !== JSON.stringify(data))
         throw new Error("Bounded checkpoint content was replaced");
       budget.check();
       await options.boundedWork.confirmed?.(scope, budget);
       return;
     }
     const snapshot = await inventory.list(scope, budget.readOptions);
-    const version4 = BigInt(snapshot.versions.at(-1)?.expectedVersion ?? "0") + 1n;
-    const envelope = createDataFileEnvelope(scope, (/* @__PURE__ */ new Date()).toISOString(), data);
-    const plaintext = new TextEncoder().encode(JSON.stringify(envelope));
-    const encrypted = await encryptWithPassword(plaintext, hex3(deriveScopeKey(options.masterKey, scope)));
-    const dataHash = keccak256(plaintext);
-    const metadataHash = keccak256(stringToHex(JSON.stringify({
-      scope,
-      collectedAt: envelope.collectedAt,
-      sizeBytes: encrypted.byteLength
-    })));
-    await storageAdapter.upload(`${scope}/${version4}`, encrypted);
-    const signature = await options.signer.signAddData({
-      ownerAddress: getAddress(owner),
-      scope,
-      dataHash,
-      metadataHash,
-      expectedVersion: version4
-    });
-    await options.gateway.registerDataPoint({
+    const toHead = (state) => state.head ? {
+      ...state.head,
+      id: computeDataPointId(owner, scope)
+    } : null;
+    const proof = await publishVersion({
       ownerAddress: owner,
-      scope,
-      dataHash,
-      metadataHash,
-      expectedVersion: String(version4),
-      signature
+      envelope: createDataFileEnvelope(scope, (/* @__PURE__ */ new Date()).toISOString(), data),
+      preferredVersion: BigInt(snapshot.versions.at(-1)?.expectedVersion ?? "0") + 1n,
+      masterKey: options.masterKey,
+      storageAdapter,
+      signer: options.signer,
+      gateway: options.gateway,
+      fencedPublication: options.fencedPublication,
+      head: toHead(snapshot),
+      readHead: async () => toHead(await inventory.list(scope, budget.readOptions)),
+      // Rebuilding an explicitly deleted system document is a deliberate re-add.
+      acknowledgedDeletionVersion: snapshot.head?.deletedAt ? BigInt(snapshot.head.expectedVersion) : void 0
+    }).catch((error51) => {
+      if (error51 instanceof NeedsFencedPublicationError)
+        options.onPublicationBlocked?.(error51);
+      throw error51;
     });
     const check2 = await inventory.list(scope, budget.readOptions);
-    const registered = check2.versions.find((slot) => slot.expectedVersion === String(version4) && slot.dataHash === dataHash && slot.metadataHash === metadataHash);
+    const registered = findCheckpointRegistration(check2, String(proof.version), proof);
     if (!registered)
       throw new Error("Concurrent additions publication replaced the registration");
     await readEnvelope(scope, registered, budget);
@@ -30038,21 +30416,18 @@ function createDurableAdditions(options) {
         coverage: !sameInventory(snapshot, check2) ? "behind" : head ? settled(head) && tombstone ? "complete" : "partial" : snapshot.versions.length ? "partial" : "complete"
       };
     }
-    const end = BigInt(head.expectedVersion);
-    const rows = snapshot.versions.filter((slot) => BigInt(slot.expectedVersion) <= end);
-    const boundary = rows.filter((slot) => slot.isTombstone && settled(slot)).at(-1);
-    const after = BigInt(boundary?.expectedVersion ?? "0");
-    const relevant = rows.filter((slot) => BigInt(slot.expectedVersion) > after);
-    let existing = null;
+    const { end, after, relevant } = sourceWindow(snapshot);
+    let checkpoint = null;
     let inaccessibleExisting = false;
     try {
-      existing = await readDocument(scope, budget);
+      checkpoint = await readDocument(scope, budget, snapshot);
     } catch (error51) {
       if (error51 instanceof AdditionsBudgetExceeded || budget.signal?.aborted)
         throw error51;
       inaccessibleExisting = true;
     }
-    const prefixValid = existing !== null && existing.slots.length <= relevant.length && existing.slots.every((slot, i2) => sameCommitment(slot, relevant[i2])) && existing.through === (existing.slots.at(-1)?.expectedVersion ?? String(after));
+    let existing = checkpoint?.document ?? null;
+    const prefixValid = existing !== null;
     let ledger = prefixValid ? existing.ledger : null;
     const folded = prefixValid ? relevant.slice(0, existing.slots.length) : [];
     let currentTotal = prefixValid ? existing.currentTotal : 0;
@@ -30065,6 +30440,7 @@ function createDurableAdditions(options) {
         coverage = "partial";
       expected = BigInt(slot.expectedVersion) + 1n;
     }
+    const sourceCoverage = coverage;
     const checkpointBytes = (candidate, count) => 128 * 1024 + 128 * new TextEncoder().encode(JSON.stringify({
       ledger: candidate,
       slots: relevant.slice(0, count),
@@ -30074,17 +30450,15 @@ function createDurableAdditions(options) {
       through,
       currentTotal
     })).byteLength;
-    for (const slot of relevant.slice(folded.length)) {
+    while (folded.length < relevant.length) {
+      const slot = relevant[folded.length];
+      let unitBudget = budget;
       try {
-        const unitBudget = budget.limited ? budget.excluding(checkpointBytes(ledger, folded.length)) : budget;
+        unitBudget = budget.limited ? budget.excluding(checkpointBytes(ledger, folded.length)) : budget;
         unitBudget.check();
         if (BigInt(slot.expectedVersion) !== BigInt(through) + 1n)
           coverage = "partial";
-        if (slot.status === "failed" || !["confirmed", "finalized", "pending", "submitting"].includes(slot.status)) {
-          coverage = "partial";
-          break;
-        }
-        if (slot.isTombstone) {
+        if (!eligible(slot)) {
           coverage = "partial";
           break;
         }
@@ -30092,21 +30466,21 @@ function createDurableAdditions(options) {
         const proof = uploaded?.proof;
         const inMemory = proof ? DataFileEnvelopeSchema.safeParse(proof.envelope) : null;
         const bytes = proof ? new TextEncoder().encode(JSON.stringify(proof.envelope)) : null;
-        const metadata = inMemory?.success && proof ? keccak256(stringToHex(JSON.stringify({
+        const metadata2 = inMemory?.success && proof ? keccak256(stringToHex(JSON.stringify({
           scope,
           collectedAt: inMemory.data.collectedAt,
           sizeBytes: proof.encryptedSize
         }))) : null;
-        if (inMemory?.success && bytes && inMemory.data.scope === scope && keccak256(bytes) === slot.dataHash && metadata === slot.metadataHash) {
+        if (inMemory?.success && bytes && inMemory.data.scope === scope && keccak256(bytes) === slot.dataHash && metadata2 === slot.metadataHash) {
           const data = sourceData(inMemory.data.data);
           if (!data)
-            throw new Error("Unsupported source envelope");
+            throw new AdditionsRecoveryError("unsupported_source_data");
           version4 = { scope, collectedAt: inMemory.data.collectedAt, data };
         } else {
           const envelope = await readEnvelope(scope, slot, unitBudget);
           const data = sourceData(envelope.data);
           if (!data)
-            throw new Error("Unsupported source envelope");
+            throw new AdditionsRecoveryError("unsupported_source_data");
           version4 = { scope, collectedAt: envelope.collectedAt, data };
         }
         const hadBaseline = ledger !== null && ledger.baseline !== null;
@@ -30124,7 +30498,39 @@ function createDurableAdditions(options) {
         folded.push(slot);
         through = slot.expectedVersion;
       } catch (error51) {
-        coverage = error51 instanceof AdditionsBudgetExceeded || budget.signal?.aborted ? "behind" : "partial";
+        if (checkpoint && !budget.signal?.aborted) {
+          const searchBudget = budget.limited ? budget.excluding(checkpointBytes(ledger, folded.length)) : budget;
+          try {
+            const fallback = await readDocument(scope, searchBudget, snapshot, {
+              before: checkpoint.publicationVersion,
+              longerThan: folded.length
+            });
+            if (fallback) {
+              checkpoint = fallback;
+              existing = fallback.document;
+              ledger = existing.ledger;
+              currentTotal = existing.currentTotal;
+              through = existing.through;
+              folded.splice(0, folded.length, ...relevant.slice(0, existing.slots.length));
+              coverage = sourceCoverage;
+              continue;
+            }
+          } catch (failure) {
+            if (failure instanceof AdditionsBudgetExceeded)
+              error51 = failure;
+            else if (searchBudget.signal?.aborted)
+              error51 = new AdditionsBudgetExceeded("Checkpoint fallback allowance exhausted");
+          }
+        }
+        try {
+          options.onRecoveryDiagnostic?.({
+            scope,
+            version: slot.expectedVersion,
+            code: error51 instanceof AdditionsBudgetExceeded || unitBudget.signal?.aborted && unitBudget.signal.reason instanceof DOMException && unitBudget.signal.reason.name === "TimeoutError" ? "budget_exceeded" : budget.signal?.aborted ? "cancelled" : error51 instanceof AdditionsRecoveryError ? error51.code : "replay_failed"
+          });
+        } catch {
+        }
+        coverage = error51 instanceof AdditionsBudgetExceeded || budget.signal?.aborted || unitBudget.signal?.aborted ? "behind" : "partial";
         break;
       }
     }
@@ -30153,7 +30559,7 @@ function createDurableAdditions(options) {
       slots: folded,
       ledger
     };
-    if ((!existing && !inaccessibleExisting || prefixValid || coverage === "complete") && JSON.stringify(document2) !== JSON.stringify(existing)) {
+    if ((!existing && !inaccessibleExisting || prefixValid || coverage === "complete") && (checkpoint?.repairHead || JSON.stringify(document2) !== JSON.stringify(existing))) {
       try {
         await publish(additionsLedgerScope(scope), { ...document2 }, budget);
       } catch {
@@ -30261,9 +30667,9 @@ function createDurableAdditions(options) {
           return;
         if (proof && keccak256(new TextEncoder().encode(JSON.stringify(proof.envelope))) !== head.dataHash)
           return;
-        const previous = await readDocument(version4.scope, budget);
-        const boundary = snapshot.versions.filter((slot) => slot.isTombstone && settled(slot)).at(-1)?.expectedVersion ?? "0";
-        const startsFresh = BigInt(head.expectedVersion) === BigInt(boundary) + 1n;
+        const previous = (await readDocument(version4.scope, budget, snapshot))?.document;
+        const { after } = sourceWindow(snapshot);
+        const startsFresh = BigInt(head.expectedVersion) === after + 1n;
         if (!startsFresh && (!previous || BigInt(previous.through) + 1n !== BigInt(head.expectedVersion)))
           return;
         const uploaded = !budget.limited && "collectedAt" in version4 && "data" in version4 ? { version: version4, proof } : void 0;
@@ -30271,9 +30677,13 @@ function createDurableAdditions(options) {
       } catch {
       }
     },
-    async deleteScope(scope) {
+    async deleteScope(scope, deletion) {
+      deletion?.signal?.throwIfAborted();
+      options.signal?.throwIfAborted();
       if (isSystemScope(scope))
         return;
+      if (deletion?.durableOnly)
+        throw new Error("Bounded additions deletion is unavailable");
       if (!options.deleteSystemScope)
         throw new Error("Durable additions deletion is unavailable");
       await options.deleteSystemScope(additionsLedgerScope(scope));
@@ -30300,12 +30710,24 @@ async function decryptBoundedAdditions(encrypted, password, budget) {
     ignoreMalformedPackets: false
   };
   const message = await no({ binaryMessage: encrypted, config: config2 });
-  const result = await po({
-    message,
-    passwords: [password],
-    format: "binary",
-    config: config2
-  });
+  let result;
+  try {
+    result = await po({
+      message,
+      passwords: [password],
+      format: "binary",
+      config: config2
+    });
+  } catch (error51) {
+    if (error51 instanceof Error && error51.message.includes(
+      "Compressed OpenPGP packets are unsupported in bounded recovery"
+    ))
+      throw new AdditionsRecoveryError(
+        "compressed_packet",
+        "Compressed OpenPGP packets are unsupported in bounded recovery"
+      );
+    throw error51;
+  }
   budget.charge();
   if (!(result.data instanceof Uint8Array))
     throw new Error("Unexpected OpenPGP stream");
@@ -30388,11 +30810,12 @@ function createService(init) {
   const reconciledScopes = /* @__PURE__ */ new Set();
   async function reconcilePending(scope, budget) {
     if (reconciledScopes.has(scope)) return null;
-    const prior = await transport("readPending", [scope], budget);
-    if (!prior) {
+    const pending2 = await transport("readPending", [scope], budget);
+    if (!pending2) {
       reconciledScopes.add(scope);
       return null;
     }
+    let prior = pending2;
     let snapshot = await inventory.list(scope, {
       budget,
       signal: budget.signal
@@ -30404,7 +30827,8 @@ function createService(init) {
     if (slot && replaced && !["confirmed", "finalized"].includes(slot.status))
       throw new Error("Pending checkpoint replacement is not settled");
     if (!slot) {
-      await transport("publish", [prior], budget);
+      const published = await transport("publish", [prior], budget);
+      prior = { ...prior, expectedVersion: published.expectedVersion };
       snapshot = await inventory.list(scope, {
         budget,
         signal: budget.signal
@@ -30413,7 +30837,7 @@ function createService(init) {
         (row) => row.expectedVersion === prior.expectedVersion
       );
     }
-    if (!slot || !replaced && (slot.dataHash !== prior.dataHash || slot.metadataHash !== prior.metadataHash))
+    if (!slot || !replaced && !findCheckpointRegistration(snapshot, prior.expectedVersion, prior))
       throw new Error("Interrupted checkpoint registration remains ambiguous");
     const proof = replaced ? slot : prior;
     let data;
@@ -30445,18 +30869,17 @@ function createService(init) {
         throw new Error("Interrupted checkpoint commitment mismatch");
       data = envelope.data;
     }
-    if (replaced) {
-      const latest = await inventory.list(scope, {
-        budget,
-        signal: budget.signal
-      });
-      if (!latest.versions.some(
-        (row) => row.expectedVersion === proof.expectedVersion && row.dataHash === proof.dataHash && row.metadataHash === proof.metadataHash && ["confirmed", "finalized"].includes(row.status)
-      ))
-        throw new Error(
-          "Pending checkpoint replacement changed during verification"
-        );
-    }
+    const latest = await inventory.list(scope, {
+      budget,
+      signal: budget.signal
+    });
+    const visible = slot.isTombstone ? latest.head && BigInt(proof.expectedVersion) <= BigInt(latest.head.expectedVersion) && latest.versions.find(
+      (row) => row.expectedVersion === proof.expectedVersion && row.dataHash === proof.dataHash && row.metadataHash === proof.metadataHash && row.isTombstone
+    ) : findCheckpointRegistration(latest, proof.expectedVersion, proof);
+    if (!visible || replaced && !["confirmed", "finalized"].includes(visible.status))
+      throw new Error(
+        "Interrupted checkpoint registration changed during verification"
+      );
     await transport("clearPending", [scope], budget);
     reconciledScopes.add(scope);
     return replaced ? null : { proof: prior, data };
@@ -30475,10 +30898,21 @@ function createService(init) {
     listScopes: async (options) => {
       activeBudget = options?.budget;
       return inventory.listScopes(options);
+    },
+    head: (scope, signal) => {
+      activeBudget = void 0;
+      return inventory.head(scope, signal);
     }
   };
+  const reported = /* @__PURE__ */ new Set();
   return createDurableAdditions({
     ...init,
+    onRecoveryDiagnostic: init.diagnostics ? (event) => {
+      const key = JSON.stringify(event);
+      if (reported.size >= 32 || reported.has(key)) return;
+      reported.add(key);
+      worker.postMessage({ kind: "diagnostic", event });
+    } : void 0,
     inventory: boundedInventory,
     storageAdapter: {
       urlForKey: (key) => key,
@@ -30550,8 +30984,7 @@ function createService(init) {
             )
           )
         };
-        await transport("publish", [prepared], budget);
-        return prepared;
+        return transport("publish", [prepared], budget);
       }
     }
   });
@@ -30566,7 +30999,11 @@ worker.onmessage = (event) => {
       request?.budget?.charge();
       if (message.error)
         request?.reject(
-          message.budgetExceeded ? new AdditionsBudgetExceeded(message.error) : new Error(message.error)
+          message.budgetExceeded ? new AdditionsBudgetExceeded(message.error) : message.publicationBlocked ? new NeedsFencedPublicationError(
+            message.publicationBlocked.scope,
+            message.publicationBlocked.reason,
+            false
+          ) : new Error(message.error)
         );
       else request?.resolve(message.result);
     } catch (error51) {