@openlfcp/client 0.1.0-rc.1

package/dist/apply.js

@@ -0,0 +1,741 @@
+import { actorSequence, bytesEqual, dataUnitId, fromHex, toHex, } from "@openlfcp/core";
+import { decryptDataUnit, deriveActorDataKey } from "@openlfcp/crypto";
+import { beyondCutoff, canonicalFrontierFromCbor, checkDataUnit, classifyDataUnit, dataUnitAad, parseDataUnit, receiveDataUnit, } from "@openlfcp/wire";
+import { decodeDeterministic } from "@openlfcp/wire/cbor";
+import { EngineGuard, isEngineTrap, unitItem } from "./engine-guard.js";
+import { dataUnitRow, StoredSeenUnits } from "./storage.js";
+/** A codec for bytes that do not parse: receiveDataUnit rejects them before any decode. */
+const unreachableCodec = (dataProfile) => ({
+    dataProfile,
+    encode: () => {
+        throw new Error("no codec for a malformed unit");
+    },
+    decode: () => {
+        throw new Error("no codec for a malformed unit");
+    },
+});
+const LFCP_ACCEPTED = ["merged", "profile-pending"];
+const CRASHED = "this unit crashed the profile engine twice, applied alone; it is not applied again on this device (local only)";
+const profileUnit = (view, r) => ({
+    unitId: r.unitId,
+    resourceId: view.state.resourceId,
+    actor: r.actor,
+    seq: r.seq,
+    epoch: r.epoch,
+});
+export class DataUnitApplier {
+    #options;
+    #handlers;
+    #storage;
+    #seen;
+    #guard;
+    /** Units quarantined by the crash-loop breaker at this start, not yet reported. */
+    #crashed = [];
+    constructor(options) {
+        this.#options = options;
+        this.#handlers = new Map(options.handlers.map((h) => [h.dataProfile, h]));
+        this.#storage = options.storage;
+        this.#seen = new StoredSeenUnits(options.storage);
+        this.#guard = new EngineGuard(options.storage, "units");
+    }
+    /** Once per Resource: a leftover apply record becomes suspects; second-time crashers are quarantined. */
+    async #recover(resource) {
+        const crashed = await this.#guard.recover(resource);
+        const writes = [];
+        for (const item of crashed) {
+            const unitId = dataUnitId(fromHex(item.slice("unit:".length)));
+            if ((await this.#storage.dataUnits.get(unitId)) === undefined)
+                continue;
+            writes.push({
+                op: "set-data-unit-status",
+                unitId,
+                status: "local-failure",
+                detail: `INVALID_AUTOMERGE_BYTES: ${CRASHED}`,
+            });
+            this.#crashed.push(unitId);
+        }
+        await this.#write(writes);
+    }
+    /** The unit's ID from its bytes, or undefined when they do not parse (reported by the LFCP checks). */
+    #idOf(bytes) {
+        try {
+            return parseDataUnit(bytes).signed.id;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    #crashOutcome(unitId) {
+        return Object.freeze({
+            kind: "engine-crash",
+            code: "INVALID_AUTOMERGE_BYTES",
+            unitId,
+            message: CRASHED,
+        });
+    }
+    async #write(writes) {
+        if (writes.length === 0)
+            return;
+        const r = await this.#storage.commit(writes);
+        if (!r.ok)
+            throw new Error(`unexpected storage precondition failure: ${r.reason}`);
+    }
+    /**
+     * Receives one Data Unit of the Resource `view` describes. Never creates
+     * a Data Unit: received content is applied, not re-sent as local work.
+     */
+    async receive(view, bytes) {
+        const R = view.state.resourceId;
+        await this.#recover(R);
+        const id = this.#idOf(bytes);
+        if (id !== undefined && this.#guard.suspicion(R, unitItem(id)) === 2)
+            return this.#crashOutcome(id);
+        return this.#guard.run(R, id === undefined ? [] : [unitItem(id)], async () => {
+            const v = await this.#verify(view, bytes);
+            if ("outcome" in v)
+                return v.outcome;
+            return v.r.kind === "accepted"
+                ? this.#apply(view, v.handler, v.r)
+                : this.#settle(view, v.handler, v.r);
+        });
+    }
+    /**
+     * Receives the units of one DATA_BATCH (or any run of units) of the
+     * Resource `view` describes: each passes the LFCP checks of receive in
+     * order, unchanged, and the accepted ones reach the profile together
+     * through the handler's applyBatch, when it has one. Outcomes come in the
+     * order of `units`. An applied unit's objects and diagnostics are those
+     * of the whole batch, reported on the last unit merged; the units
+     * buffered before that the batch unblocked count as merged by the first.
+     * Before an equivocation is handled, the units accepted so far are
+     * applied, so its exclusion sees them.
+     */
+    async receiveBatch(view, units) {
+        const handler = this.#handlers.get(view.state.dataProfile);
+        const outcomes = [];
+        if (handler?.applyBatch === undefined) {
+            for (const bytes of units)
+                outcomes.push(await this.receive(view, bytes));
+            return outcomes;
+        }
+        // Units that crashed the engine before go alone (receive), after the batch.
+        const R = view.state.resourceId;
+        await this.#recover(R);
+        const batch = [];
+        const alone = [];
+        for (const [index, bytes] of units.entries()) {
+            const id = this.#idOf(bytes);
+            if (id !== undefined && this.#guard.suspicion(R, unitItem(id)) > 0)
+                alone.push({ index, bytes });
+            else
+                batch.push({ index, bytes });
+        }
+        const items = batch.flatMap(({ bytes }) => {
+            const id = this.#idOf(bytes);
+            return id === undefined ? [] : [unitItem(id)];
+        });
+        const done = await this.#guard.run(R, items, () => this.#receiveBatch(view, handler, batch.map((b) => b.bytes)));
+        for (const [k, { index }] of batch.entries())
+            outcomes[index] = done[k];
+        for (const { index, bytes } of alone)
+            outcomes[index] = await this.receive(view, bytes);
+        return outcomes;
+    }
+    async #receiveBatch(view, handler, units) {
+        const outcomes = [];
+        let staged = [];
+        const flush = async () => {
+            const batch = staged;
+            staged = [];
+            for (const [index, outcome] of await this.#applyStaged(view, handler, batch))
+                outcomes[index] = outcome;
+        };
+        for (const [index, bytes] of units.entries()) {
+            const v = await this.#verify(view, bytes);
+            if ("outcome" in v)
+                outcomes[index] = v.outcome;
+            else if (v.r.kind === "accepted")
+                staged.push({ index, r: v.r });
+            else {
+                if (v.r.kind === "equivocation")
+                    await flush();
+                outcomes[index] = await this.#settle(view, v.handler, v.r);
+            }
+        }
+        await flush();
+        return outcomes;
+    }
+    /** The LFCP checks of one unit (receiveDataUnit), or the outcome when there is no handler. */
+    async #verify(view, bytes) {
+        const dataProfile = view.state.dataProfile;
+        let row;
+        try {
+            row = dataUnitRow(bytes);
+            this.#seen.expect(row);
+        }
+        catch {
+            row = undefined; // receiveDataUnit reports it as MALFORMED_MESSAGE
+        }
+        const handler = this.#handlers.get(dataProfile);
+        if (handler === undefined)
+            return { outcome: await this.#unsupported(view, bytes, dataProfile) };
+        const codec = row === undefined
+            ? unreachableCodec(dataProfile)
+            : handler.codecFor({ resourceId: row.resourceId, actor: row.actor });
+        const r = await receiveDataUnit(view, bytes, {
+            ...this.#options,
+            seen: this.#seen,
+            profile: codec,
+        });
+        // A decode that trapped the engine is not this unit's local failure.
+        if (r.kind === "local-failure" && isEngineTrap(r.error))
+            throw r.error;
+        return { handler, r };
+    }
+    /** A unit LFCP did not accept for merging: held, quarantined, failed locally, equivocating, … */
+    async #settle(view, handler, r) {
+        const status = (unitId, s, detail) => ({
+            op: "set-data-unit-status",
+            unitId,
+            status: s,
+            ...(detail === undefined ? {} : { detail }),
+        });
+        switch (r.kind) {
+            case "held":
+                await this.#write([status(r.unitId, "held", r.reason)]);
+                return r;
+            case "quarantined":
+                await this.#write([status(r.unitId, "quarantined", r.reason)]);
+                return r;
+            case "local-failure":
+                await this.#write([status(r.unitId, "local-failure", `${r.reason}: ${r.message}`)]);
+                return r;
+            case "equivocation":
+                return this.#equivocation(view, handler, r);
+            default:
+                return r; // duplicate (harmless replay) or rejected (never stored)
+        }
+    }
+    async #apply(view, handler, r) {
+        let result;
+        try {
+            result = handler.apply(profileUnit(view, r), r.value);
+        }
+        catch (e) {
+            if (isEngineTrap(e))
+                throw e; // the engine is gone: not the unit's refusal
+            const code = e.code;
+            return this.#rejected(r, handler.dataProfile, typeof code === "string" ? code : "PROFILE_REJECTED", e instanceof Error ? e.message : String(e));
+        }
+        return this.#merged(view, handler, r, result);
+    }
+    /** The staged accepted units through the handler's applyBatch, as #apply would one by one. */
+    async #applyStaged(view, handler, staged) {
+        if (staged.length === 0 || handler.applyBatch === undefined)
+            return [];
+        let batch;
+        try {
+            batch = handler.applyBatch(staged.map(({ r }) => ({ unit: profileUnit(view, r), value: r.value })));
+        }
+        catch (e) {
+            if (isEngineTrap(e))
+                throw e;
+            // The handler failed as a whole: apply one by one, which isolates the failing unit.
+            const out = [];
+            for (const { index, r } of staged)
+                out.push([index, await this.#apply(view, handler, r)]);
+            return out;
+        }
+        const merged = new Set(batch.merged.map((id) => toHex(id)));
+        const rejected = new Map(batch.rejected.map((x) => [toHex(x.unitId), x]));
+        const inBatch = new Set(staged.map(({ r }) => toHex(r.unitId)));
+        const unblocked = batch.merged.filter((id) => !inBatch.has(toHex(id)));
+        let last = -1;
+        staged.forEach(({ r }, k) => {
+            if (merged.has(toHex(r.unitId)))
+                last = k;
+        });
+        const out = [];
+        for (const [k, { index, r }] of staged.entries()) {
+            const key = toHex(r.unitId);
+            const refused = rejected.get(key);
+            if (refused !== undefined) {
+                out.push([
+                    index,
+                    await this.#rejected(r, handler.dataProfile, refused.code, refused.message),
+                ]);
+                continue;
+            }
+            const now = merged.has(key);
+            out.push([
+                index,
+                await this.#merged(view, handler, r, {
+                    merged: [...(now ? [r.unitId] : []), ...(k === 0 ? unblocked : [])],
+                    objects: k === last ? batch.objects : [],
+                    diagnostics: k === last ? batch.diagnostics : [],
+                    ...(now ? {} : { pending: "buffered by the profile" }),
+                }, false),
+            ]);
+        }
+        // §26.2 (G-DP1-GAP): held units whose previous names a unit of the batch
+        // may link now. One scan for the whole batch keeps it linear; each
+        // released unit is reported with the unit it links to.
+        const byPrevious = new Map(staged.map(({ index, r }) => [toHex(r.unitId), index]));
+        const held = await this.#storage.dataUnits.withStatus(view.state.resourceId, "held");
+        const releasedFor = new Map();
+        for (const h of held) {
+            const previous = parseDataUnit(h.bytes).payload.prevDataUnitId;
+            const owner = previous === null ? undefined : byPrevious.get(toHex(previous));
+            if (owner === undefined)
+                continue;
+            if ((await this.#storage.dataUnits.get(h.unitId))?.status !== "held")
+                continue;
+            releasedFor.set(owner, [
+                ...(releasedFor.get(owner) ?? []),
+                await this.receive(view, h.bytes),
+            ]);
+        }
+        return out.map(([index, outcome]) => {
+            const extra = releasedFor.get(index);
+            if (extra === undefined || !("released" in outcome))
+                return [index, outcome];
+            return [
+                index,
+                Object.freeze({ ...outcome, released: Object.freeze([...outcome.released, ...extra]) }),
+            ];
+        });
+    }
+    /** An accepted unit the profile refused: never merged. */
+    async #rejected(r, dataProfile, code, message) {
+        await this.#write([
+            { op: "set-data-unit-status", unitId: r.unitId, status: "profile-rejected", detail: message },
+        ]);
+        return Object.freeze({
+            kind: "profile-rejected",
+            unitId: r.unitId,
+            dataProfile,
+            code,
+            message,
+        });
+    }
+    /** An accepted unit the profile merged or buffered: its statuses, then held units it releases. */
+    async #merged(view, handler, r, result, releaseHeld = true) {
+        const dataProfile = handler.dataProfile;
+        const mergedNow = result.merged.some((id) => bytesEqual(id, r.unitId));
+        const alsoMerged = result.merged.filter((id) => !bytesEqual(id, r.unitId));
+        await this.#write([
+            mergedNow
+                ? { op: "set-data-unit-status", unitId: r.unitId, status: "merged" }
+                : {
+                    op: "set-data-unit-status",
+                    unitId: r.unitId,
+                    status: "profile-pending",
+                    detail: result.pending ?? "buffered by the profile",
+                },
+            ...alsoMerged.map((unitId) => ({ op: "set-data-unit-status", unitId, status: "merged" })),
+        ]);
+        // §26.2 (G-DP1, G-DP1-GAP): a held unit of this actor above it may link now, across a gap.
+        // A batch releases its held units once, at its end (#applyStaged).
+        const next = releaseHeld
+            ? await this.#storage.dataUnits.range(view.state.resourceId, r.actor, actorSequence(r.seq + 1n), actorSequence(2n ** 64n - 1n))
+            : [];
+        const released = [];
+        // Only a held unit whose previous names the unit just accepted can link now.
+        for (const held of next.filter((u) => u.status === "held")) {
+            const previous = parseDataUnit(held.bytes).payload.prevDataUnitId;
+            if (previous === null || !bytesEqual(previous, r.unitId))
+                continue;
+            // A retry above may already have released it.
+            if ((await this.#storage.dataUnits.get(held.unitId))?.status !== "held")
+                continue;
+            released.push(await this.receive(view, held.bytes));
+        }
+        const base = {
+            unitId: r.unitId,
+            dataProfile,
+            actor: r.actor,
+            seq: r.seq,
+            epoch: r.epoch,
+            haveEligible: false,
+            alsoMerged: Object.freeze(alsoMerged),
+            released: Object.freeze(released),
+        };
+        return Object.freeze(mergedNow
+            ? {
+                ...base,
+                kind: "applied",
+                objects: result.objects,
+                diagnostics: result.diagnostics,
+            }
+            : {
+                ...base,
+                kind: "profile-pending",
+                detail: result.pending ?? "buffered by the profile",
+            });
+    }
+    // §26.2 (G-DP5): exclude every merged unit of an equivocating set.
+    async #equivocation(view, handler, r) {
+        const stored = (await Promise.all(r.unitIds.map((id) => this.#storage.dataUnits.get(id)))).filter((u) => u !== undefined);
+        const merged = stored.filter((u) => LFCP_ACCEPTED.includes(u.status)).map((u) => u.unitId);
+        const result = merged.length > 0 ? handler.exclude(merged) : { objects: [], pending: [] };
+        await this.#write([
+            ...stored.flatMap((u) => [
+                {
+                    op: "set-data-unit-status",
+                    unitId: u.unitId,
+                    status: "equivocation",
+                    detail: "ACTOR_EQUIVOCATION (G-DP5)",
+                },
+                { op: "set-accepted", unitId: u.unitId, accepted: false },
+            ]),
+            ...result.pending.map((unitId) => ({
+                op: "set-data-unit-status",
+                unitId,
+                status: "profile-pending",
+                detail: "builds on an equivocating unit",
+            })),
+        ]);
+        // The actor's latest accepted unit may now be lower: held units can link (G-DP1-GAP).
+        const released = merged.length > 0 ? await this.#retryHeld(view, [r.actor]) : [];
+        return Object.freeze({
+            ...r,
+            excluded: Object.freeze(merged),
+            objects: result.objects,
+            pending: result.pending,
+            released,
+        });
+    }
+    /**
+     * After a restart: the stored, LFCP-accepted units (merged or buffered by
+     * the profile) whose content the restored profile state does not hold
+     * (merged after its last checkpoint), decrypted again from their exact
+     * stored bytes and applied, in (actor, seq) order. Units covered by a
+     * Snapshot are not replayed (their content came with it). Needs the
+     * handler's has(); returns what was replayed and what could not be (no
+     * DEK, refused). LFCP checks are not repeated: the units passed them when
+     * they were accepted.
+     */
+    async replayStored(view) {
+        const handler = this.#handlers.get(view.state.dataProfile);
+        const replayed = [];
+        const skipped = [];
+        if (handler?.has === undefined) {
+            await this.#recover(view.state.resourceId);
+            const crashed = this.#crashed;
+            this.#crashed = [];
+            return { replayed, skipped, crashed };
+        }
+        const resource = view.state.resourceId;
+        // A crash during an earlier apply: suspects, or units quarantined now.
+        await this.#recover(resource);
+        const crashed = this.#crashed;
+        this.#crashed = [];
+        // Also units accepted by LFCP whose merge was never recorded (a crash
+        // between the accepted mark and the status write leaves them "seen" or "held").
+        const stored = [
+            ...(await this.#storage.dataUnits.withStatus(resource, "merged")),
+            ...(await this.#storage.dataUnits.withStatus(resource, "profile-pending")),
+            ...(await this.#storage.dataUnits.withStatus(resource, "seen")),
+            ...(await this.#storage.dataUnits.withStatus(resource, "held")),
+        ]
+            .filter((u) => u.accepted && u.detail !== "covered by a Snapshot" && !handler.has?.(u.unitId))
+            .sort((a, b) => (a.actorSeq < b.actorSeq ? -1 : a.actorSeq > b.actorSeq ? 1 : 0));
+        const merged = [];
+        const pendingNow = [];
+        // Suspects of an earlier crash replay alone, each under its own record.
+        const suspect = (u) => this.#guard.suspicion(resource, unitItem(u.unitId)) > 0;
+        const groups = [...stored.filter(suspect).map((u) => [u]), stored.filter((u) => !suspect(u))];
+        for (const group of groups)
+            if (group.length > 0)
+                await this.#guard.run(resource, group.map((u) => unitItem(u.unitId)), () => this.#replayGroup(handler, group, { merged, pendingNow, replayed, skipped }));
+        await this.#write([
+            ...pendingNow
+                .filter((id) => !merged.some((m) => bytesEqual(m, id)))
+                .map((unitId) => ({
+                op: "set-data-unit-status",
+                unitId,
+                status: "profile-pending",
+                detail: "replayed; waiting for content it builds on",
+            })),
+            ...merged.map((unitId) => ({ op: "set-data-unit-status", unitId, status: "merged" })),
+        ]);
+        return {
+            replayed: Object.freeze(replayed),
+            skipped: Object.freeze(skipped),
+            crashed: Object.freeze(crashed),
+        };
+    }
+    /** Decrypts, decodes and applies replayed units (replayStored), adding to `acc`. */
+    async #replayGroup(handler, group, acc) {
+        const { merged, pendingNow, replayed, skipped } = acc;
+        const decoded = [];
+        for (const u of group) {
+            const dek = await this.#options.dek(u.dataEpoch);
+            if (dek === undefined) {
+                skipped.push({ unitId: u.unitId, reason: `no DEK for epoch ${u.dataEpoch}` });
+                continue;
+            }
+            try {
+                const p = parseDataUnit(u.bytes).payload;
+                const key = deriveActorDataKey(dek, p.resourceId, p.dataEpoch, p.actor);
+                const plaintext = decryptDataUnit(key, p.actorSeq, dataUnitAad(p), p.ciphertext);
+                const value = handler
+                    .codecFor({ resourceId: p.resourceId, actor: p.actor })
+                    .decode(plaintext);
+                decoded.push({
+                    unit: {
+                        unitId: u.unitId,
+                        resourceId: p.resourceId,
+                        actor: p.actor,
+                        seq: p.actorSeq,
+                        epoch: p.dataEpoch,
+                    },
+                    value,
+                });
+            }
+            catch (e) {
+                if (isEngineTrap(e))
+                    throw e;
+                skipped.push({ unitId: u.unitId, reason: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        if (handler.applyBatch !== undefined && decoded.length > 0) {
+            // One profile call for the whole replay (a restart after many changes).
+            const batch = handler.applyBatch(decoded);
+            const refused = new Map(batch.rejected.map((x) => [toHex(x.unitId), x]));
+            merged.push(...batch.merged);
+            for (const { unit } of decoded) {
+                const no = refused.get(toHex(unit.unitId));
+                if (no !== undefined) {
+                    skipped.push({ unitId: unit.unitId, reason: `${no.code}: ${no.message}` });
+                    continue;
+                }
+                if (!batch.merged.some((id) => bytesEqual(id, unit.unitId)))
+                    pendingNow.push(unit.unitId);
+                replayed.push(unit.unitId);
+            }
+        }
+        else
+            for (const { unit, value } of decoded) {
+                try {
+                    const r = handler.apply(unit, value);
+                    merged.push(...r.merged);
+                    if (!r.merged.some((id) => bytesEqual(id, unit.unitId)))
+                        pendingNow.push(unit.unitId);
+                    replayed.push(unit.unitId);
+                }
+                catch (e) {
+                    if (isEngineTrap(e))
+                        throw e;
+                    skipped.push({ unitId: unit.unitId, reason: e instanceof Error ? e.message : String(e) });
+                }
+            }
+    }
+    /**
+     * A unit inside the frontier of a Snapshot this client loaded (§29, §66
+     * step 3): its content is in the Snapshot, so it is not decrypted or
+     * merged again. It gets the DEK-free LFCP checks (structure, signature,
+     * equivocation, data/write at its head, epoch cutoff) and is then marked
+     * accepted, so the actor's next unit links to it (§26.2). Its own link to
+     * the previous unit is not checked: that unit is attested by the signed,
+     * authorized Snapshot and was never received. A replay is a duplicate.
+     */
+    async acceptCovered(view, bytes) {
+        const dataProfile = view.state.dataProfile;
+        try {
+            this.#seen.expect(dataUnitRow(bytes));
+        }
+        catch {
+            // checkDataUnit reports it as MALFORMED_MESSAGE
+        }
+        const c = await checkDataUnit(view, bytes, this.#seen, this.#options);
+        if (c.kind === "equivocation") {
+            const handler = this.#handlers.get(dataProfile);
+            return handler === undefined
+                ? Object.freeze({ ...c, excluded: [], objects: [], pending: [], released: [] })
+                : this.#equivocation(view, handler, c);
+        }
+        if (c.kind !== "valid") {
+            if (c.kind === "quarantined")
+                await this.#write([
+                    { op: "set-data-unit-status", unitId: c.unitId, status: "quarantined", detail: c.reason },
+                ]);
+            return c;
+        }
+        const p = c.parsed.payload;
+        if ((await this.#storage.dataUnits.acceptedAt(p.resourceId, p.actor, p.actorSeq)) !== undefined)
+            return Object.freeze({ kind: "duplicate", unitId: c.unitId });
+        await this.#write([
+            {
+                op: "set-data-unit-status",
+                unitId: c.unitId,
+                status: "merged",
+                detail: "covered by a Snapshot",
+            },
+            { op: "set-accepted", unitId: c.unitId, accepted: true },
+        ]);
+        // §26.2 (G-DP1, G-DP1-GAP): a held unit of this actor above it may link now, across a gap.
+        const next = await this.#storage.dataUnits.range(p.resourceId, p.actor, actorSequence(p.actorSeq + 1n), actorSequence(2n ** 64n - 1n));
+        const released = [];
+        // Only a held unit whose previous names the unit just accepted can link now.
+        for (const held of next.filter((u) => u.status === "held")) {
+            const previous = parseDataUnit(held.bytes).payload.prevDataUnitId;
+            if (previous === null || !bytesEqual(previous, c.unitId))
+                continue;
+            // A retry above may already have released it.
+            if ((await this.#storage.dataUnits.get(held.unitId))?.status !== "held")
+                continue;
+            released.push(await this.receive(view, held.bytes));
+        }
+        return Object.freeze({
+            kind: "covered",
+            unitId: c.unitId,
+            dataProfile,
+            released: Object.freeze(released),
+        });
+    }
+    async #unsupported(view, bytes, dataProfile) {
+        // DEK-free checks only: the plaintext of an unknown profile is never decrypted.
+        const c = await checkDataUnit(view, bytes, this.#seen, this.#options);
+        if (c.kind === "equivocation")
+            return Object.freeze({ ...c, excluded: [], objects: [], pending: [], released: [] });
+        if (c.kind !== "valid")
+            return c;
+        await this.#write([
+            { op: "set-data-unit-status", unitId: c.unitId, status: "profile-unsupported" },
+        ]);
+        return Object.freeze({
+            kind: "profile-unsupported",
+            code: "PROFILE_UNSUPPORTED",
+            unitId: c.unitId,
+            dataProfile,
+        });
+    }
+    /**
+     * LFCP-WIRE-01 §19.1 (G-EP7): the single entry point the sync engine calls with
+     * every newly validated Control view that may carry a new Key Epoch.
+     * Merged (or profile-buffered) units that the view now puts beyond an
+     * epoch cutoff are taken out of the profile state, which is rebuilt from
+     * the remaining accepted units; they are quarantined (STALE_DATA_EPOCH)
+     * and un-accepted.
+     */
+    // PROVISIONAL (SNAP-EP): a Key Epoch learned after a Snapshot was loaded
+    // that puts any unit the Snapshot covers beyond its cutoff drops the
+    // Snapshot-derived state: the profile is rebuilt from accepted units only,
+    // the covered units are fetched again, and G-EP7 then applies normally.
+    async #dropCutSnapshots(view, handler) {
+        const resource = view.state.resourceId;
+        const snapshots = await this.#storage.snapshots.list(resource);
+        if (snapshots.length === 0 || handler.reset === undefined)
+            return false;
+        const covered = (await this.#storage.dataUnits.withStatus(resource, "merged")).filter((u) => u.accepted && u.detail === "covered by a Snapshot");
+        const cut = snapshots.some((x) => beyondCutoff(view, x.dataEpoch, canonicalFrontierFromCbor(decodeDeterministic(x.frontier))) !== undefined) || covered.some((u) => classifyDataUnit(view, u).kind === "quarantine");
+        if (!cut)
+            return false;
+        await this.#write([
+            ...snapshots.map((x) => ({ op: "delete-snapshot", snapshotId: x.snapshotId })),
+            ...covered.flatMap((u) => [
+                { op: "set-accepted", unitId: u.unitId, accepted: false },
+                {
+                    op: "set-data-unit-status",
+                    unitId: u.unitId,
+                    status: "seen",
+                    detail: "Snapshot dropped (SNAP-EP)",
+                },
+            ]),
+        ]);
+        handler.reset();
+        await this.replayStored(view);
+        return true;
+    }
+    /** The distinct actors of stored units. */
+    async #actorsOf(unitIds) {
+        const byHex = new Map();
+        for (const id of unitIds) {
+            const u = await this.#storage.dataUnits.get(id);
+            if (u !== undefined)
+                byHex.set(toHex(u.actor), u.actor);
+        }
+        return [...byHex.values()];
+    }
+    /**
+     * §26.2 (G-DP1-GAP): after units of `actors` stopped being accepted, a
+     * held unit may now name the actor's latest accepted unit. Every held
+     * unit of those actors is received again, lowest sequence first.
+     */
+    async #retryHeld(view, actors) {
+        const released = [];
+        for (const actor of actors) {
+            const held = (await this.#storage.dataUnits.range(view.state.resourceId, actor, actorSequence(1n), actorSequence(2n ** 64n - 1n))).filter((u) => u.status === "held");
+            for (const u of held) {
+                if ((await this.#storage.dataUnits.get(u.unitId))?.status !== "held")
+                    continue;
+                released.push(await this.receive(view, u.bytes));
+            }
+        }
+        return released;
+    }
+    async reconcileEpochs(view) {
+        const handler = this.#handlers.get(view.state.dataProfile);
+        if (handler === undefined)
+            return Object.freeze({
+                excluded: [],
+                objects: [],
+                pending: [],
+                snapshotDropped: false,
+                released: [],
+            });
+        const resource = view.state.resourceId;
+        const snapshotDropped = await this.#dropCutSnapshots(view, handler);
+        const empty = Object.freeze({
+            excluded: [],
+            objects: [],
+            pending: [],
+            snapshotDropped,
+            released: [],
+        });
+        const candidates = [
+            ...(await this.#storage.dataUnits.withStatus(resource, "merged")),
+            ...(await this.#storage.dataUnits.withStatus(resource, "profile-pending")),
+        ].filter((u) => u.accepted);
+        const excluded = [];
+        for (const u of candidates) {
+            const c = classifyDataUnit(view, u);
+            if (c.kind === "quarantine")
+                excluded.push({
+                    unitId: u.unitId,
+                    quarantine: { code: c.code, reason: c.reason, epoch: c.epoch, closedBy: c.closedBy },
+                });
+        }
+        if (excluded.length === 0)
+            return empty;
+        const result = handler.exclude(excluded.map((e) => e.unitId));
+        await this.#write([
+            ...excluded.flatMap((e) => [
+                {
+                    op: "set-data-unit-status",
+                    unitId: e.unitId,
+                    status: "quarantined",
+                    detail: e.quarantine.reason,
+                },
+                { op: "set-accepted", unitId: e.unitId, accepted: false },
+            ]),
+            ...result.pending.map((unitId) => ({
+                op: "set-data-unit-status",
+                unitId,
+                status: "profile-pending",
+                detail: "builds on an excluded unit",
+            })),
+        ]);
+        const actors = await this.#actorsOf(excluded.map((e) => e.unitId));
+        const released = await this.#retryHeld(view, actors);
+        return Object.freeze({
+            snapshotDropped,
+            excluded: Object.freeze(excluded),
+            objects: result.objects,
+            pending: result.pending,
+            released,
+        });
+    }
+}
+//# sourceMappingURL=apply.js.map