@powerhousedao/reactor 6.2.3-dev.50 → 6.2.3-dev.52

package/dist/{drive-container-types-Ci1pdv4X.js → drive-container-types-BAfFzBOf.js}

@@ -1,6 +1,57 @@
-import { A as GATED_DOCUMENT_ACTIONS, B as createOperation, Et as yieldToMain, F as buildErrorResult, G as relationshipTarget, H as isGenesisOperation, I as buildSuccessResult, J as targetDocumentId, K as submittedActionIds, M as TouchedStreams, N as applyDeleteDocumentAction$1, O as DOCUMENT_SCOPE_ACTIONS, P as applyUpgradeDocumentAction$1, R as createDocumentFromAction, St as ReactorEventTypes, U as jobWriteIds, V as getNextIndexForScope, W as refusalError, Y as updateDocumentRevision, Z as AppendConditionFailedError, _ as acquirePurgeLocks, _t as ReservedActionError, at as AuthorizationDeniedError, bt as UpgradePreconditionFailedError, ct as DocumentNotDeletedError, dt as ExcessiveReshuffleError, ft as GroupInUseError, ht as PurgeTooLargeError, it as AuthTimestampNotMonotonicError, j as PurgeFence, k as FencedWriteCache, lt as DocumentNotFoundError, mt as InvalidSignatureError, pt as InvalidOperationTimestampError, st as DocumentDeletedError, ut as DocumentPurgedError, v as findPurged, vt as UnsupportedProtocolVersionError } from "./forwarding-logger-ByfBFgMS.js";
+import { A as GATED_DOCUMENT_ACTIONS, At as yieldToMain, B as createOperation, Ct as ReactorEventTypes, F as buildErrorResult, G as relationshipTarget, H as isGenesisOperation, I as buildSuccessResult, J as targetDocumentId, K as submittedActionIds, M as TouchedStreams, N as applyDeleteDocumentAction$1, O as DOCUMENT_SCOPE_ACTIONS, P as applyUpgradeDocumentAction$1, R as createDocumentFromAction, Tt as delay, U as jobWriteIds, V as getNextIndexForScope, W as refusalError, Y as updateDocumentRevision, Z as AppendConditionFailedError, _ as acquirePurgeLocks, at as AuthorizationDeniedError, ct as DocumentNotDeletedError, dt as ExcessiveReshuffleError, ft as GroupInUseError, gt as PurgeTooLargeError, it as AuthTimestampNotMonotonicError, j as PurgeFence, k as FencedWriteCache, kt as withDeadline, lt as DocumentNotFoundError, mt as InvalidSignatureError, pt as InvalidOperationTimestampError, st as DocumentDeletedError, ut as DocumentPurgedError, v as findPurged, vt as ReservedActionError, wt as TIMED_OUT, xt as UpgradePreconditionFailedError, yt as UnsupportedProtocolVersionError } from "./forwarding-logger-B9LLXItm.js";
 import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, PEER_CAPABILITIES, actionSignerIdentity, actionSigningTarget, applyAuthAction, applyDeleteDocumentAction, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, decide, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isPurgeMarker, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, purgeDocumentAction, purgeMarkerOperation, referencedGroupIds, signaturePolicyOf, sortOperations, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { sql } from "kysely";
+//#region src/shared/types.ts
+/**
+* Enum that determines deletion propagation.
+*/
+let PropagationMode = /* @__PURE__ */ function(PropagationMode) {
+	PropagationMode["None"] = "none";
+	PropagationMode["Cascade"] = "cascade";
+	return PropagationMode;
+}({});
+/**
+* Enum that describes the type of relationship change.
+*/
+let RelationshipChangeType = /* @__PURE__ */ function(RelationshipChangeType) {
+	RelationshipChangeType["Added"] = "added";
+	RelationshipChangeType["Removed"] = "removed";
+	return RelationshipChangeType;
+}({});
+/**
+* Marks a load whose operations a sync cursor keeps re-pullable, so its
+* write-ready needs no flush. A symbol, not exported from the package: it
+* cannot be set by an outside caller or survive any serialization boundary.
+*/
+const CURSOR_PROTECTED = Symbol("cursorProtected");
+/** Load meta for the sync manager's inbox, the only owner of the cursor. */
+function cursorProtectedLoadMeta(sourceRemote) {
+	return {
+		sourceRemote,
+		[CURSOR_PROTECTED]: true
+	};
+}
+function isCursorProtectedLoad(job) {
+	const meta = job.meta;
+	return job.kind === "load" && meta[CURSOR_PROTECTED] === true;
+}
+/**
+* Job execution statuses
+*/
+let JobStatus = /* @__PURE__ */ function(JobStatus) {
+	/** Job is queued but not yet started */
+	JobStatus["PENDING"] = "PENDING";
+	/** Job is currently being executed */
+	JobStatus["RUNNING"] = "RUNNING";
+	/** Operations have been written to the operation store (JOB_WRITE_READY event) */
+	JobStatus["WRITE_READY"] = "WRITE_READY";
+	/** Read models have finished indexing operations (JOB_READ_READY event) */
+	JobStatus["READ_READY"] = "READ_READY";
+	/** Job failed (may be retried) */
+	JobStatus["FAILED"] = "FAILED";
+	return JobStatus;
+}({});
+//#endregion
 //#region src/cache/operation-index-types.ts
 const DRIVE_COLLECTION_PREFIX = "drive.";
 /**
@@ -28,6 +79,16 @@ var DriveCollectionId = class DriveCollectionId {
 	* The single deserializer for the wire/storage form. `branch` may contain
 	* dots, while `driveId` is a dot-free document id, so the drive id is the
 	* final dot-delimited segment.
+	*
+	* That asymmetry is a real constraint, not a convention: a drive id
+	* containing a dot does NOT survive `key` -> `fromKey`, because the split
+	* takes the LAST dot and so hands the tail of the drive id back as the drive
+	* id and everything before it as the branch. The key format is the wire and
+	* storage representation of existing `document_collections` rows, so it
+	* cannot be changed; callers that accept a drive id or branch from outside
+	* (a UI field, an RPC payload) must reject dots in the drive id at their own
+	* boundary. The round-trip is verifiable without parsing rules:
+	* `DriveCollectionId.fromKey(id.key).key === id.key`.
 	*/
 	static fromKey(key) {
 		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
@@ -409,6 +470,7 @@ function selectDecisionModel(flags, registry) {
 const DEFAULT_MAX_PURGE_OPERATIONS = 2e5;
 /** How long a deferred job waits for its document before it fails. */
 const DEFAULT_DEFERRED_JOB_TTL_MS = 3e4;
+const DEFAULT_JOB_TIMEOUT_MS = 3e4;
 /**
 * Event types for the job executor
 */
@@ -687,6 +749,20 @@ var KyselyExecutionScope = class {
 	}
 };
 //#endregion
+//#region src/storage/storage-flush.ts
+/** The store's session is poisoned; only a host restart recovers it. */
+var StoragePoisonedError = class extends Error {
+	constructor(message, cause) {
+		super(message, { cause });
+		this.name = "StoragePoisonedError";
+	}
+};
+var NoopStorageFlusher = class {
+	flush() {
+		return Promise.resolve();
+	}
+};
+//#endregion
 //#region src/utils/reshuffle.ts
 const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"CREATE_DOCUMENT",
@@ -2184,6 +2260,8 @@ function sameContent(stored, submitted) {
 //#endregion
 //#region src/executor/simple-job-executor.ts
 const MAX_SKIP_THRESHOLD = 1e3;
+/** Retries of a failed flush before a committed job's write-ready is withheld. */
+const MAX_ANNOUNCE_FLUSH_ATTEMPTS = 5;
 const ISO_TIMESTAMP_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
 function isValidISOTimestamp(value) {
 	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
@@ -2246,11 +2324,13 @@ var SimpleJobExecutor = class {
 	documentActionHandler;
 	executionScope;
 	signer;
+	flusher;
 	/**
 	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
 	* `trustPolicy` decides which keys may sign as which users at admission.
+	* `flusher` makes a job durable before its write-ready is announced.
 	*/
-	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy) {
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy, flusher = new NoopStorageFlusher()) {
 		this.logger = logger;
 		this.registry = registry;
 		this.operationStore = operationStore;
@@ -2260,6 +2340,7 @@ var SimpleJobExecutor = class {
 		this.documentMetaCache = documentMetaCache;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
+		this.flusher = flusher;
 		this.signer = signer ?? new PassthroughSigner();
 		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.config = {
@@ -2274,7 +2355,8 @@ var SimpleJobExecutor = class {
 			batchApplies: config.batchApplies ?? true,
 			signatureVerification: config.signatureVerification ?? "enforce",
 			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols,
-			maxPurgeOperations: config.maxPurgeOperations ?? 2e5
+			maxPurgeOperations: config.maxPurgeOperations ?? 2e5,
+			durabilityWaitMs: config.durabilityWaitMs ?? 0
 		};
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
@@ -2305,7 +2387,7 @@ var SimpleJobExecutor = class {
 	* but nothing here closes it, and a caller that needs to know a write is
 	* real has the job status to ask.
 	*/
-	async executeJob(job, signal) {
+	async executeJob(job, signal, onCommitting) {
 		const startTime = Date.now();
 		const touchedStreams = new TouchedStreams();
 		const postCommitInvalidations = [];
@@ -2325,6 +2407,8 @@ var SimpleJobExecutor = class {
 					postCommitMetaInvalidations
 				});
 				if (!scoped.result.success) throw new JobRollbackSignal(scoped.result);
+				signal?.throwIfAborted();
+				onCommitting?.();
 				return scoped;
 			}, signal);
 		} catch (error) {
@@ -2336,12 +2420,54 @@ var SimpleJobExecutor = class {
 		for (const documentId of postCommitMembershipInvalidations) this.collectionMembershipCache.invalidate(documentId);
 		for (const documentId of postCommitMetaInvalidations) this.documentMetaCache.invalidate(documentId);
 		const { pendingEvent } = outcome;
-		if (pendingEvent) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
+		if (pendingEvent && await this.awaitDurable(job, signal)) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Event : @Error", pendingEvent, error);
 		});
 		return outcome.result;
 	}
 	/**
+	* Waits for a flush covering the committed job before its write-ready goes
+	* out; false withholds the announcement. A failed flush is never a failed
+	* job, since the commit stands: it is retried, and the announcement is
+	* withheld once the store is poisoned (the host restarts), the attempts run
+	* out, the wait outlives `durabilityWaitMs`, or the job's signal aborts.
+	*/
+	async awaitDurable(job, signal) {
+		if (isCursorProtectedLoad(job)) return true;
+		const budgetMs = this.config.durabilityWaitMs;
+		const deadline = budgetMs > 0 ? Date.now() + budgetMs : Infinity;
+		for (let attempt = 1;; attempt++) {
+			try {
+				if (await this.withinDurabilityWait(this.flusher.flush(), deadline, signal) !== TIMED_OUT) return true;
+				this.logger.error("Job @JobId committed but its flush outlived the durability wait or the job was aborted; its write-ready is withheld", job.id);
+				return false;
+			} catch (error) {
+				this.logger.error("Flush before announcing job @JobId failed (attempt @Attempt): @Error", job.id, attempt, error);
+				if (error instanceof StoragePoisonedError || attempt >= MAX_ANNOUNCE_FLUSH_ATTEMPTS) {
+					this.logger.error("Job @JobId committed but is not durable; its write-ready is withheld", job.id);
+					return false;
+				}
+			}
+			if (await this.withinDurabilityWait(delay(Math.min(this.config.retryMaxDelayMs, this.config.retryBaseDelayMs * 2 ** (attempt - 1))), deadline, signal) === TIMED_OUT) return false;
+		}
+	}
+	/** Settles with TIMED_OUT at the deadline or on abort; the wait itself is abandoned. */
+	async withinDurabilityWait(pending, deadline, signal) {
+		pending.catch(() => void 0);
+		if (signal?.aborted) return TIMED_OUT;
+		let onAbort;
+		const aborted = new Promise((resolve) => {
+			onAbort = () => resolve(TIMED_OUT);
+			signal?.addEventListener("abort", onAbort, { once: true });
+		});
+		try {
+			const raced = Promise.race([pending, aborted]);
+			return deadline === Infinity ? await raced : await withDeadline(raced, Math.max(0, deadline - Date.now()));
+		} finally {
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
 	* The body of a job, run inside the execution scope's transaction.
 	*
 	* The stores and caches it works through are the copies scoped to that
@@ -3761,6 +3887,6 @@ var SimpleJobExecutor = class {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = /* @__PURE__ */ new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { buildDecisionModel as _, KyselyExecutionScope as a, appliedDelete as c, DEFAULT_MAX_PURGE_OPERATIONS as d, JobExecutorEventTypes as f, authDecisionModel as g, documentDecisionModel as h, PassthroughSigner as i, resolveFeatureFlags as l, selectDecisionModel as m, SimpleJobExecutor as n, DEFAULT_PURGE_DELETE_BATCH as o, decideAtHead as p, verifyActionSignature as r, KyselyDocumentPurger as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, DEFAULT_DEFERRED_JOB_TTL_MS as u, DriveCollectionId as v };
+export { PropagationMode as C, JobStatus as S, cursorProtectedLoadMeta as T, selectDecisionModel as _, NoopStorageFlusher as a, buildDecisionModel as b, DEFAULT_PURGE_DELETE_BATCH as c, resolveFeatureFlags as d, DEFAULT_DEFERRED_JOB_TTL_MS as f, decideAtHead as g, JobExecutorEventTypes as h, PassthroughSigner as i, KyselyDocumentPurger as l, DEFAULT_MAX_PURGE_OPERATIONS as m, SimpleJobExecutor as n, StoragePoisonedError as o, DEFAULT_JOB_TIMEOUT_MS as p, verifyActionSignature as r, KyselyExecutionScope as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, appliedDelete as u, documentDecisionModel as v, RelationshipChangeType as w, DriveCollectionId as x, authDecisionModel as y };
 
-//# sourceMappingURL=drive-container-types-Ci1pdv4X.js.map
+//# sourceMappingURL=drive-container-types-BAfFzBOf.js.map