@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/DisasterRecovery.js

@@ -0,0 +1,523 @@
+/**
+ * Hot backup, verified restore, and restore-time fencing for the durable
+ * flows store.
+ *
+ * A backup captures the whole SQLite database — journal, run store, step
+ * cache, engine state, and the out-of-ladder objects created by
+ * `internal/EngineStateSchema.ts` — with `VACUUM INTO`, which reads one
+ * consistent snapshot under WAL while writers stay live. The content-addressed
+ * artifact blobs are copied beside it, digest-verified, after the database
+ * snapshot: results reference artifacts only after publication
+ * (`packages/smithers/flows/step-cache/docs/api.md`), so a blob walk taken after the
+ * database snapshot is a superset of every digest the snapshot references.
+ * A manifest written last records the digests a restore must verify, so a
+ * partial backup is detectable by its missing manifest.
+ *
+ * Restore never lets a pre-backup owner resurrect. The fencing token is the
+ * `OwnerId` triple mirrored on `flows_runs` and arbitrated by the journal's
+ * `flows_consensus_leases` — Temporal's shard `rangeID` equality check reduced
+ * to one SQL predicate (`reference/temporal`
+ * `service/history/shard/context_impl.go`, `renewRangeLocked`). Temporal
+ * fences a restored shard by bumping the persisted epoch above anything a
+ * surviving owner could hold; the equivalent bump for an identity fence is
+ * {@link fence}: clear every persisted claim, owner, and consensus lease in
+ * one serialized write transaction, so every pre-backup `OwnerId` fails its
+ * equality compare-and-swap (`FenceLost`, journal `fence_lost`) and the
+ * restored runs are claimable immediately instead of after the heartbeat
+ * staleness cutoff.
+ *
+ * Host access arrives through Effect's `FileSystem` and `SqlClient` tags and
+ * hashing through the injected `Crypto` service, so the module carries no
+ * platform binding. The SQL dialect is SQLite — a non-SQLite backend fails
+ * with the `sql` code rather than pretending to snapshot. Every file is
+ * stat-checked before it is buffered for hashing or copying. The configurable
+ * ceiling defaults to {@link defaultMaxFileSizeBytes}; an oversized file fails
+ * with the typed `io` code instead of reaching the host's allocation limit.
+ *
+ * @since 0.1.0
+ */
+import * as ArtifactBackupLease from "@smthrs/artifacts/ArtifactBackupLease";
+import { Sha256 } from "@smthrs/crypto";
+import { DurableWriter } from "@smthrs/database/DurableWriter";
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+import * as ArtifactRoots from "./internal/ArtifactRoots.js";
+/**
+ * The database file name inside a backup directory and a restored store
+ * directory.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const databaseFileName = "store.sqlite3";
+/**
+ * The manifest file name inside a backup directory. It is written last, so
+ * its presence marks a complete backup.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const manifestFileName = "manifest.json";
+/**
+ * The artifact blob directory name inside a backup directory and a restored
+ * store directory, laid out with the store's own two-hex-prefix fanout.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const objectsDirectoryName = "objects";
+/**
+ * The marker file a restore writes into the target directory, recording when
+ * the restore happened and which backup it came from.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const restoredMarkerFileName = "restored.json";
+/**
+ * Default ceiling for one backup file read into memory: 512 MiB.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const defaultMaxFileSizeBytes = 512 * 1024 * 1024;
+/**
+ * One applied row of the shared `flows_migrations` table, recorded at backup
+ * time and re-verified at fence time as the schema version of the snapshot.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export const AppliedMigration = Schema.Struct({
+    migrationId: Schema.Number,
+    name: Schema.String
+});
+/**
+ * One captured artifact blob. `sizeBytes` is informational for operators; the
+ * digest is the integrity check.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export const ArtifactEntry = Schema.Struct({
+    digest: Sha256.Digest,
+    sizeBytes: Schema.Number
+});
+/**
+ * The verification contract of a backup: the database snapshot's digest and
+ * schema version, and the digest of every captured artifact blob.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export const BackupManifest = Schema.Struct({
+    formatVersion: Schema.Literal(1),
+    createdAtMs: Schema.Number,
+    database: Schema.Struct({
+        file: Schema.Literal(databaseFileName),
+        sha256: Sha256.Digest,
+        sizeBytes: Schema.Number,
+        migrations: Schema.Array(AppliedMigration)
+    }),
+    artifacts: Schema.Array(ArtifactEntry)
+});
+/** JSON text carrying a decoded backup manifest. */
+const ManifestFromJsonString = Schema.fromJsonString(BackupManifest);
+/**
+ * Stable failure codes surfaced by backup, verify, restore, and fence.
+ * `invalid_options` reports a public option that cannot be admitted safely.
+ *
+ * @since 0.1.0
+ * @category errors
+ */
+export const DisasterRecoveryErrorCode = Schema.Literals([
+    "invalid_options",
+    "not_empty",
+    "invalid_manifest",
+    "missing_file",
+    "digest_mismatch",
+    "artifact_corruption",
+    "snapshot_incomplete",
+    "schema_mismatch",
+    "io",
+    "sql"
+]);
+/**
+ * A normalized backup or restore failure. The identity string equals this
+ * module's package path, per the house rule that a new identity is the
+ * defining module path.
+ *
+ * @since 0.1.0
+ * @category errors
+ */
+export class DisasterRecoveryError extends Schema.TaggedError()("@smthrs/engine-store/DisasterRecoveryError", {
+    code: DisasterRecoveryErrorCode,
+    method: Schema.String,
+    message: Schema.String,
+    cause: Schema.Unknown
+}) {
+}
+const error = (method, code, message, cause) => new DisasterRecoveryError({
+    code,
+    method,
+    message: `${code}: DisasterRecovery.${method}: ${message}`,
+    cause
+});
+/**
+ * One mapper per failure family, shared across every call site so the
+ * vocabulary stays uniform.
+ */
+const ioFailure = (method, subject) => (cause) => error(method, "io", `the host filesystem refused ${subject}`, cause);
+const sqlFailure = (method, subject) => (cause) => error(method, "sql", `the database refused ${subject}`, cause);
+/** Hashes bytes with the injected crypto service; a broken host is a defect. */
+const measure = (bytes) => Schema.decodeUnknownEffect(Sha256)(bytes).pipe(Effect.orDie);
+/** Resolves and validates the shared whole-file buffering ceiling. */
+const fileSizeLimit = (method, options) => {
+    const limit = options.maxFileSizeBytes;
+    if (limit === undefined)
+        return defaultMaxFileSizeBytes;
+    if (Number.isSafeInteger(limit) && limit >= 0)
+        return limit;
+    return error(method, "invalid_options", `maxFileSizeBytes must be a finite non-negative safe integer; received ${String(limit)}`, limit);
+};
+/**
+ * Refuses an oversized file before a whole-file read allocates its buffer.
+ * Every caller admits `limit` through `fileSizeLimit`, so `BigInt` cannot
+ * reject it.
+ */
+const checkFileSize = (fs, method, path, limit) => Effect.gen(function* () {
+    const info = yield* fs.stat(path).pipe(Effect.mapError(ioFailure(method, `stating ${path}`)));
+    if (info.size <= BigInt(limit))
+        return;
+    const message = `${path} is ${info.size} bytes, which exceeds the ${limit}-byte file limit`;
+    return yield* Effect.fail(error(method, "io", message, new RangeError(message)));
+});
+/**
+ * Admits a target directory that does not exist yet — created recursively —
+ * or exists empty. Anything else is refused rather than merged over.
+ */
+const ensureEmptyDirectory = (fs, method, directory) => Effect.gen(function* () {
+    const present = yield* fs.exists(directory).pipe(Effect.mapError(ioFailure(method, `probing ${directory}`)));
+    if (!present) {
+        return yield* fs.makeDirectory(directory, { recursive: true }).pipe(Effect.mapError(ioFailure(method, `creating ${directory}`)));
+    }
+    const entries = yield* fs.readDirectory(directory).pipe(Effect.mapError(ioFailure(method, `listing ${directory}`)));
+    if (entries.length > 0) {
+        return yield* Effect.fail(error(method, "not_empty", `${directory} already holds ${entries.length} entries`, directory));
+    }
+});
+/**
+ * A relative blob path in the store's fanout layout: a two-hex directory
+ * holding a 64-hex digest that begins with it. Anything else under the
+ * objects directory — a scratch `.tmp-*` file, the fanout directory itself —
+ * is not part of the store's address space.
+ */
+const blobEntry = (entry) => {
+    const match = entry.match(/^([0-9a-f]{2})[/\\]([0-9a-f]{64})$/);
+    if (match === null || !match[2].startsWith(match[1]))
+        return undefined;
+    return match[2];
+};
+const blobPath = (directory, digest) => `${directory}/${digest.slice(0, 2)}/${digest}`;
+/** The applied rows of the shared migrations table, in ladder order. */
+const appliedMigrations = (sql, method) => sql `
+    SELECT migration_id, name FROM flows_migrations ORDER BY migration_id ASC
+  `.withoutTransform.pipe(Effect.mapError(sqlFailure(method, "reading flows_migrations")), Effect.map((rows) => rows.map((row) => ({ migrationId: Number(row.migration_id), name: row.name }))));
+/** Reads every artifact root from the frozen database, never the live one. */
+const inspectSnapshot = (sql) => Effect.gen(function* () {
+    const migrations = yield* appliedMigrations(sql, "backup");
+    const cacheRows = yield* sql `
+      SELECT meta_json FROM flows_step_cache
+    `.withoutTransform.pipe(Effect.mapError(sqlFailure("backup", "reading artifact roots from snapshot step cache")));
+    const attemptRows = yield* sql `
+      SELECT checkpoint_json, meta_json FROM flows_attempts
+    `.withoutTransform.pipe(Effect.mapError(sqlFailure("backup", "reading artifact roots from snapshot attempts")));
+    const artifactRoots = new Set();
+    const decodeFailure = (cause) => error("backup", "snapshot_incomplete", cause.message, cause.cause);
+    for (const row of cacheRows) {
+        for (const digest of yield* ArtifactRoots.rootDigests("flows_step_cache", row.meta_json).pipe(Effect.mapError(decodeFailure)))
+            artifactRoots.add(digest);
+    }
+    for (const row of attemptRows) {
+        for (const digest of yield* ArtifactRoots.rootDigests("flows_attempts", row.meta_json).pipe(Effect.mapError(decodeFailure)))
+            artifactRoots.add(digest);
+        for (const digest of yield* ArtifactRoots.checkpointDigests(row.checkpoint_json).pipe(Effect.mapError(decodeFailure)))
+            artifactRoots.add(digest);
+    }
+    return { migrations, artifactRoots };
+});
+/** Reads and decodes the manifest a backup directory must carry. */
+const readManifest = (fs, method, backupDirectory, maxFileSizeBytes) => Effect.gen(function* () {
+    const path = `${backupDirectory}/${manifestFileName}`;
+    const present = yield* fs.exists(path).pipe(Effect.mapError(ioFailure(method, `probing ${path}`)));
+    if (!present) {
+        return yield* Effect.fail(error(method, "missing_file", `${path} does not exist — the backup is incomplete or not a backup`, path));
+    }
+    yield* checkFileSize(fs, method, path, maxFileSizeBytes);
+    const text = yield* fs.readFileString(path).pipe(Effect.mapError(ioFailure(method, `reading ${path}`)));
+    return yield* Schema.decodeUnknownEffect(ManifestFromJsonString)(text).pipe(Effect.mapError((cause) => error(method, "invalid_manifest", `${path} does not decode as a backup manifest`, cause)));
+});
+/** Reads a backup file and refuses bytes that no longer hash to the manifest. */
+const checkedFile = (fs, method, path, expected, maxFileSizeBytes) => Effect.gen(function* () {
+    const present = yield* fs.exists(path).pipe(Effect.mapError(ioFailure(method, `probing ${path}`)));
+    if (!present) {
+        return yield* Effect.fail(error(method, "missing_file", `${path} does not exist`, path));
+    }
+    yield* checkFileSize(fs, method, path, maxFileSizeBytes);
+    const bytes = yield* fs.readFile(path).pipe(Effect.mapError(ioFailure(method, `reading ${path}`)));
+    const measured = yield* measure(bytes);
+    if (measured !== expected) {
+        return yield* Effect.fail(error(method, "digest_mismatch", `${path} hashes to ${measured}, the manifest records ${expected}`, path));
+    }
+    return bytes;
+});
+/**
+ * Captures a hot backup of the live store into an empty directory.
+ *
+ * The database is snapshotted first with `VACUUM INTO` — a read transaction
+ * under WAL, so live writers are never blocked and the copy is one consistent
+ * point in time. The artifact walk runs after it, so every digest the
+ * snapshot references is captured (publication precedes reference). Blobs are
+ * digest-verified as they are copied; a blob whose bytes no longer hash to
+ * its address fails the backup loudly rather than capturing corruption. The
+ * manifest is encoded and admitted under the same file-size ceiling before it
+ * is written last, so a successful backup remains readable with its own
+ * options.
+ *
+ * With an `objectsDirectory`, the whole capture holds the artifact backup
+ * lease, so concurrent sweep deletion cannot remove a referenced blob
+ * mid-copy. Without one, no lease is taken; the frozen-root verification
+ * still fails the backup loudly when the snapshot references any blob, so an
+ * unfenced capture can never report success while missing artifact bytes.
+ *
+ * @since 0.1.0
+ * @category operations
+ */
+export const backup = (options) => Effect.gen(function* () {
+    const limit = fileSizeLimit("backup", options);
+    if (typeof limit !== "number")
+        return yield* Effect.fail(limit);
+    const maxFileSizeBytes = limit;
+    const sql = yield* Effect.service(SqlClient.SqlClient);
+    const fs = yield* FileSystem.FileSystem;
+    const createdAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+    yield* ensureEmptyDirectory(fs, "backup", options.directory);
+    const capture = Effect.gen(function* () {
+        const databasePath = `${options.directory}/${databaseFileName}`;
+        yield* sql `VACUUM INTO ${databasePath}`.pipe(Effect.mapError(sqlFailure("backup", `snapshotting the database into ${databasePath}`)));
+        const snapshot = yield* Effect.flatMap(Effect.service(SqlClient.SqlClient), inspectSnapshot).pipe(Effect.provide(options.snapshotDatabaseLayer(databasePath)));
+        // Opening the frozen file may normalize SQLite journal metadata, so its
+        // manifest digest is measured only after the inspection connection closes.
+        yield* checkFileSize(fs, "backup", databasePath, maxFileSizeBytes);
+        const databaseBytes = yield* fs.readFile(databasePath).pipe(Effect.mapError(ioFailure("backup", `reading ${databasePath} back`)));
+        const sha256 = yield* measure(databaseBytes);
+        const artifacts = [];
+        const captured = new Set();
+        if (options.objectsDirectory !== undefined) {
+            const objectsDirectory = options.objectsDirectory;
+            const entries = yield* fs.readDirectory(objectsDirectory, { recursive: true }).pipe(Effect.mapError(ioFailure("backup", `listing ${objectsDirectory}`)));
+            for (const entry of [...entries].sort()) {
+                const digest = blobEntry(entry);
+                if (digest === undefined)
+                    continue;
+                const source = blobPath(objectsDirectory, digest);
+                yield* checkFileSize(fs, "backup", source, maxFileSizeBytes);
+                const bytes = yield* fs.readFile(source).pipe(Effect.mapError(ioFailure("backup", `reading ${source}`)));
+                const measured = yield* measure(bytes);
+                if (measured !== digest) {
+                    return yield* Effect.fail(error("backup", "artifact_corruption", `${source} hashes to ${measured}; repair the store before backing it up`, source));
+                }
+                const target = blobPath(`${options.directory}/${objectsDirectoryName}`, digest);
+                yield* fs.makeDirectory(`${options.directory}/${objectsDirectoryName}/${digest.slice(0, 2)}`, {
+                    recursive: true
+                }).pipe(Effect.mapError(ioFailure("backup", `creating the objects directory for ${digest}`)));
+                yield* fs.writeFile(target, bytes).pipe(Effect.mapError(ioFailure("backup", `writing ${target}`)));
+                artifacts.push({ digest: measured, sizeBytes: bytes.length });
+                captured.add(measured);
+            }
+        }
+        const missing = [...snapshot.artifactRoots].filter((digest) => !captured.has(digest)).sort();
+        if (missing.length > 0) {
+            return yield* Effect.fail(error("backup", "snapshot_incomplete", `the frozen database references ${missing.length} artifact blobs absent from the backup`, { missing }));
+        }
+        const manifest = {
+            formatVersion: 1,
+            createdAtMs,
+            database: {
+                file: databaseFileName,
+                sha256,
+                sizeBytes: databaseBytes.length,
+                migrations: snapshot.migrations
+            },
+            artifacts
+        };
+        const manifestPath = `${options.directory}/${manifestFileName}`;
+        const manifestBytes = new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\n`);
+        if (manifestBytes.byteLength > maxFileSizeBytes) {
+            const message = `${manifestPath} is ${manifestBytes.byteLength} bytes, which exceeds the ${maxFileSizeBytes}-byte file limit`;
+            return yield* Effect.fail(error("backup", "io", message, new RangeError(message)));
+        }
+        yield* fs.writeFile(manifestPath, manifestBytes).pipe(Effect.mapError(ioFailure("backup", `writing ${manifestFileName}`)));
+        return manifest;
+    });
+    // The directory was empty when the capture began, so everything in it is
+    // this capture's: the snapshot, any SQLite sidecar the inspection
+    // connection left, and the copied blobs. A failed capture removes them and
+    // leaves the directory reusable for a retry. Cleanup is best effort; the
+    // original failure is the one reported.
+    const discardPartial = fs.readDirectory(options.directory).pipe(Effect.flatMap((entries) => Effect.forEach(entries, (entry) => fs.remove(`${options.directory}/${entry}`, { recursive: true, force: true }), { discard: true })), Effect.ignore);
+    return yield* (options.objectsDirectory === undefined
+        ? capture
+        : ArtifactBackupLease.withLease(fs, options.objectsDirectory, capture, ioFailure("backup", `coordinating artifact backup in ${options.objectsDirectory}`))).pipe(Effect.onError(() => discardPartial));
+}).pipe(Effect.withSpan("DisasterRecovery.backup"));
+/**
+ * Verifies a backup directory against its manifest without restoring it:
+ * the manifest decodes, the database snapshot hashes to its recorded digest,
+ * and every listed artifact blob is present and hashes to its address.
+ *
+ * @since 0.1.0
+ * @category operations
+ */
+export const verify = Effect.fn("DisasterRecovery.verify")(function* (backupDirectory, options = {}) {
+    const limit = fileSizeLimit("verify", options);
+    if (typeof limit !== "number")
+        return yield* Effect.fail(limit);
+    const maxFileSizeBytes = limit;
+    const fs = yield* FileSystem.FileSystem;
+    const manifest = yield* readManifest(fs, "verify", backupDirectory, maxFileSizeBytes);
+    yield* checkedFile(fs, "verify", `${backupDirectory}/${manifest.database.file}`, manifest.database.sha256, maxFileSizeBytes);
+    for (const entry of manifest.artifacts) {
+        yield* checkedFile(fs, "verify", blobPath(`${backupDirectory}/${objectsDirectoryName}`, entry.digest), entry.digest, maxFileSizeBytes);
+    }
+    return manifest;
+});
+/**
+ * Restores a verified backup into an empty target directory.
+ *
+ * Every byte is re-verified against the manifest as it is copied, so a backup
+ * that rotted in storage is refused rather than restored. The target holds
+ * the database file, the objects directory, and a `restored.json` marker; it
+ * is a fresh store directory to compose `NodeDatabase.layer` and
+ * `ArtifactStore.layerFileSystem` over. The database is restored with the
+ * pre-backup owner fences still in place — run {@link fence} against it
+ * before any engine adopts it.
+ *
+ * @since 0.1.0
+ * @category operations
+ */
+export const restore = Effect.fn("DisasterRecovery.restore")(function* (options) {
+    const limit = fileSizeLimit("restore", options);
+    if (typeof limit !== "number")
+        return yield* Effect.fail(limit);
+    const maxFileSizeBytes = limit;
+    const fs = yield* FileSystem.FileSystem;
+    const manifest = yield* readManifest(fs, "restore", options.backupDirectory, maxFileSizeBytes);
+    yield* ensureEmptyDirectory(fs, "restore", options.targetDirectory);
+    const databaseBytes = yield* checkedFile(fs, "restore", `${options.backupDirectory}/${manifest.database.file}`, manifest.database.sha256, maxFileSizeBytes);
+    const databaseFile = `${options.targetDirectory}/${databaseFileName}`;
+    yield* fs.writeFile(databaseFile, databaseBytes).pipe(Effect.mapError(ioFailure("restore", `writing ${databaseFile}`)));
+    const objectsDirectory = `${options.targetDirectory}/${objectsDirectoryName}`;
+    for (const entry of manifest.artifacts) {
+        const bytes = yield* checkedFile(fs, "restore", blobPath(`${options.backupDirectory}/${objectsDirectoryName}`, entry.digest), entry.digest, maxFileSizeBytes);
+        yield* fs.makeDirectory(`${objectsDirectory}/${entry.digest.slice(0, 2)}`, { recursive: true }).pipe(Effect.mapError(ioFailure("restore", `creating the objects directory for ${entry.digest}`)));
+        yield* fs.writeFile(blobPath(objectsDirectory, entry.digest), bytes).pipe(Effect.mapError(ioFailure("restore", `writing the blob for ${entry.digest}`)));
+    }
+    const restoredAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+    const marker = {
+        formatVersion: 1,
+        restoredAtMs,
+        backupCreatedAtMs: manifest.createdAtMs,
+        databaseSha256: manifest.database.sha256
+    };
+    yield* fs.writeFileString(`${options.targetDirectory}/${restoredMarkerFileName}`, `${JSON.stringify(marker, null, 2)}\n`).pipe(Effect.mapError(ioFailure("restore", `writing ${restoredMarkerFileName}`)));
+    return { databaseFile, objectsDirectory, manifest };
+});
+/**
+ * Bumps the restored store's fencing epoch so pre-backup owners are fenced
+ * out.
+ *
+ * The store's fence is `OwnerId` equality, so the epoch bump is fence
+ * invalidation: in one serialized write transaction every pending claim is
+ * cleared, every run that was `running` at backup time is suspended with its
+ * owner and heartbeat cleared, and every consensus lease is deleted. A
+ * surviving pre-backup owner then fails every fenced operation against the
+ * restored store — `heartbeat` and `transitionOwned` report `FenceLost`,
+ * fenced journal appends fail `fence_lost` — exactly as a stale Temporal owner
+ * fails its `rangeID` compare-and-swap. The suspended runs are claimable
+ * immediately, without waiting out the heartbeat staleness cutoff and without
+ * liveness evidence.
+ *
+ * Every migration recorded in the manifest must remain applied with the same
+ * ID and namespaced name. Forward additions within any installed block are
+ * compatible, including engine-store `3006` below an existing plan `4003`;
+ * the current database layer applies them on open. A missing or renamed
+ * historical entry fails `schema_mismatch` before ownership is cleared.
+ *
+ * In-flight attempt rows are deliberately untouched: attempt writes are
+ * fenced on the run row's ownership, and the resuming engine adopts or
+ * retries them under its own fresh owner.
+ *
+ * @since 0.1.0
+ * @category operations
+ */
+export const fence = Effect.fn("DisasterRecovery.fence")(function* (manifest) {
+    const sql = yield* Effect.service(SqlClient.SqlClient);
+    const writer = yield* DurableWriter;
+    const applied = yield* appliedMigrations(sql, "fence");
+    const expected = manifest.database.migrations;
+    const key = (migration) => `${migration.migrationId}:${migration.name}`;
+    // IDs identify migrations within their reserved blocks. Compare historical
+    // identities independently so additions in lower blocks cannot shift them.
+    const appliedById = new Map(applied.map((migration) => [migration.migrationId, migration.name]));
+    if (expected.some((migration) => appliedById.get(migration.migrationId) !== migration.name)) {
+        return yield* Effect.fail(error("fence", "schema_mismatch", `the restored database applied [${applied.map(key).join(", ")}] but the manifest records [${expected.map(key).join(", ")}]`, { applied, expected }));
+    }
+    return yield* writer.write(Effect.gen(function* () {
+        const claims = yield* sql `
+        UPDATE flows_runs
+        SET
+          claim_host_id = NULL,
+          claim_pid = NULL,
+          claim_nonce = NULL,
+          claimed_at_ms = NULL
+        WHERE claim_host_id IS NOT NULL
+        RETURNING run_id
+      `.withoutTransform;
+        const running = yield* sql `
+        UPDATE flows_runs
+        SET
+          status = 'suspended',
+          owner_host_id = NULL,
+          owner_pid = NULL,
+          owner_nonce = NULL,
+          heartbeat_at_ms = NULL,
+          waiting_reason = 'released',
+          waiting_wake_at_ms = NULL,
+          waiting_token = NULL
+        WHERE status = 'running'
+        RETURNING run_id
+      `.withoutTransform;
+        yield* sql `DELETE FROM flows_consensus_leases`.withoutTransform;
+        return { clearedClaims: claims.length, suspendedRuns: running.length };
+    })).pipe(Effect.mapError(sqlFailure("fence", "invalidating the persisted fences")));
+});
+/**
+ * Restores a backup and immediately fences the restored database.
+ *
+ * This is the one-shot operator API for disaster recovery. The database
+ * driver itself still arrives through a caller-supplied Layer so this module
+ * remains host-neutral and browser-bundleable; the bundled Node script passes
+ * `NodeDatabase.layer` for the restored file.
+ *
+ * @since 0.1.0
+ * @category operations
+ */
+export const restoreAndFence = (options) => Effect.gen(function* () {
+    const restored = yield* restore(options);
+    const summary = yield* fence(restored.manifest).pipe(Effect.provide(options.databaseLayer(restored.databaseFile)));
+    return { ...restored, fence: summary };
+});
+//# sourceMappingURL=DisasterRecovery.js.map

package/dist/esm/DisasterRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisasterRecovery.js","sourceRoot":"","sources":["../../src/DisasterRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,mBAAmB,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAE/C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAC1D,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC,CAAA;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC,MAAM;CACzB,CAAC,CAAA;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC,MAAM;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;KAC3C,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;CACvC,CAAC,CAAA;AAUF,oDAAoD;AACpD,MAAM,sBAAsB,GAAG,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,CAAA;AAEpE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACvD,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,IAAI;IACJ,KAAK;CACN,CAAC,CAAA;AAUF;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,4CAA4C,EAC5C;IACE,IAAI,EAAE,yBAAyB;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,OAAO;CACtB,CACF;CAAG;AAiHJ,MAAM,KAAK,GAAG,CACZ,MAAc,EACd,IAA+B,EAC/B,OAAe,EACf,KAAc,EACS,EAAE,CACzB,IAAI,qBAAqB,CAAC;IACxB,IAAI;IACJ,MAAM;IACN,OAAO,EAAE,GAAG,IAAI,sBAAsB,MAAM,KAAK,OAAO,EAAE;IAC1D,KAAK;CACN,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,KAAc,EAAyB,EAAE,CAC/F,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,+BAA+B,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;AAEtE,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,KAAc,EAAyB,EAAE,CAChG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,wBAAwB,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;AAEhE,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAkE,EAAE,CACpG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE9D,sEAAsE;AACtE,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,OAAwB,EACQ,EAAE;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAA;IACvD,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,KAAK,CACV,MAAM,EACN,iBAAiB,EACjB,yEAAyE,MAAM,CAAC,KAAK,CAAC,EAAE,EACxF,KAAK,CACN,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,aAAa,GAAG,CACpB,EAAyB,EACzB,MAAc,EACd,IAAY,EACZ,KAAa,EAC+B,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7F,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAM;IACtC,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,IAAI,CAAC,IAAI,6BAA6B,KAAK,kBAAkB,CAAA;IAC3F,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAC3B,EAAyB,EACzB,MAAc,EACd,SAAiB,EAC2B,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC,CAC5D,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE,CAAC,CAAC,CAC3D,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,kBAAkB,OAAO,CAAC,MAAM,UAAU,EAAE,SAAS,CAAC,CAC9F,CAAA;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,SAAS,GAAG,CAAC,KAAa,EAAsB,EAAE;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IACxE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAA;AAE9G,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,CACxB,GAAwB,EACxB,MAAc,EACiD,EAAE,CACjE,GAAG,CAA0D;;GAE5D,CAAC,gBAAgB,CAAC,IAAI,CACrB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACrG,CAAA;AAOH,8EAA8E;AAC9E,MAAM,eAAe,GAAG,CACtB,GAAwB,EAC6B,EAAE,CACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAgC;;KAE3D,CAAC,gBAAgB,CAAC,IAAI,CACrB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC,CACzF,CAAA;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAG5B;;KAED,CAAC,gBAAgB,CAAC,IAAI,CACrB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC,CACvF,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,MAAM,aAAa,GAAG,CAAC,KAA4C,EAAyB,EAAE,CAC5F,KAAK,CAAC,QAAQ,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACpE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,KACE,MAAM,MAAM,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CACtF,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC/B;YACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KACE,MAAM,MAAM,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CACpF,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC/B;YACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3B,KACE,MAAM,MAAM,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAC9E,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC/B;YACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AACtC,CAAC,CAAC,CAAA;AAEJ,oEAAoE;AACpE,MAAM,YAAY,GAAG,CACnB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,gBAAwB,EAC6C,EAAE,CACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,eAAe,IAAI,gBAAgB,EAAE,CAAA;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAClG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,4DAA4D,EAAE,IAAI,CAAC,CACzG,CAAA;IACH,CAAC;IACD,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACvG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CACzE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,uCAAuC,EAAE,KAAK,CAAC,CACzF,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,iFAAiF;AACjF,MAAM,WAAW,GAAG,CAClB,EAAyB,EACzB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,gBAAwB,EACyC,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAClG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IACD,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,cAAc,QAAQ,0BAA0B,QAAQ,EAAE,EAAE,IAAI,CAAC,CAC1G,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,OAA4B,EAK5B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,gBAAgB,GAAG,KAAK,CAAA;IAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/E,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAE5D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAA;QAC/D,KAAK,CAAC,CAAC,GAAG,CAAA,eAAe,YAAY,EAAE,CAAC,IAAI,CAC1C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,kCAAkC,YAAY,EAAE,CAAC,CAAC,CACxF,CAAA;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACpC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EACnC,eAAe,CAChB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAA;QAClE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,YAAY,OAAO,CAAC,CAAC,CACrE,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE5C,MAAM,SAAS,GAAyB,EAAE,CAAA;QAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAClC,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,gBAAgB,EAAE,CAAC,CAAC,CACpE,CAAA;YACD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC/B,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAQ;gBAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;gBACjD,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;gBAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC,CAC1D,CAAA;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACtC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CACH,QAAQ,EACR,qBAAqB,EACrB,GAAG,MAAM,cAAc,QAAQ,yCAAyC,EACxE,MAAM,CACP,CACF,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC/E,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;oBAC5F,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,sCAAsC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC7F,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;gBAClG,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC7D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CACH,QAAQ,EACR,qBAAqB,EACrB,kCAAkC,OAAO,CAAC,MAAM,wCAAwC,EACxF,EAAE,OAAO,EAAE,CACZ,CACF,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAmB;YAC/B,aAAa,EAAE,CAAC;YAChB,WAAW;YACX,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,MAAM;gBACN,SAAS,EAAE,aAAa,CAAC,MAAM;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC;YACD,SAAS;SACV,CAAA;QACD,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAA;QAC/D,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QACxF,IAAI,aAAa,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAChD,MAAM,OAAO,GACX,GAAG,YAAY,OAAO,aAAa,CAAC,UAAU,6BAA6B,gBAAgB,kBAAkB,CAAA;YAC/G,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,gBAAgB,EAAE,CAAC,CAAC,CACpE,CAAA;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,kEAAkE;IAClE,2EAA2E;IAC3E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,MAAM,CAAC,OAAO,CACZ,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACvF,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CACF,EACD,MAAM,CAAC,MAAM,CACd,CAAA;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACnD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAC7B,EAAE,EACF,OAAO,CAAC,gBAAgB,EACxB,OAAO,EACP,SAAS,CAAC,QAAQ,EAAE,mCAAmC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CACnF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAA;AACjD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAA;AAErD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAClE,eAAuB,EACvB,UAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,gBAAgB,GAAG,KAAK,CAAA;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAA;IACrF,KAAK,CAAC,CAAC,WAAW,CAChB,EAAE,EACF,QAAQ,EACR,GAAG,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAC9C,QAAQ,CAAC,QAAQ,CAAC,MAAM,EACxB,gBAAgB,CACjB,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,WAAW,CAChB,EAAE,EACF,QAAQ,EACR,QAAQ,CAAC,GAAG,eAAe,IAAI,oBAAoB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EACpE,KAAK,CAAC,MAAM,EACZ,gBAAgB,CACjB,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAC,OAAuB;IAC5F,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,gBAAgB,GAAG,KAAK,CAAA;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAA;IAC9F,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAEnE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,WAAW,CACtC,EAAE,EACF,SAAS,EACT,GAAG,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EACtD,QAAQ,CAAC,QAAQ,CAAC,MAAM,EACxB,gBAAgB,CACjB,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAA;IACrE,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,YAAY,EAAE,CAAC,CAAC,CACjE,CAAA;IAED,MAAM,gBAAgB,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAA;IAC7E,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAC9B,EAAE,EACF,SAAS,EACT,QAAQ,CAAC,GAAG,OAAO,CAAC,eAAe,IAAI,oBAAoB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAC5E,KAAK,CAAC,MAAM,EACZ,gBAAgB,CACjB,CAAA;QACD,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,gBAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAClG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,sCAAsC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAC5F,CAAA;QACD,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,wBAAwB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAC9E,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,CAAC;QAChB,YAAY;QACZ,iBAAiB,EAAE,QAAQ,CAAC,WAAW;QACvC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;KACzC,CAAA;IACD,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CACvB,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,EAAE,EACtD,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,sBAAsB,EAAE,CAAC,CAAC,CAAC,CAAA;IAClF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAA0B,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAC,QAAwB;IACzF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAA;IAC7C,MAAM,GAAG,GAAG,CAAC,SAA2B,EAAU,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,EAAE,CAAA;IACjG,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5F,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CACH,OAAO,EACP,iBAAiB,EACjB,kCAAkC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAC3D,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAC7B,GAAG,EACH,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CACF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;;;;;;;;OASrD,CAAC,gBAAgB,CAAA;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAA6B;;;;;;;;;;;;;OAatD,CAAC,gBAAgB,CAAA;QAClB,KAAK,CAAC,CAAC,GAAG,CAAA,oCAAoC,CAAC,gBAAgB,CAAA;QAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAyB,CAAA;IAC/F,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC,CAAC,CAAA;AACnF,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAqC,EACqE,EAAE,CAC5G,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAC7D,CAAA;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAgC,CAAA;AACtE,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Hot backup, verified restore, and restore-time fencing for the durable\n * flows store.\n *\n * A backup captures the whole SQLite database — journal, run store, step\n * cache, engine state, and the out-of-ladder objects created by\n * `internal/EngineStateSchema.ts` — with `VACUUM INTO`, which reads one\n * consistent snapshot under WAL while writers stay live. The content-addressed\n * artifact blobs are copied beside it, digest-verified, after the database\n * snapshot: results reference artifacts only after publication\n * (`packages/smithers/flows/step-cache/docs/api.md`), so a blob walk taken after the\n * database snapshot is a superset of every digest the snapshot references.\n * A manifest written last records the digests a restore must verify, so a\n * partial backup is detectable by its missing manifest.\n *\n * Restore never lets a pre-backup owner resurrect. The fencing token is the\n * `OwnerId` triple mirrored on `flows_runs` and arbitrated by the journal's\n * `flows_consensus_leases` — Temporal's shard `rangeID` equality check reduced\n * to one SQL predicate (`reference/temporal`\n * `service/history/shard/context_impl.go`, `renewRangeLocked`). Temporal\n * fences a restored shard by bumping the persisted epoch above anything a\n * surviving owner could hold; the equivalent bump for an identity fence is\n * {@link fence}: clear every persisted claim, owner, and consensus lease in\n * one serialized write transaction, so every pre-backup `OwnerId` fails its\n * equality compare-and-swap (`FenceLost`, journal `fence_lost`) and the\n * restored runs are claimable immediately instead of after the heartbeat\n * staleness cutoff.\n *\n * Host access arrives through Effect's `FileSystem` and `SqlClient` tags and\n * hashing through the injected `Crypto` service, so the module carries no\n * platform binding. The SQL dialect is SQLite — a non-SQLite backend fails\n * with the `sql` code rather than pretending to snapshot. Every file is\n * stat-checked before it is buffered for hashing or copying. The configurable\n * ceiling defaults to {@link defaultMaxFileSizeBytes}; an oversized file fails\n * with the typed `io` code instead of reaching the host's allocation limit.\n *\n * @since 0.1.0\n */\n\nimport * as ArtifactBackupLease from \"@smthrs/artifacts/ArtifactBackupLease\"\nimport { Sha256 } from \"@smthrs/crypto\"\nimport { DurableWriter } from \"@smthrs/database/DurableWriter\"\nimport * as Clock from \"effect/Clock\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Effect from \"effect/Effect\"\nimport * as FileSystem from \"effect/FileSystem\"\nimport type * as Layer from \"effect/Layer\"\nimport * as Schema from \"effect/Schema\"\nimport * as SqlClient from \"effect/unstable/sql/SqlClient\"\nimport * as ArtifactRoots from \"./internal/ArtifactRoots.ts\"\n\n/**\n * The database file name inside a backup directory and a restored store\n * directory.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const databaseFileName = \"store.sqlite3\"\n\n/**\n * The manifest file name inside a backup directory. It is written last, so\n * its presence marks a complete backup.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const manifestFileName = \"manifest.json\"\n\n/**\n * The artifact blob directory name inside a backup directory and a restored\n * store directory, laid out with the store's own two-hex-prefix fanout.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const objectsDirectoryName = \"objects\"\n\n/**\n * The marker file a restore writes into the target directory, recording when\n * the restore happened and which backup it came from.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const restoredMarkerFileName = \"restored.json\"\n\n/**\n * Default ceiling for one backup file read into memory: 512 MiB.\n *\n * @since 1.0.0\n * @category constants\n */\nexport const defaultMaxFileSizeBytes = 512 * 1024 * 1024\n\n/**\n * One applied row of the shared `flows_migrations` table, recorded at backup\n * time and re-verified at fence time as the schema version of the snapshot.\n *\n * @since 0.1.0\n * @category schemas\n */\nexport const AppliedMigration = Schema.Struct({\n  migrationId: Schema.Number,\n  name: Schema.String\n})\n\n/**\n * One applied row of the shared `flows_migrations` table.\n *\n * @since 0.1.0\n * @category models\n */\nexport type AppliedMigration = typeof AppliedMigration.Type\n\n/**\n * One captured artifact blob. `sizeBytes` is informational for operators; the\n * digest is the integrity check.\n *\n * @since 0.1.0\n * @category schemas\n */\nexport const ArtifactEntry = Schema.Struct({\n  digest: Sha256.Digest,\n  sizeBytes: Schema.Number\n})\n\n/**\n * One captured artifact blob.\n *\n * @since 0.1.0\n * @category models\n */\nexport type ArtifactEntry = typeof ArtifactEntry.Type\n\n/**\n * The verification contract of a backup: the database snapshot's digest and\n * schema version, and the digest of every captured artifact blob.\n *\n * @since 0.1.0\n * @category schemas\n */\nexport const BackupManifest = Schema.Struct({\n  formatVersion: Schema.Literal(1),\n  createdAtMs: Schema.Number,\n  database: Schema.Struct({\n    file: Schema.Literal(databaseFileName),\n    sha256: Sha256.Digest,\n    sizeBytes: Schema.Number,\n    migrations: Schema.Array(AppliedMigration)\n  }),\n  artifacts: Schema.Array(ArtifactEntry)\n})\n\n/**\n * The verification contract of a backup.\n *\n * @since 0.1.0\n * @category models\n */\nexport type BackupManifest = typeof BackupManifest.Type\n\n/** JSON text carrying a decoded backup manifest. */\nconst ManifestFromJsonString = Schema.fromJsonString(BackupManifest)\n\n/**\n * Stable failure codes surfaced by backup, verify, restore, and fence.\n * `invalid_options` reports a public option that cannot be admitted safely.\n *\n * @since 0.1.0\n * @category errors\n */\nexport const DisasterRecoveryErrorCode = Schema.Literals([\n  \"invalid_options\",\n  \"not_empty\",\n  \"invalid_manifest\",\n  \"missing_file\",\n  \"digest_mismatch\",\n  \"artifact_corruption\",\n  \"snapshot_incomplete\",\n  \"schema_mismatch\",\n  \"io\",\n  \"sql\"\n])\n\n/**\n * A stable disaster-recovery failure code.\n *\n * @since 0.1.0\n * @category errors\n */\nexport type DisasterRecoveryErrorCode = typeof DisasterRecoveryErrorCode.Type\n\n/**\n * A normalized backup or restore failure. The identity string equals this\n * module's package path, per the house rule that a new identity is the\n * defining module path.\n *\n * @since 0.1.0\n * @category errors\n */\nexport class DisasterRecoveryError extends Schema.TaggedError<DisasterRecoveryError>()(\n  \"@smthrs/engine-store/DisasterRecoveryError\",\n  {\n    code: DisasterRecoveryErrorCode,\n    method: Schema.String,\n    message: Schema.String,\n    cause: Schema.Unknown\n  }\n) {}\n\n/**\n * Shared buffering limit for backup, verification, and restore operations.\n *\n * @since 1.0.0\n * @category models\n */\nexport interface FileSizeOptions {\n  /**\n   * Largest file, in bytes, that backup, verification, or restore may buffer.\n   * The value must be a finite non-negative safe integer. Defaults to\n   * {@link defaultMaxFileSizeBytes}.\n   */\n  readonly maxFileSizeBytes?: number | undefined\n}\n\n/**\n * Where a backup is written and which artifact store it captures.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface BackupOptions<R = never, E = never> extends FileSizeOptions {\n  /** The directory the backup is written into. Created when absent; must be empty when present. */\n  readonly directory: string\n  /**\n   * The live store's content-addressed objects directory (the\n   * `ArtifactStore.layerFileSystem` directory). When set, the whole capture\n   * holds the cross-process artifact backup lease, so a concurrent\n   * `ArtifactGc.gc` sweep cannot delete a blob between the database snapshot\n   * and its copy. Absent means the composition has no filesystem artifact\n   * tier: the backup carries no blobs and takes no lease, because there is\n   * no objects directory to fence, and a frozen snapshot that references any\n   * artifact digest fails with `snapshot_incomplete` instead of reporting\n   * success. A filesystem-backed composition must therefore pass the same\n   * directory it gives `ArtifactStore.layerFileSystem`.\n   */\n  readonly objectsDirectory?: string | undefined\n  /**\n   * Opens the frozen `VACUUM INTO` file so backup can enumerate artifact\n   * roots and migrations from that exact snapshot, independently of the live\n   * connection. The host should open this file without applying migrations.\n   */\n  readonly snapshotDatabaseLayer: (databaseFile: string) => Layer.Layer<SqlClient.SqlClient, E, R>\n}\n\n/**\n * Which backup to restore and where the restored store lands.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface RestoreOptions extends FileSizeOptions {\n  /** The directory a previous {@link backup} wrote. */\n  readonly backupDirectory: string\n  /** The fresh directory the restored store is written into. Created when absent; must be empty when present. */\n  readonly targetDirectory: string\n}\n\n/**\n * Which backup to restore and how to open the freshly restored SQLite file\n * for restore-time fencing.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface RestoreAndFenceOptions<R = never, E = never> extends RestoreOptions {\n  /**\n   * Builds the database and durable-writer layer for the newly restored file.\n   * This keeps database opening as the caller's host composition rather than\n   * importing a Node-only driver into this browser-safe module.\n   */\n  readonly databaseLayer: (databaseFile: string) => Layer.Layer<DurableWriter | SqlClient.SqlClient, E, R>\n}\n\n/**\n * The restored store's on-disk locations, ready to compose database and\n * artifact layers over.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface RestoredStore {\n  readonly databaseFile: string\n  readonly objectsDirectory: string\n  readonly manifest: BackupManifest\n}\n\n/**\n * A restored store after restore-time fencing has invalidated pre-backup\n * owners.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface FencedRestoredStore extends RestoredStore {\n  readonly fence: FenceSummary\n}\n\n/**\n * What {@link fence} invalidated on the restored store.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface FenceSummary {\n  /** Runs whose pending claim columns were cleared. */\n  readonly clearedClaims: number\n  /** Runs that were `running` at backup time, now suspended with their owner fence cleared. */\n  readonly suspendedRuns: number\n}\n\nconst error = (\n  method: string,\n  code: DisasterRecoveryErrorCode,\n  message: string,\n  cause: unknown\n): DisasterRecoveryError =>\n  new DisasterRecoveryError({\n    code,\n    method,\n    message: `${code}: DisasterRecovery.${method}: ${message}`,\n    cause\n  })\n\n/**\n * One mapper per failure family, shared across every call site so the\n * vocabulary stays uniform.\n */\nconst ioFailure = (method: string, subject: string) => (cause: unknown): DisasterRecoveryError =>\n  error(method, \"io\", `the host filesystem refused ${subject}`, cause)\n\nconst sqlFailure = (method: string, subject: string) => (cause: unknown): DisasterRecoveryError =>\n  error(method, \"sql\", `the database refused ${subject}`, cause)\n\n/** Hashes bytes with the injected crypto service; a broken host is a defect. */\nconst measure = (bytes: Uint8Array): Effect.Effect<typeof Sha256.Digest.Type, never, Crypto.Crypto> =>\n  Schema.decodeUnknownEffect(Sha256)(bytes).pipe(Effect.orDie)\n\n/** Resolves and validates the shared whole-file buffering ceiling. */\nconst fileSizeLimit = (\n  method: string,\n  options: FileSizeOptions\n): number | DisasterRecoveryError => {\n  const limit = options.maxFileSizeBytes\n  if (limit === undefined) return defaultMaxFileSizeBytes\n  if (Number.isSafeInteger(limit) && limit >= 0) return limit\n  return error(\n    method,\n    \"invalid_options\",\n    `maxFileSizeBytes must be a finite non-negative safe integer; received ${String(limit)}`,\n    limit\n  )\n}\n\n/**\n * Refuses an oversized file before a whole-file read allocates its buffer.\n * Every caller admits `limit` through `fileSizeLimit`, so `BigInt` cannot\n * reject it.\n */\nconst checkFileSize = (\n  fs: FileSystem.FileSystem,\n  method: string,\n  path: string,\n  limit: number\n): Effect.Effect<void, DisasterRecoveryError> =>\n  Effect.gen(function*() {\n    const info = yield* fs.stat(path).pipe(Effect.mapError(ioFailure(method, `stating ${path}`)))\n    if (info.size <= BigInt(limit)) return\n    const message = `${path} is ${info.size} bytes, which exceeds the ${limit}-byte file limit`\n    return yield* Effect.fail(error(method, \"io\", message, new RangeError(message)))\n  })\n\n/**\n * Admits a target directory that does not exist yet — created recursively —\n * or exists empty. Anything else is refused rather than merged over.\n */\nconst ensureEmptyDirectory = (\n  fs: FileSystem.FileSystem,\n  method: string,\n  directory: string\n): Effect.Effect<void, DisasterRecoveryError> =>\n  Effect.gen(function*() {\n    const present = yield* fs.exists(directory).pipe(Effect.mapError(ioFailure(method, `probing ${directory}`)))\n    if (!present) {\n      return yield* fs.makeDirectory(directory, { recursive: true }).pipe(\n        Effect.mapError(ioFailure(method, `creating ${directory}`))\n      )\n    }\n    const entries = yield* fs.readDirectory(directory).pipe(\n      Effect.mapError(ioFailure(method, `listing ${directory}`))\n    )\n    if (entries.length > 0) {\n      return yield* Effect.fail(\n        error(method, \"not_empty\", `${directory} already holds ${entries.length} entries`, directory)\n      )\n    }\n  })\n\n/**\n * A relative blob path in the store's fanout layout: a two-hex directory\n * holding a 64-hex digest that begins with it. Anything else under the\n * objects directory — a scratch `.tmp-*` file, the fanout directory itself —\n * is not part of the store's address space.\n */\nconst blobEntry = (entry: string): string | undefined => {\n  const match = entry.match(/^([0-9a-f]{2})[/\\\\]([0-9a-f]{64})$/)\n  if (match === null || !match[2]!.startsWith(match[1]!)) return undefined\n  return match[2]\n}\n\nconst blobPath = (directory: string, digest: string): string => `${directory}/${digest.slice(0, 2)}/${digest}`\n\n/** The applied rows of the shared migrations table, in ladder order. */\nconst appliedMigrations = (\n  sql: SqlClient.SqlClient,\n  method: string\n): Effect.Effect<Array<AppliedMigration>, DisasterRecoveryError> =>\n  sql<{ readonly migration_id: number; readonly name: string }>`\n    SELECT migration_id, name FROM flows_migrations ORDER BY migration_id ASC\n  `.withoutTransform.pipe(\n    Effect.mapError(sqlFailure(method, \"reading flows_migrations\")),\n    Effect.map((rows) => rows.map((row) => ({ migrationId: Number(row.migration_id), name: row.name })))\n  )\n\ninterface SnapshotState {\n  readonly migrations: Array<AppliedMigration>\n  readonly artifactRoots: ReadonlySet<string>\n}\n\n/** Reads every artifact root from the frozen database, never the live one. */\nconst inspectSnapshot = (\n  sql: SqlClient.SqlClient\n): Effect.Effect<SnapshotState, DisasterRecoveryError> =>\n  Effect.gen(function*() {\n    const migrations = yield* appliedMigrations(sql, \"backup\")\n    const cacheRows = yield* sql<{ readonly meta_json: string }>`\n      SELECT meta_json FROM flows_step_cache\n    `.withoutTransform.pipe(\n      Effect.mapError(sqlFailure(\"backup\", \"reading artifact roots from snapshot step cache\"))\n    )\n    const attemptRows = yield* sql<{\n      readonly checkpoint_json: string | null\n      readonly meta_json: string\n    }>`\n      SELECT checkpoint_json, meta_json FROM flows_attempts\n    `.withoutTransform.pipe(\n      Effect.mapError(sqlFailure(\"backup\", \"reading artifact roots from snapshot attempts\"))\n    )\n    const artifactRoots = new Set<string>()\n    const decodeFailure = (cause: ArtifactRoots.ArtifactRootDecodeError): DisasterRecoveryError =>\n      error(\"backup\", \"snapshot_incomplete\", cause.message, cause.cause)\n    for (const row of cacheRows) {\n      for (\n        const digest of yield* ArtifactRoots.rootDigests(\"flows_step_cache\", row.meta_json).pipe(\n          Effect.mapError(decodeFailure)\n        )\n      ) artifactRoots.add(digest)\n    }\n    for (const row of attemptRows) {\n      for (\n        const digest of yield* ArtifactRoots.rootDigests(\"flows_attempts\", row.meta_json).pipe(\n          Effect.mapError(decodeFailure)\n        )\n      ) artifactRoots.add(digest)\n      for (\n        const digest of yield* ArtifactRoots.checkpointDigests(row.checkpoint_json).pipe(\n          Effect.mapError(decodeFailure)\n        )\n      ) artifactRoots.add(digest)\n    }\n    return { migrations, artifactRoots }\n  })\n\n/** Reads and decodes the manifest a backup directory must carry. */\nconst readManifest = (\n  fs: FileSystem.FileSystem,\n  method: string,\n  backupDirectory: string,\n  maxFileSizeBytes: number\n): Effect.Effect<BackupManifest, DisasterRecoveryError, Crypto.Crypto> =>\n  Effect.gen(function*() {\n    const path = `${backupDirectory}/${manifestFileName}`\n    const present = yield* fs.exists(path).pipe(Effect.mapError(ioFailure(method, `probing ${path}`)))\n    if (!present) {\n      return yield* Effect.fail(\n        error(method, \"missing_file\", `${path} does not exist — the backup is incomplete or not a backup`, path)\n      )\n    }\n    yield* checkFileSize(fs, method, path, maxFileSizeBytes)\n    const text = yield* fs.readFileString(path).pipe(Effect.mapError(ioFailure(method, `reading ${path}`)))\n    return yield* Schema.decodeUnknownEffect(ManifestFromJsonString)(text).pipe(\n      Effect.mapError((cause) =>\n        error(method, \"invalid_manifest\", `${path} does not decode as a backup manifest`, cause)\n      )\n    )\n  })\n\n/** Reads a backup file and refuses bytes that no longer hash to the manifest. */\nconst checkedFile = (\n  fs: FileSystem.FileSystem,\n  method: string,\n  path: string,\n  expected: string,\n  maxFileSizeBytes: number\n): Effect.Effect<Uint8Array, DisasterRecoveryError, Crypto.Crypto> =>\n  Effect.gen(function*() {\n    const present = yield* fs.exists(path).pipe(Effect.mapError(ioFailure(method, `probing ${path}`)))\n    if (!present) {\n      return yield* Effect.fail(error(method, \"missing_file\", `${path} does not exist`, path))\n    }\n    yield* checkFileSize(fs, method, path, maxFileSizeBytes)\n    const bytes = yield* fs.readFile(path).pipe(Effect.mapError(ioFailure(method, `reading ${path}`)))\n    const measured = yield* measure(bytes)\n    if (measured !== expected) {\n      return yield* Effect.fail(\n        error(method, \"digest_mismatch\", `${path} hashes to ${measured}, the manifest records ${expected}`, path)\n      )\n    }\n    return bytes\n  })\n\n/**\n * Captures a hot backup of the live store into an empty directory.\n *\n * The database is snapshotted first with `VACUUM INTO` — a read transaction\n * under WAL, so live writers are never blocked and the copy is one consistent\n * point in time. The artifact walk runs after it, so every digest the\n * snapshot references is captured (publication precedes reference). Blobs are\n * digest-verified as they are copied; a blob whose bytes no longer hash to\n * its address fails the backup loudly rather than capturing corruption. The\n * manifest is encoded and admitted under the same file-size ceiling before it\n * is written last, so a successful backup remains readable with its own\n * options.\n *\n * With an `objectsDirectory`, the whole capture holds the artifact backup\n * lease, so concurrent sweep deletion cannot remove a referenced blob\n * mid-copy. Without one, no lease is taken; the frozen-root verification\n * still fails the backup loudly when the snapshot references any blob, so an\n * unfenced capture can never report success while missing artifact bytes.\n *\n * @since 0.1.0\n * @category operations\n */\nexport const backup = <R = never, E = never>(\n  options: BackupOptions<R, E>\n): Effect.Effect<\n  BackupManifest,\n  DisasterRecoveryError | E,\n  SqlClient.SqlClient | FileSystem.FileSystem | Crypto.Crypto | R\n> =>\n  Effect.gen(function*() {\n    const limit = fileSizeLimit(\"backup\", options)\n    if (typeof limit !== \"number\") return yield* Effect.fail(limit)\n    const maxFileSizeBytes = limit\n    const sql = yield* Effect.service(SqlClient.SqlClient)\n    const fs = yield* FileSystem.FileSystem\n    const createdAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor))\n    yield* ensureEmptyDirectory(fs, \"backup\", options.directory)\n\n    const capture = Effect.gen(function*() {\n      const databasePath = `${options.directory}/${databaseFileName}`\n      yield* sql`VACUUM INTO ${databasePath}`.pipe(\n        Effect.mapError(sqlFailure(\"backup\", `snapshotting the database into ${databasePath}`))\n      )\n      const snapshot = yield* Effect.flatMap(\n        Effect.service(SqlClient.SqlClient),\n        inspectSnapshot\n      ).pipe(Effect.provide(options.snapshotDatabaseLayer(databasePath)))\n      // Opening the frozen file may normalize SQLite journal metadata, so its\n      // manifest digest is measured only after the inspection connection closes.\n      yield* checkFileSize(fs, \"backup\", databasePath, maxFileSizeBytes)\n      const databaseBytes = yield* fs.readFile(databasePath).pipe(\n        Effect.mapError(ioFailure(\"backup\", `reading ${databasePath} back`))\n      )\n      const sha256 = yield* measure(databaseBytes)\n\n      const artifacts: Array<ArtifactEntry> = []\n      const captured = new Set<string>()\n      if (options.objectsDirectory !== undefined) {\n        const objectsDirectory = options.objectsDirectory\n        const entries = yield* fs.readDirectory(objectsDirectory, { recursive: true }).pipe(\n          Effect.mapError(ioFailure(\"backup\", `listing ${objectsDirectory}`))\n        )\n        for (const entry of [...entries].sort()) {\n          const digest = blobEntry(entry)\n          if (digest === undefined) continue\n          const source = blobPath(objectsDirectory, digest)\n          yield* checkFileSize(fs, \"backup\", source, maxFileSizeBytes)\n          const bytes = yield* fs.readFile(source).pipe(\n            Effect.mapError(ioFailure(\"backup\", `reading ${source}`))\n          )\n          const measured = yield* measure(bytes)\n          if (measured !== digest) {\n            return yield* Effect.fail(\n              error(\n                \"backup\",\n                \"artifact_corruption\",\n                `${source} hashes to ${measured}; repair the store before backing it up`,\n                source\n              )\n            )\n          }\n          const target = blobPath(`${options.directory}/${objectsDirectoryName}`, digest)\n          yield* fs.makeDirectory(`${options.directory}/${objectsDirectoryName}/${digest.slice(0, 2)}`, {\n            recursive: true\n          }).pipe(Effect.mapError(ioFailure(\"backup\", `creating the objects directory for ${digest}`)))\n          yield* fs.writeFile(target, bytes).pipe(Effect.mapError(ioFailure(\"backup\", `writing ${target}`)))\n          artifacts.push({ digest: measured, sizeBytes: bytes.length })\n          captured.add(measured)\n        }\n      }\n\n      const missing = [...snapshot.artifactRoots].filter((digest) => !captured.has(digest)).sort()\n      if (missing.length > 0) {\n        return yield* Effect.fail(\n          error(\n            \"backup\",\n            \"snapshot_incomplete\",\n            `the frozen database references ${missing.length} artifact blobs absent from the backup`,\n            { missing }\n          )\n        )\n      }\n\n      const manifest: BackupManifest = {\n        formatVersion: 1,\n        createdAtMs,\n        database: {\n          file: databaseFileName,\n          sha256,\n          sizeBytes: databaseBytes.length,\n          migrations: snapshot.migrations\n        },\n        artifacts\n      }\n      const manifestPath = `${options.directory}/${manifestFileName}`\n      const manifestBytes = new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\\n`)\n      if (manifestBytes.byteLength > maxFileSizeBytes) {\n        const message =\n          `${manifestPath} is ${manifestBytes.byteLength} bytes, which exceeds the ${maxFileSizeBytes}-byte file limit`\n        return yield* Effect.fail(error(\"backup\", \"io\", message, new RangeError(message)))\n      }\n      yield* fs.writeFile(manifestPath, manifestBytes).pipe(\n        Effect.mapError(ioFailure(\"backup\", `writing ${manifestFileName}`))\n      )\n      return manifest\n    })\n\n    // The directory was empty when the capture began, so everything in it is\n    // this capture's: the snapshot, any SQLite sidecar the inspection\n    // connection left, and the copied blobs. A failed capture removes them and\n    // leaves the directory reusable for a retry. Cleanup is best effort; the\n    // original failure is the one reported.\n    const discardPartial = fs.readDirectory(options.directory).pipe(\n      Effect.flatMap((entries) =>\n        Effect.forEach(\n          entries,\n          (entry) => fs.remove(`${options.directory}/${entry}`, { recursive: true, force: true }),\n          { discard: true }\n        )\n      ),\n      Effect.ignore\n    )\n\n    return yield* (options.objectsDirectory === undefined\n      ? capture\n      : ArtifactBackupLease.withLease(\n        fs,\n        options.objectsDirectory,\n        capture,\n        ioFailure(\"backup\", `coordinating artifact backup in ${options.objectsDirectory}`)\n      )).pipe(Effect.onError(() => discardPartial))\n  }).pipe(Effect.withSpan(\"DisasterRecovery.backup\"))\n\n/**\n * Verifies a backup directory against its manifest without restoring it:\n * the manifest decodes, the database snapshot hashes to its recorded digest,\n * and every listed artifact blob is present and hashes to its address.\n *\n * @since 0.1.0\n * @category operations\n */\nexport const verify = Effect.fn(\"DisasterRecovery.verify\")(function*(\n  backupDirectory: string,\n  options: FileSizeOptions = {}\n) {\n  const limit = fileSizeLimit(\"verify\", options)\n  if (typeof limit !== \"number\") return yield* Effect.fail(limit)\n  const maxFileSizeBytes = limit\n  const fs = yield* FileSystem.FileSystem\n  const manifest = yield* readManifest(fs, \"verify\", backupDirectory, maxFileSizeBytes)\n  yield* checkedFile(\n    fs,\n    \"verify\",\n    `${backupDirectory}/${manifest.database.file}`,\n    manifest.database.sha256,\n    maxFileSizeBytes\n  )\n  for (const entry of manifest.artifacts) {\n    yield* checkedFile(\n      fs,\n      \"verify\",\n      blobPath(`${backupDirectory}/${objectsDirectoryName}`, entry.digest),\n      entry.digest,\n      maxFileSizeBytes\n    )\n  }\n  return manifest\n})\n\n/**\n * Restores a verified backup into an empty target directory.\n *\n * Every byte is re-verified against the manifest as it is copied, so a backup\n * that rotted in storage is refused rather than restored. The target holds\n * the database file, the objects directory, and a `restored.json` marker; it\n * is a fresh store directory to compose `NodeDatabase.layer` and\n * `ArtifactStore.layerFileSystem` over. The database is restored with the\n * pre-backup owner fences still in place — run {@link fence} against it\n * before any engine adopts it.\n *\n * @since 0.1.0\n * @category operations\n */\nexport const restore = Effect.fn(\"DisasterRecovery.restore\")(function*(options: RestoreOptions) {\n  const limit = fileSizeLimit(\"restore\", options)\n  if (typeof limit !== \"number\") return yield* Effect.fail(limit)\n  const maxFileSizeBytes = limit\n  const fs = yield* FileSystem.FileSystem\n  const manifest = yield* readManifest(fs, \"restore\", options.backupDirectory, maxFileSizeBytes)\n  yield* ensureEmptyDirectory(fs, \"restore\", options.targetDirectory)\n\n  const databaseBytes = yield* checkedFile(\n    fs,\n    \"restore\",\n    `${options.backupDirectory}/${manifest.database.file}`,\n    manifest.database.sha256,\n    maxFileSizeBytes\n  )\n  const databaseFile = `${options.targetDirectory}/${databaseFileName}`\n  yield* fs.writeFile(databaseFile, databaseBytes).pipe(\n    Effect.mapError(ioFailure(\"restore\", `writing ${databaseFile}`))\n  )\n\n  const objectsDirectory = `${options.targetDirectory}/${objectsDirectoryName}`\n  for (const entry of manifest.artifacts) {\n    const bytes = yield* checkedFile(\n      fs,\n      \"restore\",\n      blobPath(`${options.backupDirectory}/${objectsDirectoryName}`, entry.digest),\n      entry.digest,\n      maxFileSizeBytes\n    )\n    yield* fs.makeDirectory(`${objectsDirectory}/${entry.digest.slice(0, 2)}`, { recursive: true }).pipe(\n      Effect.mapError(ioFailure(\"restore\", `creating the objects directory for ${entry.digest}`))\n    )\n    yield* fs.writeFile(blobPath(objectsDirectory, entry.digest), bytes).pipe(\n      Effect.mapError(ioFailure(\"restore\", `writing the blob for ${entry.digest}`))\n    )\n  }\n\n  const restoredAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor))\n  const marker = {\n    formatVersion: 1,\n    restoredAtMs,\n    backupCreatedAtMs: manifest.createdAtMs,\n    databaseSha256: manifest.database.sha256\n  }\n  yield* fs.writeFileString(\n    `${options.targetDirectory}/${restoredMarkerFileName}`,\n    `${JSON.stringify(marker, null, 2)}\\n`\n  ).pipe(Effect.mapError(ioFailure(\"restore\", `writing ${restoredMarkerFileName}`)))\n  return { databaseFile, objectsDirectory, manifest } satisfies RestoredStore\n})\n\n/**\n * Bumps the restored store's fencing epoch so pre-backup owners are fenced\n * out.\n *\n * The store's fence is `OwnerId` equality, so the epoch bump is fence\n * invalidation: in one serialized write transaction every pending claim is\n * cleared, every run that was `running` at backup time is suspended with its\n * owner and heartbeat cleared, and every consensus lease is deleted. A\n * surviving pre-backup owner then fails every fenced operation against the\n * restored store — `heartbeat` and `transitionOwned` report `FenceLost`,\n * fenced journal appends fail `fence_lost` — exactly as a stale Temporal owner\n * fails its `rangeID` compare-and-swap. The suspended runs are claimable\n * immediately, without waiting out the heartbeat staleness cutoff and without\n * liveness evidence.\n *\n * Every migration recorded in the manifest must remain applied with the same\n * ID and namespaced name. Forward additions within any installed block are\n * compatible, including engine-store `3006` below an existing plan `4003`;\n * the current database layer applies them on open. A missing or renamed\n * historical entry fails `schema_mismatch` before ownership is cleared.\n *\n * In-flight attempt rows are deliberately untouched: attempt writes are\n * fenced on the run row's ownership, and the resuming engine adopts or\n * retries them under its own fresh owner.\n *\n * @since 0.1.0\n * @category operations\n */\nexport const fence = Effect.fn(\"DisasterRecovery.fence\")(function*(manifest: BackupManifest) {\n  const sql = yield* Effect.service(SqlClient.SqlClient)\n  const writer = yield* DurableWriter\n  const applied = yield* appliedMigrations(sql, \"fence\")\n  const expected = manifest.database.migrations\n  const key = (migration: AppliedMigration): string => `${migration.migrationId}:${migration.name}`\n  // IDs identify migrations within their reserved blocks. Compare historical\n  // identities independently so additions in lower blocks cannot shift them.\n  const appliedById = new Map(applied.map((migration) => [migration.migrationId, migration.name]))\n  if (expected.some((migration) => appliedById.get(migration.migrationId) !== migration.name)) {\n    return yield* Effect.fail(\n      error(\n        \"fence\",\n        \"schema_mismatch\",\n        `the restored database applied [${applied.map(key).join(\", \")}] but the manifest records [${\n          expected.map(key).join(\", \")\n        }]`,\n        { applied, expected }\n      )\n    )\n  }\n  return yield* writer.write(\n    Effect.gen(function*() {\n      const claims = yield* sql<{ readonly run_id: string }>`\n        UPDATE flows_runs\n        SET\n          claim_host_id = NULL,\n          claim_pid = NULL,\n          claim_nonce = NULL,\n          claimed_at_ms = NULL\n        WHERE claim_host_id IS NOT NULL\n        RETURNING run_id\n      `.withoutTransform\n      const running = yield* sql<{ readonly run_id: string }>`\n        UPDATE flows_runs\n        SET\n          status = 'suspended',\n          owner_host_id = NULL,\n          owner_pid = NULL,\n          owner_nonce = NULL,\n          heartbeat_at_ms = NULL,\n          waiting_reason = 'released',\n          waiting_wake_at_ms = NULL,\n          waiting_token = NULL\n        WHERE status = 'running'\n        RETURNING run_id\n      `.withoutTransform\n      yield* sql`DELETE FROM flows_consensus_leases`.withoutTransform\n      return { clearedClaims: claims.length, suspendedRuns: running.length } satisfies FenceSummary\n    })\n  ).pipe(Effect.mapError(sqlFailure(\"fence\", \"invalidating the persisted fences\")))\n})\n\n/**\n * Restores a backup and immediately fences the restored database.\n *\n * This is the one-shot operator API for disaster recovery. The database\n * driver itself still arrives through a caller-supplied Layer so this module\n * remains host-neutral and browser-bundleable; the bundled Node script passes\n * `NodeDatabase.layer` for the restored file.\n *\n * @since 0.1.0\n * @category operations\n */\nexport const restoreAndFence = <R = never, E = never>(\n  options: RestoreAndFenceOptions<R, E>\n): Effect.Effect<FencedRestoredStore, DisasterRecoveryError | E, FileSystem.FileSystem | Crypto.Crypto | R> =>\n  Effect.gen(function*() {\n    const restored = yield* restore(options)\n    const summary = yield* fence(restored.manifest).pipe(\n      Effect.provide(options.databaseLayer(restored.databaseFile))\n    )\n    return { ...restored, fence: summary } satisfies FencedRestoredStore\n  })\n"]}