@tangle-network/braid 0.1.0

package/dist/adapters/storage/sqlite-state-snapshot-lifecycle.js

@@ -0,0 +1,185 @@
+import { StorageError } from './sqlite-errors.js';
+import { asNumber, asString } from './sqlite-rows.js';
+import { asCredentialRef } from './sqlite-state-snapshot-codec.js';
+import { destroySnapshotCredentialsBeforeMutation, removeSnapshotCredentials, } from './sqlite-state-snapshot-keys.js';
+import { beginSnapshotTransaction, commit, rollbackSnapshotTransaction, } from './sqlite-state-snapshot-transaction.js';
+export class SqliteStateSnapshotLifecycle {
+    #runtime;
+    constructor(runtime) {
+        this.#runtime = runtime;
+    }
+    async prune() {
+        await this.#runtime.writes.run(() => this.pruneUnsafe());
+    }
+    async pruneAfterCommitUnsafe() {
+        try {
+            await this.pruneUnsafe();
+        }
+        catch {
+            // The snapshot or event is already durable; startup retries cleanup.
+        }
+    }
+    async discardCredentials(refs) {
+        await removeSnapshotCredentials(this.#runtime, refs);
+    }
+    async pruneUnsafe() {
+        const database = this.#runtime.database();
+        const scopeId = this.#runtime.scopeId();
+        const rows = database
+            .prepare(`SELECT snapshot_id, scope_id, generation, key_ref
+         FROM braid_state_snapshots
+         WHERE scope_id = ?
+         ORDER BY generation DESC, snapshot_id DESC
+         LIMIT -1 OFFSET 2`)
+            .all(scopeId);
+        if (rows.length === 0)
+            return;
+        const retiring = rows.map((row) => ({
+            snapshotId: asNumber(row.snapshot_id, 'snapshot_id'),
+            generation: asNumber(row.generation, 'generation'),
+            keyRef: asCredentialRef(row.key_ref),
+        }));
+        if (retiring.some((row) => row.keyRef === null)) {
+            throw new StorageError('STATE_SNAPSHOT_INVALID', 'Snapshot generation key reference is invalid');
+        }
+        beginSnapshotTransaction(database);
+        try {
+            for (const row of retiring) {
+                database
+                    .prepare('DELETE FROM braid_state_snapshots WHERE snapshot_id = ?')
+                    .run(row.snapshotId);
+                database
+                    .prepare('UPDATE braid_state_snapshot_keys SET retired = 1 WHERE scope_id = ? AND generation = ?')
+                    .run(scopeId, row.generation);
+            }
+            commit(this.#runtime, database, 'state.snapshot.prune');
+        }
+        catch (error) {
+            rollbackSnapshotTransaction(database);
+            throw error;
+        }
+        await removeSnapshotCredentials(this.#runtime, retiring.flatMap((row) => (row.keyRef === null ? [] : [row.keyRef])));
+        beginSnapshotTransaction(database);
+        try {
+            database
+                .prepare(`DELETE FROM braid_state_snapshot_keys AS key_row
+           WHERE key_row.scope_id = ? AND key_row.retired = 1
+             AND NOT EXISTS (
+               SELECT 1 FROM braid_state_snapshots AS snapshot_row
+               WHERE snapshot_row.key_ref = key_row.credential_ref
+             )`)
+                .run(scopeId);
+            commit(this.#runtime, database, 'state.snapshot.keys.remove');
+        }
+        catch (error) {
+            rollbackSnapshotTransaction(database);
+            throw error;
+        }
+    }
+    async destroyKeysBeforeMutation() {
+        const database = this.#runtime.database();
+        const refs = new Set();
+        const keyRows = database
+            .prepare('SELECT credential_ref FROM braid_state_snapshot_keys WHERE scope_id = ? AND retired = 0')
+            .all(this.#runtime.scopeId());
+        for (const row of keyRows) {
+            const ref = asCredentialRef(row.credential_ref);
+            if (ref !== null)
+                refs.add(ref);
+        }
+        const snapshotRows = database
+            .prepare('SELECT key_ref FROM braid_state_snapshots WHERE scope_id = ?')
+            .all(this.#runtime.scopeId());
+        for (const row of snapshotRows) {
+            const ref = asCredentialRef(row.key_ref);
+            if (ref !== null)
+                refs.add(ref);
+        }
+        await destroySnapshotCredentialsBeforeMutation(this.#runtime, [...refs]);
+    }
+    invalidateUnsafe() {
+        const database = this.#runtime.database();
+        const scopeId = this.#runtime.scopeId();
+        database.prepare('DELETE FROM braid_state_snapshots WHERE scope_id = ?').run(scopeId);
+        database
+            .prepare('UPDATE braid_state_snapshot_keys SET retired = 1 WHERE scope_id = ?')
+            .run(scopeId);
+    }
+    async finishInvalidationUnsafe() {
+        const database = this.#runtime.database();
+        const refs = database
+            .prepare('SELECT credential_ref FROM braid_state_snapshot_keys WHERE scope_id = ? AND retired = 1')
+            .all(this.#runtime.scopeId());
+        const parsedRefs = refs.flatMap((row) => {
+            const ref = asCredentialRef(row.credential_ref);
+            return ref === null ? [] : [ref];
+        });
+        await removeSnapshotCredentials(this.#runtime, parsedRefs);
+        beginSnapshotTransaction(database);
+        try {
+            database
+                .prepare(`DELETE FROM braid_state_snapshot_keys AS key_row
+           WHERE key_row.scope_id = ? AND key_row.retired = 1
+             AND NOT EXISTS (
+               SELECT 1 FROM braid_state_snapshots AS snapshot_row
+               WHERE snapshot_row.key_ref = key_row.credential_ref
+             )`)
+                .run(this.#runtime.scopeId());
+            commit(this.#runtime, database, 'state.snapshot.invalidation.cleanup');
+        }
+        catch (error) {
+            rollbackSnapshotTransaction(database);
+            throw error;
+        }
+    }
+    async reconcile() {
+        await this.#runtime.writes.run(() => this.reconcileUnsafe());
+    }
+    async reconcileUnsafe() {
+        const database = this.#runtime.database();
+        const active = new Set();
+        const snapshots = database
+            .prepare('SELECT scope_id, generation FROM braid_state_snapshots')
+            .all();
+        for (const row of snapshots) {
+            active.add(`${asString(row.scope_id, 'scope_id')}\u0000${asNumber(row.generation, 'generation')}`);
+        }
+        const keys = database
+            .prepare('SELECT scope_id, generation, credential_ref, retired FROM braid_state_snapshot_keys')
+            .all();
+        const stale = [];
+        for (const row of keys) {
+            const scopeId = asString(row.scope_id, 'scope_id');
+            const generation = asNumber(row.generation, 'generation');
+            if (Number(row.retired) === 1 || !active.has(`${scopeId}\u0000${generation}`)) {
+                const ref = asCredentialRef(row.credential_ref);
+                if (ref === null)
+                    throw new StorageError('STATE_SNAPSHOT_INVALID', 'Snapshot key reference is invalid');
+                stale.push({ scopeId, generation, ref });
+            }
+        }
+        await removeSnapshotCredentials(this.#runtime, stale.map((row) => row.ref));
+        if (stale.length === 0)
+            return;
+        beginSnapshotTransaction(database);
+        try {
+            for (const row of stale) {
+                database
+                    .prepare(`DELETE FROM braid_state_snapshot_keys AS key_row
+             WHERE key_row.scope_id = ? AND key_row.generation = ?
+               AND key_row.credential_ref = ?
+               AND NOT EXISTS (
+                 SELECT 1 FROM braid_state_snapshots AS snapshot_row
+                 WHERE snapshot_row.key_ref = key_row.credential_ref
+               )`)
+                    .run(row.scopeId, row.generation, row.ref);
+            }
+            commit(this.#runtime, database, 'state.snapshot.key.reconcile');
+        }
+        catch (error) {
+            rollbackSnapshotTransaction(database);
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=sqlite-state-snapshot-lifecycle.js.map

package/dist/adapters/storage/sqlite-state-snapshot-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-lifecycle.js","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAClE,OAAO,EACL,wCAAwC,EACxC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,MAAM,EACN,2BAA2B,GAC5B,MAAM,wCAAwC,CAAA;AAG/C,MAAM,OAAO,4BAA4B;IAC9B,QAAQ,CAAiB;IAElC,YAAY,OAAwB;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAA8B;QACrD,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ;aAClB,OAAO,CACN;;;;2BAImB,CACpB;aACA,GAAG,CAAC,OAAO,CAAuC,CAAA;QACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC;YACpD,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;YAClD,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC,CAAA;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,8CAA8C,CAC/C,CAAA;QACH,CAAC;QACD,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,QAAQ;qBACL,OAAO,CAAC,yDAAyD,CAAC;qBAClE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACtB,QAAQ;qBACL,OAAO,CACN,wFAAwF,CACzF;qBACA,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;YACjC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2BAA2B,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,yBAAyB,CAC7B,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CACrE,CAAA;QACD,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,QAAQ;iBACL,OAAO,CACN;;;;;eAKK,CACN;iBACA,GAAG,CAAC,OAAO,CAAC,CAAA;YACf,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2BAA2B,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,CAAA;QACrC,MAAM,OAAO,GAAG,QAAQ;aACrB,OAAO,CACN,yFAAyF,CAC1F;aACA,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAA8B,CAAA;QAC5D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC/C,IAAI,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ;aAC1B,OAAO,CAAC,8DAA8D,CAAC;aACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAuC,CAAA;QACrE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxC,IAAI,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,wCAAwC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,gBAAgB;QACd,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACvC,QAAQ,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrF,QAAQ;aACL,OAAO,CAAC,qEAAqE,CAAC;aAC9E,GAAG,CAAC,OAAO,CAAC,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,wBAAwB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,QAAQ;aAClB,OAAO,CACN,yFAAyF,CAC1F;aACA,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAA8B,CAAA;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC/C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QACF,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAC1D,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,QAAQ;iBACL,OAAO,CACN;;;;;eAKK,CACN;iBACA,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,qCAAqC,CAAC,CAAA;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2BAA2B,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;QAChC,MAAM,SAAS,GAAG,QAAQ;aACvB,OAAO,CAAC,wDAAwD,CAAC;aACjE,GAAG,EAAwC,CAAA;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CACR,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CACvF,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ;aAClB,OAAO,CACN,qFAAqF,CACtF;aACA,GAAG,EAA+B,CAAA;QACrC,MAAM,KAAK,GAIN,EAAE,CAAA;QACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;YAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;YACzD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,SAAS,UAAU,EAAE,CAAC,EAAE,CAAC;gBAC9E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBAC/C,IAAI,GAAG,KAAK,IAAI;oBACd,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAA;gBACvF,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QACD,MAAM,yBAAyB,CAC7B,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5B,CAAA;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC9B,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,QAAQ;qBACL,OAAO,CACN;;;;;;iBAMK,CACN;qBACA,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,8BAA8B,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2BAA2B,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;CACF"}

package/dist/adapters/storage/sqlite-state-snapshot-read.d.ts

@@ -0,0 +1,10 @@
+import type { StoredStateSnapshot } from '../../ports/storage.js';
+import type { SnapshotRuntime } from './sqlite-state-snapshot-types.js';
+export declare class SqliteStateSnapshotReader {
+    #private;
+    constructor(runtime: SnapshotRuntime);
+    latest(): Promise<StoredStateSnapshot | null>;
+    private read;
+    private quarantine;
+}
+//# sourceMappingURL=sqlite-state-snapshot-read.d.ts.map

package/dist/adapters/storage/sqlite-state-snapshot-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-read.d.ts","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-read.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAiBjE,OAAO,KAAK,EAGV,eAAe,EAChB,MAAM,kCAAkC,CAAA;AAEzC,qBAAa,yBAAyB;;IAGpC,YAAY,OAAO,EAAE,eAAe,EAEnC;IAEK,MAAM,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAwBlD;YAEa,IAAI;YAsCJ,UAAU;CAiEzB"}

package/dist/adapters/storage/sqlite-state-snapshot-read.js

@@ -0,0 +1,147 @@
+import { CredentialError } from '../../ports/credentials.js';
+import { decryptPayload } from './sqlite-crypto.js';
+import { StorageError } from './sqlite-errors.js';
+import { asBuffer, asString } from './sqlite-rows.js';
+import { asCredentialRef, asPositiveNumber, materializedSnapshotFromPayload, metadataFromRow, metadataFromRowSafe, } from './sqlite-state-snapshot-codec.js';
+import { removeSnapshotCredentials, resolveSnapshotKey } from './sqlite-state-snapshot-keys.js';
+import { beginSnapshotTransaction, commit, rollbackSnapshotTransaction, } from './sqlite-state-snapshot-transaction.js';
+export class SqliteStateSnapshotReader {
+    #runtime;
+    constructor(runtime) {
+        this.#runtime = runtime;
+    }
+    async latest() {
+        const scopeId = this.#runtime.scopeId();
+        for (;;) {
+            const row = this.#runtime
+                .database()
+                .prepare(`SELECT snapshot_id, scope_id, generation, storage_id, event_id,
+                  journal_sequence, revision, state_checksum, key_ref
+           FROM braid_state_snapshots
+           WHERE scope_id = ?
+           ORDER BY generation DESC, snapshot_id DESC
+           LIMIT 1`)
+                .get(scopeId);
+            if (!row)
+                return null;
+            let metadata = null;
+            try {
+                metadata = metadataFromRow(row);
+                return await this.read(metadata);
+            }
+            catch (error) {
+                if (!isSnapshotCorruption(error))
+                    throw error;
+                await this.quarantine(row, metadata ?? metadataFromRowSafe(row));
+            }
+        }
+    }
+    async read(metadata) {
+        const scopeId = this.#runtime.scopeId();
+        if (metadata.scopeId !== scopeId)
+            throw new StorageError('STATE_SNAPSHOT_INVALID', 'Snapshot scope differs');
+        const database = this.#runtime.database();
+        const key = database
+            .prepare(`SELECT credential_ref, retired
+         FROM braid_state_snapshot_keys
+         WHERE scope_id = ? AND generation = ?`)
+            .get(scopeId, metadata.generation);
+        if (!key || Number(key.retired) === 1 || key.credential_ref !== metadata.keyRef) {
+            throw new StorageError('STATE_SNAPSHOT_KEY_UNAVAILABLE', 'Snapshot generation key is unavailable');
+        }
+        const row = database
+            .prepare('SELECT state_ciphertext FROM braid_state_snapshots WHERE snapshot_id = ?')
+            .get(metadata.snapshotId);
+        if (!row)
+            throw new StorageError('STATE_SNAPSHOT_INVALID', 'Snapshot payload is missing');
+        const secret = await resolveSnapshotKey(this.#runtime, metadata.keyRef);
+        try {
+            const payload = decryptPayload(asBuffer(row.state_ciphertext, 'state_ciphertext'), secret);
+            const candidate = materializedSnapshotFromPayload(metadata, payload);
+            const event = database
+                .prepare('SELECT event_id FROM braid_journal_events WHERE storage_id = ?')
+                .get(metadata.storageId);
+            if (!event || event.event_id !== metadata.eventId) {
+                throw new StorageError('STATE_SNAPSHOT_UNBOUND', 'Snapshot event binding is invalid');
+            }
+            return { ...candidate, storageId: metadata.storageId };
+        }
+        finally {
+            secret.fill(0);
+        }
+    }
+    async quarantine(row, metadata) {
+        const database = this.#runtime.database();
+        const snapshotId = asPositiveNumber(row.snapshot_id);
+        if (snapshotId === null) {
+            throw new StorageError('STATE_SNAPSHOT_INVALID', 'Invalid snapshot identity cannot be quarantined safely');
+        }
+        const scopeId = asString(row.scope_id, 'scope_id');
+        const generation = asPositiveNumber(row.generation);
+        const keyRefs = new Set();
+        if (metadata?.keyRef !== undefined)
+            keyRefs.add(metadata.keyRef);
+        const rowKeyRef = asCredentialRef(row.key_ref);
+        if (rowKeyRef !== null)
+            keyRefs.add(rowKeyRef);
+        if (generation !== null) {
+            const keyRow = database
+                .prepare('SELECT credential_ref FROM braid_state_snapshot_keys WHERE scope_id = ? AND generation = ?')
+                .get(scopeId, generation);
+            const storedKeyRef = asCredentialRef(keyRow?.credential_ref);
+            if (storedKeyRef !== null)
+                keyRefs.add(storedKeyRef);
+        }
+        await this.#runtime.writes.run(async () => {
+            beginSnapshotTransaction(database);
+            try {
+                database.prepare('DELETE FROM braid_state_snapshots WHERE snapshot_id = ?').run(snapshotId);
+                if (generation !== null) {
+                    database
+                        .prepare('UPDATE braid_state_snapshot_keys SET retired = 1 WHERE scope_id = ? AND generation = ?')
+                        .run(scopeId, generation);
+                }
+                commit(this.#runtime, database, 'state.snapshot.quarantine');
+            }
+            catch (error) {
+                rollbackSnapshotTransaction(database);
+                throw error;
+            }
+            await removeSnapshotCredentials(this.#runtime, [...keyRefs]);
+            beginSnapshotTransaction(database);
+            try {
+                if (generation !== null) {
+                    database
+                        .prepare(`DELETE FROM braid_state_snapshot_keys AS key_row
+               WHERE key_row.scope_id = ? AND key_row.generation = ?
+                 AND NOT EXISTS (
+                   SELECT 1 FROM braid_state_snapshots AS snapshot_row
+                   WHERE snapshot_row.key_ref = key_row.credential_ref
+                 )`)
+                        .run(scopeId, generation);
+                }
+                commit(this.#runtime, database, 'state.snapshot.quarantine.cleanup');
+            }
+            catch (error) {
+                rollbackSnapshotTransaction(database);
+                throw error;
+            }
+        });
+    }
+}
+const QUARANTINED_STORAGE_CODES = new Set([
+    'PAYLOAD_DECRYPT_FAILED',
+    'PAYLOAD_VERSION',
+    'STATE_SNAPSHOT_INVALID',
+    'STATE_SNAPSHOT_KEY_INVALID',
+    'STATE_SNAPSHOT_KEY_UNAVAILABLE',
+    'STATE_SNAPSHOT_UNBOUND',
+    'STORAGE_ROW_INVALID',
+]);
+function isSnapshotCorruption(error) {
+    if (error instanceof CredentialError) {
+        return error.code === 'CREDENTIAL_NOT_FOUND' || error.code === 'INVALID_CREDENTIAL_REF';
+    }
+    return error instanceof StorageError && QUARANTINED_STORAGE_CODES.has(error.code);
+}
+//# sourceMappingURL=sqlite-state-snapshot-read.js.map

package/dist/adapters/storage/sqlite-state-snapshot-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-read.js","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAsB,MAAM,4BAA4B,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,+BAA+B,EAC/B,eAAe,EACf,mBAAmB,GACpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAC/F,OAAO,EACL,wBAAwB,EACxB,MAAM,EACN,2BAA2B,GAC5B,MAAM,wCAAwC,CAAA;AAO/C,MAAM,OAAO,yBAAyB;IAC3B,QAAQ,CAAiB;IAElC,YAAY,OAAwB;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACvC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ;iBACtB,QAAQ,EAAE;iBACV,OAAO,CACN;;;;;mBAKS,CACV;iBACA,GAAG,CAAC,OAAO,CAAwC,CAAA;YACtD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,IAAI,QAAQ,GAA4B,IAAI,CAAA;YAC5C,IAAI,CAAC;gBACH,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBAC/B,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,QAA0B;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACvC,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC9B,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAA;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,GAAG,GAAG,QAAQ;aACjB,OAAO,CACN;;+CAEuC,CACxC;aACA,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAA+B,CAAA;QAClE,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,IAAI,YAAY,CACpB,gCAAgC,EAChC,wCAAwC,CACzC,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ;aACjB,OAAO,CAAC,0EAA0E,CAAC;aACnF,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAwD,CAAA;QAClF,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAA;YAC1F,MAAM,SAAS,GAAG,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpE,MAAM,KAAK,GAAG,QAAQ;iBACnB,OAAO,CAAC,gEAAgE,CAAC;iBACzE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAgD,CAAA;YACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAClD,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAA;YACvF,CAAC;YACD,OAAO,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAA;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,GAA4B,EAC5B,QAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,wDAAwD,CACzD,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;QACxC,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAChE,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC9C,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,QAAQ;iBACpB,OAAO,CACN,4FAA4F,CAC7F;iBACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAA+B,CAAA;YACzD,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;YAC5D,IAAI,YAAY,KAAK,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACxC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBAC3F,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,QAAQ;yBACL,OAAO,CACN,wFAAwF,CACzF;yBACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;gBAC7B,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAA;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2BAA2B,CAAC,QAAQ,CAAC,CAAA;gBACrC,MAAM,KAAK,CAAA;YACb,CAAC;YACD,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAA;YAC5D,wBAAwB,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,CAAC;gBACH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,QAAQ;yBACL,OAAO,CACN;;;;;mBAKK,CACN;yBACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;gBAC7B,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2BAA2B,CAAC,QAAQ,CAAC,CAAA;gBACrC,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,wBAAwB;IACxB,iBAAiB;IACjB,wBAAwB;IACxB,4BAA4B;IAC5B,gCAAgC;IAChC,wBAAwB;IACxB,qBAAqB;CACtB,CAAC,CAAA;AAEF,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,CAAA;IACzF,CAAC;IACD,OAAO,KAAK,YAAY,YAAY,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACnF,CAAC"}

package/dist/adapters/storage/sqlite-state-snapshot-transaction.d.ts

@@ -0,0 +1,8 @@
+import type { SqliteDatabase } from './sqlite-driver.js';
+import type { SnapshotRuntime } from './sqlite-state-snapshot-types.js';
+type SnapshotDurabilityRuntime = Pick<SnapshotRuntime, 'durableBoundary'>;
+export declare function beginSnapshotTransaction(database: SqliteDatabase): void;
+export declare function commit(runtime: SnapshotDurabilityRuntime, database: SqliteDatabase, boundary: string): void;
+export declare function rollbackSnapshotTransaction(database: SqliteDatabase): void;
+export {};
+//# sourceMappingURL=sqlite-state-snapshot-transaction.d.ts.map

package/dist/adapters/storage/sqlite-state-snapshot-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-transaction.d.ts","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-transaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAEvE,KAAK,yBAAyB,GAAG,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;AAEzE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAEvE;AAED,wBAAgB,MAAM,CACpB,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAM1E"}

package/dist/adapters/storage/sqlite-state-snapshot-transaction.js

@@ -0,0 +1,22 @@
+export function beginSnapshotTransaction(database) {
+    database.exec('BEGIN IMMEDIATE');
+}
+export function commit(runtime, database, boundary) {
+    runtime.durableBoundary?.(`before:${boundary}`);
+    database.exec('COMMIT');
+    try {
+        runtime.durableBoundary?.(`after:${boundary}`);
+    }
+    catch {
+        // An observer cannot invalidate a transition that has already committed.
+    }
+}
+export function rollbackSnapshotTransaction(database) {
+    try {
+        database.exec('ROLLBACK');
+    }
+    catch {
+        // Preserve the original storage failure if rollback itself is unavailable.
+    }
+}
+//# sourceMappingURL=sqlite-state-snapshot-transaction.js.map

package/dist/adapters/storage/sqlite-state-snapshot-transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-transaction.js","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-transaction.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,wBAAwB,CAAC,QAAwB;IAC/D,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,OAAkC,EAClC,QAAwB,EACxB,QAAgB;IAEhB,OAAO,CAAC,eAAe,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAA;IAC/C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAwB;IAClE,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC"}

package/dist/adapters/storage/sqlite-state-snapshot-types.d.ts

@@ -0,0 +1,32 @@
+import type { CredentialPort, CredentialRef } from '../../ports/credentials.js';
+import type { SqliteDatabase } from './sqlite-driver.js';
+import type { BoundedWriteQueue } from './sqlite-queue.js';
+export interface SnapshotRuntime {
+    readonly database: () => SqliteDatabase;
+    readonly credentials: CredentialPort;
+    readonly scopeId: () => string;
+    readonly writes: BoundedWriteQueue;
+    readonly durableBoundary?: (boundary: string) => void;
+}
+export interface PreparedStateSnapshot {
+    readonly key: Buffer;
+    readonly keyRef: CredentialRef;
+}
+export interface SnapshotMetadata {
+    readonly snapshotId: number;
+    readonly scopeId: string;
+    readonly generation: number;
+    readonly storageId: number;
+    readonly eventId: string;
+    readonly sequence: number;
+    readonly revision: number;
+    readonly stateChecksum: string;
+    readonly keyRef: CredentialRef;
+}
+export interface SnapshotKeyRow {
+    readonly scope_id?: unknown;
+    readonly generation?: unknown;
+    readonly credential_ref?: unknown;
+    readonly retired?: unknown;
+}
+//# sourceMappingURL=sqlite-state-snapshot-types.d.ts.map

package/dist/adapters/storage/sqlite-state-snapshot-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-types.d.ts","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,cAAc,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CACtD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B"}

package/dist/adapters/storage/sqlite-state-snapshot-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sqlite-state-snapshot-types.js.map

package/dist/adapters/storage/sqlite-state-snapshot-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-types.js","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-types.ts"],"names":[],"mappings":""}

package/dist/adapters/storage/sqlite-state-snapshot-write.d.ts

@@ -0,0 +1,11 @@
+import type { CredentialRef } from '../../ports/credentials.js';
+import type { StateSnapshot } from '../../ports/storage.js';
+import type { PreparedStateSnapshot, SnapshotRuntime } from './sqlite-state-snapshot-types.js';
+export declare class SqliteStateSnapshotWriter {
+    #private;
+    constructor(runtime: SnapshotRuntime);
+    prepare(snapshot: StateSnapshot, createdRefs: CredentialRef[]): Promise<PreparedStateSnapshot>;
+    writeUnsafe(snapshot: StateSnapshot, storageId: number, prepared: PreparedStateSnapshot): void;
+    write(snapshot: StateSnapshot, pruneAfterCommit: () => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=sqlite-state-snapshot-write.d.ts.map

package/dist/adapters/storage/sqlite-state-snapshot-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-write.d.ts","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAW3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAE9F,qBAAa,yBAAyB;;IAGpC,YAAY,OAAO,EAAE,eAAe,EAEnC;IAEK,OAAO,CACX,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,aAAa,EAAE,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;IAED,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAgD7F;IAEK,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuCzF;CACF"}

package/dist/adapters/storage/sqlite-state-snapshot-write.js

@@ -0,0 +1,88 @@
+import { encryptPayload } from './sqlite-crypto.js';
+import { StorageError } from './sqlite-errors.js';
+import { asNumber, now } from './sqlite-rows.js';
+import { assertJsonState, assertSnapshotChecksum } from './sqlite-state-snapshot-codec.js';
+import { prepareSnapshotKey, removeSnapshotCredentials } from './sqlite-state-snapshot-keys.js';
+import { beginSnapshotTransaction, commit, rollbackSnapshotTransaction, } from './sqlite-state-snapshot-transaction.js';
+export class SqliteStateSnapshotWriter {
+    #runtime;
+    constructor(runtime) {
+        this.#runtime = runtime;
+    }
+    async prepare(snapshot, createdRefs) {
+        return prepareSnapshotKey(this.#runtime, snapshot, createdRefs);
+    }
+    writeUnsafe(snapshot, storageId, prepared) {
+        if (snapshot.scopeId !== this.#runtime.scopeId()) {
+            throw new StorageError('STATE_SNAPSHOT_INVALID', 'Snapshot scope differs from storage scope');
+        }
+        assertSnapshotChecksum(snapshot);
+        const database = this.#runtime.database();
+        const event = database
+            .prepare('SELECT event_id FROM braid_journal_events WHERE storage_id = ?')
+            .get(storageId);
+        if (!event || event.event_id !== snapshot.eventId) {
+            throw new StorageError('STATE_SNAPSHOT_UNBOUND', `State snapshot event ${snapshot.eventId} is not bound to storage row ${storageId}`);
+        }
+        const ciphertext = encryptPayload(assertJsonState(snapshot.state), prepared.key);
+        try {
+            database
+                .prepare(`INSERT INTO braid_state_snapshot_keys(
+           scope_id, generation, credential_ref, retired, created_at
+           ) VALUES (?, ?, ?, 0, ?)
+           `)
+                .run(this.#runtime.scopeId(), snapshot.generation, prepared.keyRef, now());
+            database
+                .prepare(`INSERT INTO braid_state_snapshots(
+             scope_id, generation, storage_id, event_id, journal_sequence,
+             revision, state_checksum, key_ref, state_ciphertext, created_at
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+           `)
+                .run(this.#runtime.scopeId(), snapshot.generation, storageId, snapshot.eventId, snapshot.sequence, snapshot.revision, snapshot.stateChecksum, prepared.keyRef, ciphertext, now());
+        }
+        finally {
+            ciphertext.fill(0);
+        }
+    }
+    async write(snapshot, pruneAfterCommit) {
+        const createdRefs = [];
+        const prepared = await this.prepare(snapshot, createdRefs);
+        let committed = false;
+        try {
+            await this.#runtime.writes.run(async () => {
+                const database = this.#runtime.database();
+                beginSnapshotTransaction(database);
+                try {
+                    const events = database
+                        .prepare('SELECT storage_id FROM braid_journal_events WHERE event_id = ? ORDER BY storage_id')
+                        .all(snapshot.eventId);
+                    const event = events[0];
+                    if (event === undefined)
+                        throw new StorageError('STATE_SNAPSHOT_UNBOUND', 'Snapshot event is not stored');
+                    if (events.length !== 1) {
+                        throw new StorageError('STATE_SNAPSHOT_UNBOUND', `Snapshot event ${snapshot.eventId} is not uniquely bound to storage`);
+                    }
+                    this.writeUnsafe(snapshot, asNumber(event.storage_id, 'storage_id'), prepared);
+                    commit(this.#runtime, database, 'state.snapshot');
+                    committed = true;
+                    await pruneAfterCommit();
+                }
+                catch (error) {
+                    if (!committed)
+                        rollbackSnapshotTransaction(database);
+                    throw error;
+                }
+            });
+            createdRefs.length = 0;
+        }
+        catch (error) {
+            if (!committed)
+                await removeSnapshotCredentials(this.#runtime, createdRefs);
+            throw error;
+        }
+        finally {
+            prepared.key.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=sqlite-state-snapshot-write.js.map

package/dist/adapters/storage/sqlite-state-snapshot-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshot-write.js","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshot-write.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAA;AAC/F,OAAO,EACL,wBAAwB,EACxB,MAAM,EACN,2BAA2B,GAC5B,MAAM,wCAAwC,CAAA;AAG/C,MAAM,OAAO,yBAAyB;IAC3B,QAAQ,CAAiB;IAElC,YAAY,OAAwB;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAuB,EACvB,WAA4B;QAE5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjE,CAAC;IAED,WAAW,CAAC,QAAuB,EAAE,SAAiB,EAAE,QAA+B;QACrF,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,2CAA2C,CAAC,CAAA;QAC/F,CAAC;QACD,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,KAAK,GAAG,QAAQ;aACnB,OAAO,CAAC,gEAAgE,CAAC;aACzE,GAAG,CAAC,SAAS,CAAgD,CAAA;QAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAClD,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,wBAAwB,QAAQ,CAAC,OAAO,gCAAgC,SAAS,EAAE,CACpF,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChF,IAAI,CAAC;YACH,QAAQ;iBACL,OAAO,CACN;;;YAGE,CACH;iBACA,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5E,QAAQ;iBACL,OAAO,CACN;;;;YAIE,CACH;iBACA,GAAG,CACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EACvB,QAAQ,CAAC,UAAU,EACnB,SAAS,EACT,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,MAAM,EACf,UAAU,EACV,GAAG,EAAE,CACN,CAAA;QACL,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAuB,EAAE,gBAAqC;QACxE,MAAM,WAAW,GAAoB,EAAE,CAAA;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAC1D,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;gBACzC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,QAAQ;yBACpB,OAAO,CACN,oFAAoF,CACrF;yBACA,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAiD,CAAA;oBACxE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;oBACvB,IAAI,KAAK,KAAK,SAAS;wBACrB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,8BAA8B,CAAC,CAAA;oBAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACxB,MAAM,IAAI,YAAY,CACpB,wBAAwB,EACxB,kBAAkB,QAAQ,CAAC,OAAO,mCAAmC,CACtE,CAAA;oBACH,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAA;oBAC9E,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;oBACjD,SAAS,GAAG,IAAI,CAAA;oBAChB,MAAM,gBAAgB,EAAE,CAAA;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,SAAS;wBAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAA;oBACrD,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC,CAAC,CAAA;YACF,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS;gBAAE,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;YAC3E,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/adapters/storage/sqlite-state-snapshots.d.ts

@@ -0,0 +1,21 @@
+import type { CredentialRef } from '../../ports/credentials.js';
+import type { StateSnapshot, StoredStateSnapshot } from '../../ports/storage.js';
+import type { PreparedStateSnapshot, SnapshotRuntime } from './sqlite-state-snapshot-types.js';
+export declare class SqliteStateSnapshotStore {
+    #private;
+    constructor(runtime: SnapshotRuntime);
+    latest(): Promise<StoredStateSnapshot | null>;
+    prepare(snapshot: StateSnapshot, createdRefs: CredentialRef[]): Promise<PreparedStateSnapshot>;
+    writeUnsafe(snapshot: StateSnapshot, storageId: number, prepared: PreparedStateSnapshot): void;
+    write(snapshot: StateSnapshot): Promise<void>;
+    prune(): Promise<void>;
+    pruneAfterCommitUnsafe(): Promise<void>;
+    discardCredentials(refs: readonly CredentialRef[]): Promise<void>;
+    pruneUnsafe(): Promise<void>;
+    destroyKeysBeforeMutation(): Promise<void>;
+    invalidateUnsafe(): void;
+    finishInvalidationUnsafe(): Promise<void>;
+    reconcile(): Promise<void>;
+    reconcileUnsafe(): Promise<void>;
+}
+//# sourceMappingURL=sqlite-state-snapshots.d.ts.map

package/dist/adapters/storage/sqlite-state-snapshots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-state-snapshots.d.ts","sourceRoot":"","sources":["../../../src/adapters/storage/sqlite-state-snapshots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAGhF,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAG9F,qBAAa,wBAAwB;;IAKnC,YAAY,OAAO,EAAE,eAAe,EAInC;IAEK,MAAM,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAElD;IAEK,OAAO,CACX,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,aAAa,EAAE,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;IAED,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAE7F;IAEK,KAAK,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE5C;IAEK,kBAAkB,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;IAEK,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAEjC;IAEK,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,gBAAgB,IAAI,IAAI,CAEvB;IAEK,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9C;IAEK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAE/B;IAEK,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErC;CACF"}