@voltro/plugin-rooms 0.0.0-stage → 0.88.0

package/dist/snapshotBlobCleanup.js

@@ -0,0 +1,92 @@
+import { ProtocolError as e } from "./errors.js";
+import { ROOM_CHECKPOINTS_TABLE as t } from "./identities.js";
+import { canonicalRoomJson as n } from "./checkpointJson.js";
+import { captureRoomSnapshotBlobReference as r } from "./snapshotBlob.js";
+import { captureRoomSnapshotBlobs as i, captureRoomSnapshotEffectRunner as a } from "./snapshotBlobIndex.js";
+import { readRoomSnapshotSegmentBlobs as o } from "./snapshotSegmentBlobs.js";
+import { and as s, eq as c } from "@voltro/database";
+import { Effect as l } from "effect";
+// src/snapshotBlobCleanup.ts
+function u(t) {
+	throw new e({ detail: t });
+}
+var d = (e) => n([e.refId, e.claim]), f = (e, t) => s(c("roomId", e), c("tenantId", t)), p = async (e, n, r) => (await e.query({
+	table: t,
+	predicate: f(n, r),
+	order: [],
+	take: 1,
+	skip: void 0,
+	projection: void 0,
+	lock: "update"
+}))[0], m = (e, t, n, i) => {
+	if (e.blob == null) return null;
+	let a = e.checkpoint;
+	return !a || a.roomId !== t || a.tenantId !== n ? u("Snapshot blob journal has unrelated checkpoint identity") : r(e.blob, {
+		roomId: t,
+		tenantId: n,
+		epoch: a.epoch,
+		revision: a.revision
+	}, i);
+}, h = (e, t, n, i) => {
+	let a = e ? m(e, t, n, i) : null, o = new Set(a ? [d(a)] : []), s = (a, s) => {
+		if (a == null) return [];
+		if (!Array.isArray(a) || a.length > s) return u("Snapshot blob journal exceeds its bounded inventory");
+		let c = a;
+		for (let e = 0; e < c.length; e++) if (!Object.hasOwn(c, e)) return u("Snapshot blob journal cannot be sparse");
+		return c.map((a) => {
+			if (!a || typeof a != "object" || Array.isArray(a)) return u("Malformed snapshot blob journal reference");
+			let s = a, c = r(s, {
+				roomId: t,
+				tenantId: n,
+				epoch: s.epoch,
+				revision: s.revision
+			}, i), l = e?.checkpoint;
+			return !l || c.epoch > l.epoch || c.revision >= l.revision ? u("Snapshot blob journal reference is not retired history") : o.has(d(c)) ? u("Snapshot blob claim is duplicated or still current") : (o.add(d(c)), c);
+		});
+	};
+	return Object.freeze({
+		blobHistory: Object.freeze(s(e?.blobHistory, 16)),
+		retiredBlobs: Object.freeze(s(e?.retiredBlobs, 256))
+	});
+}, g = (e, t, n, r) => {
+	let i = h(e, t.roomId, t.tenantId, r), a = e ? m(e, t.roomId, t.tenantId, r) : null, o = [...i.blobHistory];
+	a && (!n || d(a) !== d(n)) && o.push(a), o.sort((e, t) => t.epoch - e.epoch || t.revision - e.revision);
+	let s = Math.max(0, (t.snapshot?.keepFulls ?? 3) - 1), c = [...i.retiredBlobs, ...o.slice(s)];
+	if (c.length > 256) return u("Snapshot retired-claim journal must drain before another checkpoint");
+	let l = new Set(n ? [d(n)] : []);
+	for (let e of o.slice(0, s)) l.add(d(e));
+	return c.some((e) => l.has(d(e))) ? u("Snapshot retired claim remains referenced") : Object.freeze({
+		blobHistory: Object.freeze(o.slice(0, s)),
+		retiredBlobs: Object.freeze(c)
+	});
+}, _ = (e, t, n, r, i) => h({
+	checkpoint: t,
+	blob: n,
+	blobHistory: e.blobHistory,
+	retiredBlobs: [...e.retiredBlobs, ...r]
+}, t.roomId, t.tenantId, i), v = async (e, t, n, r, i) => {
+	if (!t.length) return;
+	let a = new Set((await o(e, n, r, i)).map(d));
+	t.some((e) => a.has(d(e))) && u("Retired snapshot claim remains referenced by a SQL segment");
+}, y = (n, r, o, g, _ = {}) => {
+	if (!_ || typeof _ != "object" || Array.isArray(_) || Object.keys(_).some((e) => !["maxBytes", "limit"].includes(e))) return l.fail(new e({ detail: "Invalid scoped snapshot blob cleanup budget" }));
+	let y = i(r), b = _.maxBytes ?? 1048576, x = _.limit ?? 16;
+	return !y || ![o, g].every((e) => typeof e == "string" && e.trim() && e.length <= 191) || !Number.isSafeInteger(b) || b < 1 || b > 67108864 || !Number.isSafeInteger(x) || x < 1 || x > 256 ? l.fail(new e({ detail: "Invalid scoped snapshot blob cleanup budget" })) : l.flatMap(l.context(), (r) => l.uninterruptible(l.tryPromise({
+		try: async () => {
+			let e = a(r), i = await n.transactional(async (e) => {
+				let t = h(await p(e, o, g), o, g, b).retiredBlobs.slice(0, x);
+				return await v(e, t, o, g, b), t;
+			}), l = 0;
+			for (let r of i) await e(y.release(r, r)), await n.transactional(async (e) => {
+				let n = await p(e, o, g);
+				if (!n) return;
+				let i = h(n, o, g, b), a = m(n, o, g, b);
+				if (a && d(a) === d(r) || i.blobHistory.some((e) => d(e) === d(r))) return u("Released snapshot claim was illegally reintroduced into its index");
+				await v(e, [r], o, g, b), await e.updateMany(t, { retiredBlobs: i.retiredBlobs.filter((e) => d(e) !== d(r)) }, { where: s(f(o, g), c("id", n.id)) });
+			}), l++;
+			return l;
+		},
+		catch: (t) => t instanceof e ? t : new e({ detail: "Snapshot retired-claim cleanup remains unconfirmed" })
+	})));
+};
+export { _ as appendRoomSnapshotRetiredClaims, y as cleanupRoomCheckpointBlobs, g as planRoomSnapshotBlobJournal, h as readRoomSnapshotBlobJournal };

package/dist/snapshotBlobIndex.js

@@ -0,0 +1,37 @@
+import { ProtocolError as e } from "./errors.js";
+import { captureRoomSnapshotBlobReference as t } from "./snapshotBlob.js";
+import { Effect as n, Result as r } from "effect";
+import { createHash as i } from "node:crypto";
+// src/snapshotBlobIndex.ts
+var a = (e) => async (t) => {
+	let i = await n.runPromiseWith(e)(n.result(t));
+	if (r.isFailure(i)) throw i.failure;
+	return i.success;
+}, o = (t) => {
+	if (t !== void 0) {
+		if (!t || ![
+			"write",
+			"read",
+			"release",
+			"recover"
+		].every((e) => typeof Reflect.get(t, e) == "function")) throw new e({ detail: "Snapshot placement requires the complete borrowed blob port" });
+		return Object.freeze({
+			recover: t.recover.bind(t),
+			write: t.write.bind(t),
+			read: t.read.bind(t),
+			release: t.release.bind(t)
+		});
+	}
+}, s = async (r, a, o, s, c, l = n.runPromise) => {
+	let u = r.checkpoint;
+	if (!u || u.snapshot?.mode !== "full" || r.storage != null || !(r.bytes instanceof Uint8Array) || r.bytes.byteLength !== 0 || !c) throw new e({ detail: "Room blob index requires matching full metadata and its bound blob port" });
+	let d = t(r.blob, {
+		roomId: a,
+		tenantId: o,
+		epoch: u.epoch,
+		revision: u.revision
+	}, s), f = await l(c.read(d, d));
+	if (!(f instanceof Uint8Array) || f.byteLength !== d.size || i("sha256").update(f).digest("hex") !== d.checksum) throw new e({ detail: "Room snapshot blob index content integrity failed" });
+	return Uint8Array.from(f);
+};
+export { o as captureRoomSnapshotBlobs, a as captureRoomSnapshotEffectRunner, s as readRoomSnapshotBlobIndex };

package/dist/snapshotBudget.js

@@ -0,0 +1,79 @@
+import { ProtocolError as e } from "./errors.js";
+// src/snapshotBudget.ts
+var t = (t = {}) => {
+	if (!t || typeof t != "object" || Array.isArray(t) || Object.keys(t).some((e) => !["budgetBytesPerSec", "burstBytes"].includes(e))) throw new e({ detail: "Invalid Room snapshot host byte budget" });
+	let n = t.budgetBytesPerSec ?? 2e6, r = t.burstBytes ?? Math.max(n, 1048576);
+	if (![n, r].every((e) => Number.isSafeInteger(e) && e > 0 && e <= 2147483647)) throw new e({ detail: "Room snapshot rate and burst must be bounded positive byte budgets" });
+	let i = r, a = null, o = null, s = 0, c = 0, l = 0, u = (t, o) => {
+		if (!Number.isSafeInteger(t) || t < 1 || !Number.isFinite(o) || o < 0 || a !== null && o < a) throw new e({ detail: "Invalid Room snapshot payload or monotonic budget clock" });
+		a !== null && (i = Math.min(r, i + Math.min((o - a) / 1e3, (r - i) / n) * n)), a = o;
+	};
+	return Object.freeze({
+		forced: (e, t) => {
+			u(e, t), i -= e, c += e;
+		},
+		periodic: (t, n, a) => {
+			if (typeof t != "string" || !t.trim()) throw new e({ detail: "Snapshot scheduling requires an owned room identity" });
+			return u(n, a), o !== null && o !== t || i < Math.min(n, r) ? (o ??= t, s++, !1) : (i -= n, l += n, o = null, !0);
+		},
+		blocked: (e) => {
+			let t = o !== null && o !== e;
+			return t && s++, t;
+		},
+		forget: (e) => {
+			o === e && (o = null);
+		},
+		metrics: () => Object.freeze({
+			deferred: s,
+			forcedBytes: c,
+			periodicBytes: l,
+			debtBytes: Math.max(0, -i)
+		})
+	});
+}, n = (n, r) => {
+	if (t(r), typeof n != "function") throw new e({ detail: "Room snapshot budget strategy must be a factory" });
+	let i;
+	try {
+		i = n(Object.freeze({ ...r }));
+	} catch {
+		throw new e({ detail: "Room snapshot budget strategy admission failed" });
+	}
+	if (!i || ![
+		"forced",
+		"periodic",
+		"blocked",
+		"forget",
+		"metrics"
+	].every((e) => typeof i[e] == "function")) throw i instanceof Promise && i.catch(() => void 0), new e({ detail: "Room snapshot budget strategy returned an incomplete synchronous service" });
+	let a = i.forced.bind(i), o = i.periodic.bind(i), s = i.blocked.bind(i), c = i.forget.bind(i), l = i.metrics.bind(i), u = (t) => {
+		if (t !== void 0) throw t instanceof Promise && t.catch(() => void 0), new e({ detail: "Room snapshot budget operations must complete synchronously" });
+	}, d = (t) => {
+		if (typeof t == "boolean") return t;
+		throw t instanceof Promise && t.catch(() => void 0), new e({ detail: "Room snapshot budget decisions must be synchronous booleans" });
+	};
+	return Object.freeze({
+		forced: (e, t) => u(a(e, t)),
+		periodic: (e, t, n) => d(o(e, t, n)),
+		blocked: (e) => d(s(e)),
+		forget: (e) => u(c(e)),
+		metrics: () => {
+			let t = l();
+			if (t instanceof Promise && t.catch(() => void 0), !t || ![
+				"deferred",
+				"forcedBytes",
+				"periodicBytes",
+				"debtBytes"
+			].every((e) => {
+				let n = t[e];
+				return typeof n == "number" && Number.isFinite(n) && n >= 0;
+			})) throw new e({ detail: "Room snapshot budget returned invalid observations" });
+			return Object.freeze({
+				deferred: t.deferred,
+				forcedBytes: t.forcedBytes,
+				periodicBytes: t.periodicBytes,
+				debtBytes: t.debtBytes
+			});
+		}
+	});
+};
+export { n as captureRoomSnapshotBudget, t as defaultRoomSnapshotBudget };

package/dist/snapshotChain.js

@@ -0,0 +1,184 @@
+import { ProtocolError as e } from "./errors.js";
+import { ROOMS_TABLE as t, ROOM_SNAPSHOT_SEGMENTS_TABLE as n } from "./identities.js";
+import { canonicalRoomJson as r } from "./checkpointJson.js";
+import { captureRoomSnapshotBlobReference as i } from "./snapshotBlob.js";
+import { readRoomSnapshotBlobIndex as a } from "./snapshotBlobIndex.js";
+import { captureRoomSnapshotSegmentBlob as o, retireRoomSnapshotSegments as s } from "./snapshotSegmentBlobs.js";
+import { and as c, eq as l, generateId as u } from "@voltro/database";
+import { Effect as d, Result as f } from "effect";
+import { createHash as p } from "node:crypto";
+// src/snapshotChain.ts
+function m(t) {
+	throw new e({ detail: t });
+}
+var h = (e) => p("sha256").update(e).digest("hex"), g = (e, t) => p("sha256").update(r(e)).update(t).digest("hex"), _ = (e, t) => c(l("roomId", e), l("tenantId", t)), v = (e) => typeof e == "number" && Number.isSafeInteger(e) && e > 0, y = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), b = (e) => {
+	if (f.isFailure(e)) throw e.failure;
+	return e.success;
+}, x = (e) => {
+	if (!e || typeof e != "object" || Array.isArray(e)) return m("Malformed Room snapshot chain reference");
+	let t = e;
+	return Object.keys(t).some((e) => ![
+		"version",
+		"epoch",
+		"revision",
+		"fullRevision",
+		"fullEvery",
+		"keepFulls"
+	].includes(e)) || t.version !== 1 || ![
+		t.epoch,
+		t.revision,
+		t.fullRevision,
+		t.fullEvery,
+		t.keepFulls
+	].every(v) || t.fullEvery > 128 || t.keepFulls > 16 || t.fullRevision > t.revision || t.revision - t.fullRevision >= t.fullEvery ? m("Invalid bounded Room snapshot chain reference") : Object.freeze({ ...t });
+}, S = async (e, n, r, i, a) => {
+	if (typeof a != "function") return m("Room delta snapshot requires the declared room codec resolver");
+	let o = (await e.query({
+		table: t,
+		predicate: c(l("id", n), l("tenantId", r)),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: ["name"]
+	}))[0];
+	if (!o || typeof o.name != "string") return m("Room snapshot codec has no matching SQL room declaration");
+	let s = a(o.name);
+	return !s || s.schemaHash !== i || ![
+		"decodeFull",
+		"decodeDelta",
+		"full",
+		"delta"
+	].every((e) => typeof Reflect.get(s, e) == "function") ? m("Room snapshot codec does not match the durable schema") : s;
+}, C = async (e, t, r, i, s, u, f, p = d.runPromise) => {
+	if (t.blob != null) return a(t, r, i, s, f, p);
+	if (t.storage === void 0 || t.storage === null) return t.checkpoint?.snapshot?.mode === "delta" ? m("Room delta checkpoint has no durable chain reference") : t.bytes instanceof Uint8Array ? Uint8Array.from(t.bytes) : m("Malformed inline Room snapshot bytes");
+	let C = x(t.storage), w = t.checkpoint;
+	if (!w || w.roomId !== r || w.tenantId !== i || w.epoch !== C.epoch || w.revision !== C.revision || !(t.bytes instanceof Uint8Array) || t.bytes.byteLength !== 0 || w.snapshot?.mode !== "delta" || w.snapshot.fullEvery !== C.fullEvery || w.snapshot.keepFulls !== C.keepFulls) return m("Room snapshot chain does not match its checkpoint");
+	let T = await S(e, r, i, w.schemaHash, u), E = await e.query({
+		table: n,
+		predicate: c(_(r, i), l("epoch", C.epoch), l("fullRevision", C.fullRevision)),
+		order: [{
+			column: "revision",
+			direction: "asc"
+		}],
+		take: C.fullEvery + 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (E.length !== C.revision - C.fullRevision + 1) return m("Room snapshot chain is incomplete or exceeds its bound");
+	let D, O = /* @__PURE__ */ new Uint8Array();
+	for (let e = 0; e < E.length; e++) {
+		let t = E[e], n = t.segment, a = t.bytes, c = o(t, r, i, s);
+		if (c) {
+			if (!f) return m("Room snapshot segment needs its actual bound blob port");
+			if (a = await p(f.read(c, c)), !(a instanceof Uint8Array) || a.byteLength !== c.size || h(a) !== c.checksum) return m("Room snapshot segment blob content integrity failed");
+			a = Uint8Array.from(a);
+		}
+		if (!n || ![
+			n.epoch,
+			n.revision,
+			n.fullRevision
+		].every(v) || Object.keys(n).some((e) => ![
+			"epoch",
+			"revision",
+			"fullRevision",
+			"previousRevision",
+			"schemaHash",
+			"kind",
+			"resultHash"
+		].includes(e)) || n.epoch !== C.epoch || n.revision !== C.fullRevision + e || n.fullRevision !== C.fullRevision || n.previousRevision !== (e === 0 ? null : n.revision - 1) || n.schemaHash !== w.schemaHash || e === 0 && n.kind !== "full" || e !== 0 && !["delta", "same"].includes(n.kind) || !y(n.resultHash) || !(a instanceof Uint8Array) || a.byteLength > s || t.roomId !== r || t.tenantId !== i || t.epoch !== n.epoch || t.revision !== n.revision || t.fullRevision !== n.fullRevision || t.kind !== n.kind || t.digest !== g(n, a)) return m("Room snapshot segment integrity failed");
+		if (e === 0) D = b(T.decodeFull(a)), O = Uint8Array.from(a);
+		else if (n.kind === "delta") D = b(T.decodeDelta(a, D)), O = Uint8Array.from(b(T.full(D)));
+		else if (a.byteLength !== 0) return m("Unchanged Room snapshot segment must have no payload");
+		if (O.byteLength > s || h(O) !== n.resultHash) return m("Room snapshot reconstruction integrity failed");
+	}
+	return O;
+}, w = async (e, t, n, r, i) => {
+	let a = t.snapshot;
+	if (a?.mode !== "delta") return m("Snapshot segment planning requires the actual delta policy");
+	let o = await S(e, t.roomId, t.tenantId, t.schemaHash, i), s = b(o.decodeFull(t.bytes)), c = n?.storage == null ? null : x(n.storage), l = Uint8Array.from(t.bytes), u = "full", d = t.revision;
+	if (r && c && t.disposition === "live" && r.epoch === t.epoch && r.schemaHash === t.schemaHash && c.fullEvery === a.fullEvery && c.keepFulls === a.keepFulls && t.revision - c.fullRevision < a.fullEvery) {
+		let e = b(o.delta(s, b(o.decodeFull(r.bytes))));
+		(e === null || e.byteLength < t.bytes.byteLength) && (u = e === null ? "same" : "delta", l = e === null ? /* @__PURE__ */ new Uint8Array() : Uint8Array.from(e), d = c.fullRevision);
+	}
+	let f = Object.freeze({
+		epoch: t.epoch,
+		revision: t.revision,
+		fullRevision: d,
+		previousRevision: u === "full" ? null : t.revision - 1,
+		schemaHash: t.schemaHash,
+		kind: u,
+		resultHash: h(t.bytes)
+	});
+	return Object.freeze({
+		segment: f,
+		payload: l,
+		storage: Object.freeze({
+			version: 1,
+			epoch: t.epoch,
+			revision: t.revision,
+			fullRevision: d,
+			fullEvery: a.fullEvery,
+			keepFulls: a.keepFulls
+		})
+	});
+}, T = async (e, t, a, o, d, f, p, v, y, b = 1048576) => {
+	let x = t.snapshot;
+	if (x?.mode !== "delta") {
+		let n = await s(e, t.roomId, t.tenantId, b);
+		return {
+			bytes: Uint8Array.from(t.bytes),
+			storage: null,
+			retiredBlobs: n
+		};
+	}
+	let S = await w(e, t, a, o, d);
+	if (v && (r(v.segment) !== r(S.segment) || r(v.storage) !== r(S.storage) || !Buffer.from(v.payload).equals(Buffer.from(S.payload)))) return m("Uploaded Room segment plan no longer matches the fenced SQL baseline");
+	let { segment: C, payload: T, storage: E } = S, D = null;
+	if (y) {
+		if (D = i(y, t, b), !v || T.byteLength <= p || D.size !== T.byteLength || D.checksum !== h(T)) return m("Room segment blob does not match its exact prepared payload");
+	} else if (T.byteLength > p) return m("Room snapshot segment exceeds inline placement and needs its actual blob port");
+	await e.insert(n, {
+		id: u({
+			kind: "typeid",
+			prefix: "rseg"
+		}, n),
+		roomId: t.roomId,
+		tenantId: t.tenantId,
+		epoch: t.epoch,
+		revision: t.revision,
+		fullRevision: C.fullRevision,
+		kind: C.kind,
+		segment: C,
+		bytes: D ? /* @__PURE__ */ new Uint8Array() : T,
+		blob: D,
+		digest: g(C, T),
+		createdAt: f
+	});
+	let O = [];
+	if (C.kind === "full") {
+		for (let n of ["delta", "same"]) O.push(...await s(e, t.roomId, t.tenantId, b, l("kind", n)));
+		let r = await e.query({
+			table: n,
+			predicate: c(_(t.roomId, t.tenantId), l("kind", "full")),
+			order: [{
+				column: "epoch",
+				direction: "desc"
+			}, {
+				column: "revision",
+				direction: "desc"
+			}],
+			take: 18,
+			skip: void 0,
+			projection: ["id"]
+		});
+		if (r.length > 17) return m("Retained Room full history exceeds its bounded inventory");
+		for (let n of r.slice(x.keepFulls)) O.push(...await s(e, t.roomId, t.tenantId, b, l("id", n.id)));
+	}
+	return {
+		bytes: /* @__PURE__ */ new Uint8Array(),
+		storage: E,
+		retiredBlobs: O
+	};
+};
+export { C as loadRoomSnapshotPayload, w as prepareRoomSnapshotPayload, x as readRoomSnapshotChainReference, T as writeRoomSnapshotPayload };

package/dist/snapshotErasure.js

@@ -0,0 +1,171 @@
+import { ProtocolError as e } from "./errors.js";
+import { ROOMS_TABLE as t, ROOM_CHECKPOINTS_TABLE as n, ROOM_SNAPSHOT_SEGMENTS_TABLE as r } from "./identities.js";
+import { canonicalRoomJson as i } from "./checkpointJson.js";
+import { captureRoomSnapshotBlobReference as a } from "./snapshotBlob.js";
+import { captureRoomSnapshotBlobs as o, captureRoomSnapshotEffectRunner as s } from "./snapshotBlobIndex.js";
+import { readRoomSnapshotSegmentBlobs as c } from "./snapshotSegmentBlobs.js";
+import { readRoomSnapshotBlobJournal as l } from "./snapshotBlobCleanup.js";
+import { cleanupRoomSnapshotUploads as u, readRoomSnapshotUploadJournal as d } from "./snapshotUploads.js";
+import { and as f, eq as p } from "@voltro/database";
+import { Effect as m } from "effect";
+// src/snapshotErasure.ts
+var h = 418;
+function g(t) {
+	throw new e({ detail: t });
+}
+var _ = (e) => typeof e == "string" && e.trim() && e.length <= 191 ? e : g("Invalid scoped snapshot erasure identity"), v = (e) => i([e.refId, e.claim]), y = (e, t) => f(p("roomId", e), p("tenantId", t)), b = (e, t, n, r) => {
+	if (e.id !== t || e.tenantId !== n || !Number.isSafeInteger(e.epoch) || Number(e.epoch) < 1) return g("Snapshot erasure journal has unrelated SQL authority");
+	let i = e.snapshotErasure;
+	if (i == null) return null;
+	if (!i || typeof i != "object" || Array.isArray(i)) return g("Malformed snapshot erasure journal");
+	let o = i;
+	if (Object.keys(o).some((e) => ![
+		"version",
+		"epoch",
+		"requestId",
+		"state",
+		"references"
+	].includes(e)) || o.version !== 1 || o.epoch !== e.epoch || !["pending", "complete"].includes(o.state) || e.state !== "disposed" || e.clients !== 0 || e.locked !== !0 || e.private !== !0 || !Array.isArray(o.references) || o.references.length > h || o.state === "complete" && o.references.length !== 0) return g("Invalid snapshot erasure journal boundary");
+	let s = _(o.requestId), c = Array.from(o.references, (e) => {
+		if (!e || typeof e != "object" || Array.isArray(e)) return g("Malformed snapshot erasure claim");
+		let i = a(e, {
+			roomId: t,
+			tenantId: n,
+			epoch: e.epoch,
+			revision: e.revision
+		}, r);
+		return i.epoch >= o.epoch ? g("Snapshot erasure cannot release an unfenced owner claim") : i;
+	});
+	return new Set(c.map(v)).size === c.length ? Object.freeze({
+		version: 1,
+		epoch: o.epoch,
+		requestId: s,
+		state: o.state,
+		references: Object.freeze(c)
+	}) : g("Snapshot erasure claim inventory is duplicated");
+}, x = (h, x, S, C = {}) => {
+	let w, T, E;
+	try {
+		(!S || typeof S != "object" || Array.isArray(S) || Object.keys(S).some((e) => ![
+			"roomId",
+			"tenantId",
+			"epoch",
+			"requestId"
+		].includes(e)) || !Number.isSafeInteger(S.epoch) || S.epoch < 2 || !C || typeof C != "object" || Array.isArray(C) || Object.keys(C).some((e) => e !== "maxBytes")) && g("Invalid snapshot erasure admission"), w = Object.freeze({
+			roomId: _(S.roomId),
+			tenantId: _(S.tenantId),
+			epoch: S.epoch,
+			requestId: _(S.requestId)
+		}), T = C.maxBytes ?? 1048576, (!Number.isSafeInteger(T) || T < 1 || T > 67108864) && g("Invalid snapshot erasure byte budget"), E = o(x);
+	} catch (t) {
+		return m.fail(t instanceof e ? t : new e({ detail: "Snapshot erasure admission failed" }));
+	}
+	let D = async (e) => {
+		let n = (await e.query({
+			table: t,
+			predicate: f(p("id", w.roomId), p("tenantId", w.tenantId)),
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: void 0,
+			lock: "update"
+		}))[0];
+		return !n || n.epoch !== w.epoch || n.state !== "disposed" || n.clients !== 0 || n.locked !== !0 || n.private !== !0 ? g("Snapshot erasure requires the exact withdrawn SQL room") : n;
+	}, O = (e) => {
+		let t = b(e, w.roomId, w.tenantId, T);
+		return t && t.requestId !== w.requestId ? g("Snapshot erasure request identity changed") : t;
+	};
+	return m.flatMap(m.context(), (o) => m.uninterruptible(m.tryPromise({
+		try: async () => {
+			let e = s(o), m = await h.transactional(async (e) => {
+				let o = await D(e), s = O(o), u = d(o, w.roomId, w.tenantId, T);
+				if (u.some((e) => e.epoch >= w.epoch)) return g("Snapshot erasure still has an unfenced upload writer");
+				if (s) {
+					if (s.state === "complete" && u.length) return g("Completed snapshot erasure has reintroduced uploads");
+					for (let t of [n, r]) if ((await e.query({
+						table: t,
+						predicate: y(w.roomId, w.tenantId),
+						order: [],
+						take: 1,
+						skip: void 0,
+						projection: ["id"]
+					})).length) return g("Snapshot erasure indexes were illegally reintroduced");
+					return !E && (s.references.length || u.length) ? g("Pending snapshot erasure lost its actual blob port") : s;
+				}
+				let m = (await e.query({
+					table: n,
+					predicate: y(w.roomId, w.tenantId),
+					order: [],
+					take: 1,
+					skip: void 0,
+					projection: void 0,
+					lock: "update"
+				}))[0], h = [];
+				if (m) {
+					let e = m.checkpoint;
+					if (!e || e.roomId !== w.roomId || e.tenantId !== w.tenantId || !Number.isSafeInteger(e.epoch) || Number(e.epoch) < 1 || Number(e.epoch) >= w.epoch || !Number.isSafeInteger(e.revision) || Number(e.revision) < 1) return g("Snapshot erasure has no strictly older checkpoint authority");
+					let t = l(m, w.roomId, w.tenantId, T);
+					h.push(...t.blobHistory, ...t.retiredBlobs), m.blob != null && h.push(a(m.blob, {
+						roomId: w.roomId,
+						tenantId: w.tenantId,
+						epoch: Number(e.epoch),
+						revision: Number(e.revision)
+					}, T));
+				}
+				h.push(...await c(e, w.roomId, w.tenantId, T, w.epoch));
+				let _ = /* @__PURE__ */ new Map();
+				for (let e of h) {
+					if (e.epoch >= w.epoch) return g("Snapshot erasure has an unfenced segment claim");
+					let t = _.get(v(e));
+					if (t && i(t) !== i(e)) return g("Snapshot erasure claim has conflicting scope");
+					_.set(v(e), e);
+				}
+				if (!E && (_.size || u.length)) return g("Snapshot erasure requires its actual bound blob port");
+				let x = {
+					version: 1,
+					epoch: w.epoch,
+					requestId: w.requestId,
+					state: "pending",
+					references: [..._.values()]
+				};
+				return b({
+					...o,
+					snapshotErasure: x
+				}, w.roomId, w.tenantId, T), await e.updateMany(t, { snapshotErasure: x }, { where: f(p("id", w.roomId), p("tenantId", w.tenantId)) }), await e.deleteMany(r, { where: y(w.roomId, w.tenantId) }), await e.deleteMany(n, { where: y(w.roomId, w.tenantId) }), x;
+			});
+			if (m.state !== "complete") {
+				if (!E && m.references.length) return g("Pending snapshot erasure lost its actual blob port");
+				for (let n of m.references) await h.transactional(async (e) => O(await D(e))?.references.some((e) => v(e) === v(n))) && (await e(E.release(n, n)), await h.transactional(async (e) => {
+					let r = await D(e), i = O(r);
+					if (!i || i.state !== "pending") return g("Snapshot erasure lost its durable release receipt");
+					await e.updateMany(t, { snapshotErasure: {
+						...i,
+						references: i.references.filter((e) => v(e) !== v(n))
+					} }, { where: f(p("id", w.roomId), p("tenantId", w.tenantId)) });
+				}));
+				if ((await h.transactional(async (e) => d(await D(e), w.roomId, w.tenantId, T))).length) {
+					if (!E) return g("Pending snapshot uploads require their actual recovery port");
+					if ((await e(u(h, E, w.roomId, w.tenantId, T))).pending > 0) return g("Snapshot erasure is waiting for durable upload evidence");
+				}
+				await h.transactional(async (e) => {
+					let i = await D(e), a = O(i);
+					if (!a || a.references.length || d(i, w.roomId, w.tenantId, T).length) return g("Snapshot erasure still owns unfinished claim cleanup");
+					for (let t of [n, r]) if ((await e.query({
+						table: t,
+						predicate: y(w.roomId, w.tenantId),
+						order: [],
+						take: 1,
+						skip: void 0,
+						projection: ["id"]
+					})).length) return g("Snapshot erasure indexes were illegally reintroduced");
+					await e.updateMany(t, { snapshotErasure: {
+						...a,
+						state: "complete"
+					} }, { where: f(p("id", w.roomId), p("tenantId", w.tenantId)) });
+				});
+			}
+		},
+		catch: (t) => t instanceof e ? t : new e({ detail: "Snapshot erasure remains unconfirmed" })
+	})));
+};
+export { x as eraseRoomSnapshots, b as readRoomSnapshotErasureJournal };

package/dist/snapshotInspection.js

@@ -0,0 +1,104 @@
+import { ROOM_CHECKPOINTS_TABLE as e, ROOM_SNAPSHOT_SEGMENTS_TABLE as t } from "./identities.js";
+import { captureRoomSnapshotBlobReference as n } from "./snapshotBlob.js";
+import { readRoomSnapshotUploadJournal as r } from "./snapshotUploads.js";
+import { readRoomSnapshotErasureJournal as i } from "./snapshotErasure.js";
+import { and as a, eq as o, or as s } from "@voltro/database";
+// src/snapshotInspection.ts
+var c = 67108864, l = 145;
+function u() {
+	throw Error("Invalid scoped snapshot observation");
+}
+var d = (e) => {
+	let t = e instanceof Date ? e : typeof e == "string" ? new Date(e) : null;
+	return t && Number.isFinite(t.getTime()) ? t.toISOString() : u();
+}, f = (e, t, r) => {
+	if (!e || typeof e != "object" || Array.isArray(e)) return u();
+	let i = e;
+	return n(i, {
+		roomId: t,
+		tenantId: r,
+		epoch: i.epoch,
+		revision: i.revision
+	}, c);
+}, p = (e, t, n, r) => e == null ? [] : !Array.isArray(e) || e.length > t ? u() : Array.from(e, (e) => f(e, n, r)), m = (e) => JSON.stringify([e.refId, e.claim]), h = async (n, h, g) => {
+	let _ = new Map(h.map((e) => {
+		let t = e.id;
+		if (typeof t != "string" || e.tenantId !== g) return u();
+		let n = r(e, t, g, c), a = i(e, t, g, c);
+		return [t, {
+			checkpointUpdatedAt: null,
+			currentFullBlobs: 0,
+			retainedFullBlobs: 0,
+			segmentRows: 0,
+			segmentBlobs: 0,
+			retiredBlobClaims: 0,
+			uploadIntents: n.length,
+			uploadsWithReceipt: n.filter((e) => e.reference !== null).length,
+			erasurePhase: a?.state ?? "none",
+			erasureClaims: a?.references.length ?? 0
+		}];
+	}));
+	if (h.length > 50 || _.size !== h.length) return u();
+	if (!h.length) return _;
+	let v = a(o("tenantId", g), s(...[..._.keys()].map((e) => o("roomId", e)))), y = await n.query({
+		table: e,
+		predicate: v,
+		order: [],
+		take: h.length + 1,
+		skip: void 0,
+		projection: [
+			"roomId",
+			"tenantId",
+			"updatedAt",
+			"blob",
+			"blobHistory",
+			"retiredBlobs"
+		]
+	});
+	if (y.length > h.length) return u();
+	let b = /* @__PURE__ */ new Set();
+	for (let e of y) {
+		let t = e.roomId;
+		if (typeof t != "string" || e.tenantId !== g || b.has(t)) return u();
+		let n = _.get(t);
+		if (!n) return u();
+		b.add(t);
+		let r = e.blob == null ? [] : [f(e.blob, t, g)], i = p(e.blobHistory, 16, t, g), a = p(e.retiredBlobs, 256, t, g), o = [
+			...r,
+			...i,
+			...a
+		];
+		if (new Set(o.map(m)).size !== o.length) return u();
+		n.checkpointUpdatedAt = d(e.updatedAt), n.currentFullBlobs = r.length, n.retainedFullBlobs = i.length, n.retiredBlobClaims = a.length;
+	}
+	let x = await n.query({
+		table: t,
+		predicate: v,
+		order: [],
+		take: h.length * l + 1,
+		skip: void 0,
+		projection: [
+			"id",
+			"roomId",
+			"tenantId",
+			"epoch",
+			"revision",
+			"blob"
+		]
+	});
+	if (x.length > h.length * l) return u();
+	let S = /* @__PURE__ */ new Set();
+	for (let e of x) {
+		let t = e.roomId, n = e.id, r = e.epoch, i = e.revision;
+		if (typeof t != "string" || e.tenantId !== g || typeof n != "string" || !n.trim() || n.length > 191 || S.has(n) || !Number.isSafeInteger(r) || Number(r) < 1 || !Number.isSafeInteger(i) || Number(i) < 1) return u();
+		let a = _.get(t);
+		if (!a || ++a.segmentRows > l) return u();
+		if (S.add(n), e.blob != null) {
+			let n = f(e.blob, t, g);
+			if (n.epoch !== r || n.revision !== i) return u();
+			a.segmentBlobs++;
+		}
+	}
+	return _;
+};
+export { h as inspectRoomSnapshots };