beatrina 0.8.7 → 0.9.83

package/host/journal-store.mjs

@@ -22,7 +22,8 @@
 //                                 the page's checkpoint codec wrote)
 //     checkpoint.rev              the revision of that envelope
 //     pins/<rev>.json             a named version, with its content
-//     meta.json                   display name, file binding, gaps, updated
+//     meta.json                   display name, file binding, gaps, updated,
+//                                 and `saved` — what the last Save wrote (N3)
 //     journal.corrupt-<time>      bytes cut from a journal that did not end at
 //                                 a line boundary — kept as evidence
 //
@@ -52,12 +53,13 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { privateModeHeld, stateDir } from "./user-dirs.mjs";
+import { envReader } from "./env-names.mjs";
 
 const TAB = 0x09;
 const NL = 0x0a;
 export const JOURNAL_KEY_RE = /^[a-z]+:[A-Za-z0-9._~-]{1,200}$/;
 export const JOURNAL_MAX_REPLY_BYTES = 6e6;      // under the 8 MB frame cap, with room
-const envOf = (name, unset = "") => (process.env[name] == null ? unset : String(process.env[name]));
+const envOf = envReader(process.env);   // dual-read (host/env-names.mjs)
 
 /** A UTC stamp in the journal's evidence-filename shape: %Y%m%d-%H%M%S. */
 const stamp = () => {
@@ -73,11 +75,11 @@ const bytesOf = (text) => Buffer.byteLength(text, "utf8");
  * first's idea of where a tail is.
  */
 export function createJournalStore() {
-  const enabled = envOf("CARMAR_NO_JOURNAL") !== "1";
+  const enabled = envOf("BEATRINA_NO_JOURNAL") !== "1";
   const cache = new Map();
 
   const root = () => {
-    const explicit = envOf("CARMAR_HISTORY_DIR");
+    const explicit = envOf("BEATRINA_HISTORY_DIR");
     if (explicit) return explicit;
     return path.join(stateDir(), "history");
   };
@@ -87,7 +89,7 @@ export function createJournalStore() {
    * stacks; pins hold their own content), never the tail.
    */
   const budget = () => {
-    const v = Number(envOf("CARMAR_HISTORY_BUDGET"));
+    const v = Number(envOf("BEATRINA_HISTORY_BUDGET"));
     return !Number.isFinite(v) || v < 65536 ? 64 * 1024 * 1024 : v;
   };
   const validKey = (key) => typeof key === "string" && JOURNAL_KEY_RE.test(key);
@@ -174,7 +176,7 @@ export function createJournalStore() {
 
   /** Atomic replace within the same directory: write a sibling, rename over. */
   const replace = (file, text) => {
-    const temp = path.join(path.dirname(file), `.carmar-journal-${crypto.randomBytes(8).toString("hex")}`);
+    const temp = path.join(path.dirname(file), `.beatrina-journal-${crypto.randomBytes(8).toString("hex")}`);
     writePrivate(temp, text);
     try { fs.renameSync(temp, file); } catch (e) {
       try { fs.unlinkSync(temp); } catch { /* gone */ }
@@ -263,7 +265,7 @@ export function createJournalStore() {
       return { held: { pid: Math.trunc(prior.pid), port: prior.port, epoch: prior.epoch }, epoch: null };
     }
     const epoch = prior && typeof prior.epoch === "number" ? Math.trunc(prior.epoch) + 1 : 1;
-    const me = { pid: mePid, port: Number.parseInt(envOf("CARMAR_PORT", "0"), 10) || 0, epoch, at: Date.now() };
+    const me = { pid: mePid, port: Number.parseInt(envOf("BEATRINA_PORT", "0"), 10) || 0, epoch, at: Date.now() };
     try { replace(file, JSON.stringify(me)); } catch {
       return { held: null, epoch: null, error: "The writer lease could not be written." };
     }
@@ -294,8 +296,12 @@ export function createJournalStore() {
 
   // ── the ops ───────────────────────────────────────────────────────────────
 
+  const HEX64 = /^[0-9a-f]{64}$/;
+  const validSaved = (v) => v != null && typeof v === "object" && !Array.isArray(v)
+    && typeof v.model === "string" && HEX64.test(v.model) && typeof v.file === "string" && HEX64.test(v.file);
+
   const open = (id, key, meta, takeover) => {
-    if (!enabled) return err("journal_open", id, "unavailable", "The document journal is disabled (CARMAR_NO_JOURNAL=1).");
+    if (!enabled) return err("journal_open", id, "unavailable", "The document journal is disabled (BEATRINA_NO_JOURNAL=1).");
     if (!validKey(key)) return err("journal_open", id, "invalid_key", "A journal needs a durable document key.");
     let st;
     try { st = stateOf(key); } catch (e) { return err("journal_open", id, "io", e.message); }
@@ -323,7 +329,7 @@ export function createJournalStore() {
    * directory behind, so it never calls stateOf().
    */
   const probe = (id, key) => {
-    if (!enabled) return err("journal_probe", id, "unavailable", "The document journal is disabled (CARMAR_NO_JOURNAL=1).");
+    if (!enabled) return err("journal_probe", id, "unavailable", "The document journal is disabled (BEATRINA_NO_JOURNAL=1).");
     if (!validKey(key)) return err("journal_probe", id, "invalid_key", "A journal needs a durable document key.");
     const dir = dirOf(key);
     if (!fs.existsSync(dir)) return { type: "journal_probe", id, key, exists: false, path: null, pathExists: false };
@@ -427,7 +433,7 @@ export function createJournalStore() {
     return before - st.bytes;
   };
 
-  const checkpoint = (id, key, revision, generation, envelope, meta, rebase, epoch) => {
+  const checkpoint = (id, key, revision, generation, envelope, meta, rebase, epoch, saved) => {
     if (!enabled) return err("journal_checkpoint", id, "unavailable", "The document journal is disabled.");
     if (!validKey(key)) return err("journal_checkpoint", id, "invalid_key", "A journal needs a durable document key.");
     const refused = leaseRefusal("journal_checkpoint", id, dirOf(key), epoch);
@@ -436,6 +442,9 @@ export function createJournalStore() {
         || typeof envelope !== "string" || !envelope.length) {
       return err("journal_checkpoint", id, "invalid_checkpoint", "A checkpoint needs a revision and its envelope.");
     }
+    // Refused before anything is written, so a bad marker never leaves a
+    // checkpoint on disk that the store's state does not know about.
+    if (saved != null && !validSaved(saved)) return err("journal_checkpoint", id, "invalid_saved", "A save marker needs two SHA-256 digests.");
     let st;
     try { st = stateOf(key); } catch (e) { return err("journal_checkpoint", id, "io", e.message); }
     const rev = Math.trunc(revision);
@@ -463,6 +472,13 @@ export function createJournalStore() {
       stored.gaps = [...(stored.gaps ?? []), gap];
     }
     if (meta && typeof meta === "object" && Object.keys(meta).length) stored.display = meta;
+    // N3: a Save rides on a checkpoint and says what it wrote — two digests,
+    // the document's content and the file's bytes. It is kept apart from
+    // `display` because the next opening's journal_open replaces `display`
+    // before it loads, and this is exactly what that opening needs to read.
+    // Content-addressed, so it is never cleared: a later edit simply stops it
+    // matching. Anything malformed is refused rather than stored half-read.
+    if (saved != null) stored.saved = { model: saved.model, file: saved.file, at: Date.now() };
     try { writeMeta(st.dir, stored); } catch { /* the checkpoint still stands */ }
     st.checkpoint = rev;
     st.last = rev;
@@ -500,6 +516,7 @@ export function createJournalStore() {
     return { type: "journal_load", id, key, aliases: meta.aliases ?? [],
       checkpointRevision: st.checkpoint, durableRevision: st.last,
       more, repaired: st.repaired === true, gaps: meta.gaps ?? [], pins: pinsOf(st.dir),
+      saved: validSaved(meta.saved) ? meta.saved : null,
       __raw: { records, checkpoint: envelope } };
   };
 
@@ -674,7 +691,7 @@ export function createJournalStore() {
     try { st = stateOf(key); } catch (e) { return err("journal_export", id, "io", e.message); }
     const s = scan(st.path);
     const envelope = readEnvelope(st.dir);
-    const head = JSON.stringify({ format: "carmar-history-export", schema: 1, key,
+    const head = JSON.stringify({ format: "beatrina-history-export", schema: 1, key,
       exported: Date.now(), checkpointRevision: st.checkpoint, meta: readMeta(st.dir) });
     const text = `${head.slice(0, head.length - 1)},"checkpoint":${envelope == null ? "null" : JSON.stringify(envelope)},"records":[${s.records.join(",")}]}`;
     if (bytesOf(text) > JOURNAL_MAX_REPLY_BYTES) {
@@ -690,7 +707,7 @@ export function createJournalStore() {
       case "journal_probe": return probe(cmd.id, cmd.key);
       case "journal_append": return append(cmd.id, cmd.key, cmd.records, cmd.epoch);
       case "journal_checkpoint": return checkpoint(cmd.id, cmd.key, cmd.revision, cmd.generation, cmd.envelope,
-        cmd.meta && typeof cmd.meta === "object" ? cmd.meta : null, cmd.rebase === true, cmd.epoch);
+        cmd.meta && typeof cmd.meta === "object" ? cmd.meta : null, cmd.rebase === true, cmd.epoch, cmd.saved ?? null);
       case "journal_archive": return archive(cmd.id, cmd.key);
       case "journal_rename": return rename(cmd.id, cmd.from, cmd.to);
       case "journal_load": return load(cmd.id, cmd.key, cmd.afterRevision);