dsh-archived-chats 1.0.2 → 1.0.3

package/docs/ARCHITECTURE.en.md

@@ -76,7 +76,7 @@ Preview accepts visible archived IDs by default and only recycle-catalog IDs wit
 
 The preview/image authorization sequence is fixed: first require POST and `x-dsh-archived-chats: 1`, then bounded-parse `sessionId` and `attachmentId`; next confirm that the session is still in the currently visible archive set, find an exact image-descriptor match in that session's canonical projection, and only then read bytes through the optional `attachments.readImage` service. Both preview and preview/image recheck visible archive state after asynchronous reads and immediately before sending a response, preventing an overlapping unarchive or delete from exposing stale content. Image bytes use `no-store` and `nosniff`; cross-session, non-archived, and unprojected references are rejected, and error responses never echo filesystem paths. A host without attachment-read capability returns `preview-image-unsupported`; this degrades images only and does not block text, Markdown, reasoning, tool, JSON, or code preview.
 
-Cross-session persistence inspection is limited to four concurrent reads. A broken session is reported in `skipped` while other hits still succeed. Canonical projections use a 30-second TTL, a 64-session LRU, and a per-session cached-code-point cap; oversized sessions remain searchable but do not stay resident. Unarchive, delete, and restore invalidate affected cache entries.
+Cross-session persistence inspection is limited to four concurrent reads, stops scheduling batches once the hit limit is satisfied, and aborts an older browser request when a newer search starts. A broken session is reported in `skipped` while other hits still succeed. Canonical projection limits each segment to 256 Ki code points, each message to 1 Mi code points and 1,000 segments, and each session to 10,000 projected messages; unknown structured values are bounded by depth, node, and character budgets before stringify. A 30-second TTL, 64-session LRU, and per-session cache cap keep bounded projections resident. Unarchive, delete, and restore invalidate affected cache entries.
 
 ## History versions and restore-as-copy
 
@@ -104,7 +104,7 @@ ZIP paths are sanitized and collision-safe. Batch export inspects and writes ses
 
 ## Import and restore flow
 
-import/inspect accepts only version-one ZIPs produced by this plugin. The Host streams bounded compressed chunks, preflights declared entry sizes, counts actual output, and caps entry count, per-entry bytes, manifest bytes, and total expansion. Iterative JSON validation then caps depth, node count, and total Unicode code points before path, version, session-record, and cross-file checks return a preview:
+import/inspect accepts only version-one ZIPs produced by this plugin. The Host streams bounded compressed chunks, preflights declared entry sizes, counts actual output, and caps entry count, per-entry bytes, manifest bytes, and total expansion. Iterative JSON validation then caps depth, node count, and total Unicode code points before checking paths, versions, generator, workspace, storage descriptors, timestamps, `source.meta.id`, the event array, and cross-file consistency:
 
 1. The browser uploads the ZIP and receives session summaries, versions, size, and warnings.
 2. Existing session IDs are marked as conflicts and deselected by default.
@@ -113,19 +113,19 @@ import/inspect accepts only version-one ZIPs produced by this plugin. The Host s
 5. restore.js uses a feature-detected adapter to write sessions, metadata, and archive state.
 6. Any failure rolls back staged data and never overwrites an existing session.
 
-The confirmation token expires quickly and can be used once. Hosts without the supported writer capability return restore-unsupported without writing.
+The confirmation token expires quickly, can be used once, and is bounded to eight retained plans and 128 MiB total per process. Confirmation-time conflict revalidation, staging, and commit all run inside the shared lifecycle queue. Import is enabled only when the Host exposes writer, removal rollback, archive, and metadata capabilities; workspace attach is used only with a matching detach, otherwise the item restores ungrouped with a warning. A boundary that throws after changing state is compensated in reverse order; failed compensation is reported explicitly rather than returning false success.
 
 ## Recycle and protection-snapshot lifecycle
 
 `trash.json` permits only `trashed`, `purge-pending`, and `degraded`. Legal transitions are `missing -> trashed`, `trashed/degraded -> purge-pending`, and removal of an existing state after a committed transaction. A `purge-pending` record cannot restore.
 
-Protection manifests use `dsh-archived-chats/snapshot` v1 and session payloads use `dsh-archived-chats/snapshot-session` v1. Each recycle record names one active snapshot; older valid snapshots from restore/recycle cycles remain history until explicit retention application or permanent purge. Exact limits remain 4 MiB manifest, 512 MiB session JSON, 10,000 attachments, 32 MiB each, and 8 GiB total.
+Protection manifests use `dsh-archived-chats/snapshot` v1 and session payloads use `dsh-archived-chats/snapshot-session` v1. Each recycle record names one active snapshot; older valid snapshots from restore/recycle cycles remain history until explicit retention application or permanent purge. Exact limits are 4 MiB manifest, 64 MiB session JSON, 1,000 attachments, 32 MiB each, and 512 MiB total. Restore validation streams attachment digests first and rereads one attachment at a time immediately before Host writes, never retaining all attachment bytes together. Snapshot publication/deletion and state-file renames sync file and parent-directory durability, with a safe fallback on Windows filesystems that do not expose directory fsync.
 
 Move ordering is: validate archive ownership → dispose or park a live session → capture and verify snapshot → recheck ownership → atomically commit `trashed` → invalidate caches. Ordinary move never removes the persistence artifact.
 
 Restore first rejects an existing-ID conflict. With an intact original it restores archive visibility and removes only the recycle record, without rewriting persistence; the snapshot remains history. With a missing original it completes validation and attachment-identity republishing before writing through public `create` / `append` / `saveImage` capabilities. A failure rolls back the new artifact and retains trash.
 
-Permanent purge persists `purge-pending` before physical writes, then removes the original, every validated snapshot for that source, and the recycle record. Startup recovery retries only `purge-pending`, never plain `trashed`. Legacy `pending-deletions.json` is strict read-only migration input: each still-archived ID becomes recoverable trash and is never boot-deleted merely because of the old marker.
+Permanent purge persists `purge-pending` before physical writes, then removes the original, every validated snapshot for that source, and the recycle record. Workspace, metadata, snapshot, or physical-delete failures retain `purge-pending`; snapshot deletion is rescanned before success can be returned. Startup recovery retries only `purge-pending`, never plain `trashed`. Legacy `pending-deletions.json` is strict read-only migration input: each still-archived ID becomes recoverable trash and is never boot-deleted merely because of the old marker.
 
 ## Browser client
 

package/docs/ARCHITECTURE.md

@@ -76,7 +76,7 @@ preview 默认只接受当前可见归档 ID；显式 `scope: "trash"` 时仅接
 
 preview/image 的授权顺序固定为：先验证 POST 和 `x-dsh-archived-chats: 1`，再有界解析 `sessionId` 与 `attachmentId`；随后确认会话仍在当前可见归档集合中，从该会话的规范投影中查找完全匹配的图片描述符，最后才通过可选的 `attachments.readImage` 服务读取。preview 和 preview/image 都会在异步读取完成后、响应发送前再次检查可见归档状态，避免并发取消归档或删除泄露旧内容。图片字节以 `no-store`、`nosniff` 返回；跨会话、非归档或不在投影中的引用均会被拒绝，错误响应不回显文件路径。宿主没有附件读取能力时返回 `preview-image-unsupported`；这只降级图片，不阻塞文本、Markdown、思考、工具、JSON 或代码预览。
 
-跨会话搜索的持久层读取并发上限为 4；单个会话失败会记入 skipped，其他命中仍正常返回。规范投影使用 30 秒 TTL、64 会话 LRU 和单会话最大缓存字符数保护内存；超大会话仍可搜索，但不会常驻缓存。取消归档、删除和恢复会使相关缓存失效。
+跨会话搜索的持久层读取并发上限为 4，达到命中上限后不再调度后续批次，浏览器的新搜索会中止旧请求；单个会话失败会记入 skipped，其他命中仍正常返回。规范投影使用 30 秒 TTL、64 会话 LRU，并限制单段 256 Ki Unicode 码点、单消息 1 Mi 码点/1,000 段、单会话 10,000 条投影消息；结构化未知值在 stringify 前即受深度、节点和字符预算约束。超出投影边界的内容会安全截断且不会常驻缓存。取消归档、删除和恢复会使相关缓存失效。
 
 ## 历史版本与恢复为副本
 
@@ -104,7 +104,7 @@ ZIP 路径会清理遍历字符并处理重名。批量导出按会话顺序逐
 
 ## 导入和恢复流程
 
-import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩块流式解压，先核对条目声明大小，再累计实际输出，并限制条目数、单条目、manifest 与总解压量。JSON 校验使用迭代遍历限制深度、节点数和 Unicode 字符总量，然后继续校验路径、版本、会话记录及跨文件一致性并生成预览：
+import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩块流式解压，先核对条目声明大小，再累计实际输出，并限制条目数、单条目、manifest 与总解压量。JSON 校验使用迭代遍历限制深度、节点数和 Unicode 字符总量，然后继续校验路径、版本、生成器、工作区、存储描述符、时间戳、`source.meta.id`、事件数组及跨文件一致性并生成预览：
 
 1. 浏览器上传 ZIP，Host 返回会话摘要、版本、大小和警告。
 2. 已存在的会话 ID 标记为冲突并默认取消选择。
@@ -113,19 +113,19 @@ import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩
 5. restore.js 通过能力探测的适配器写入会话、元数据和归档状态。
 6. 任一步骤失败都回滚暂存数据，不覆盖已有会话。
 
-确认令牌短期有效且只能使用一次。宿主不支持写入能力时返回 restore-unsupported，不执行任何写入。
+确认令牌短期有效且只能使用一次，并受 8 条、总计 128 MiB 的进程内保留上限约束。确认后的冲突重检、暂存和提交全部进入共享生命周期队列。只有同时提供 writer、删除回滚、归档和元数据能力的宿主才会启用导入；工作区 attach 必须有对应 detach，否则按未分组警告处理。任一边界即使在抛错前已经改变状态，也会按逆序补偿；无法完成补偿时明确返回 rollback failed，而不会报告恢复成功。
 
 ## 回收与保护快照生命周期
 
 `trash.json` 的合法状态只有 `trashed`、`purge-pending`、`degraded`。合法转换为 `missing -> trashed`、`trashed/degraded -> purge-pending`，以及任一现有状态在事务成功后移除。`purge-pending` 不得恢复。
 
-保护快照格式是 `dsh-archived-chats/snapshot` v1，会话载荷是 `dsh-archived-chats/snapshot-session` v1。每个回收记录只引用一个活跃快照，重复恢复/回收产生的旧有效快照保留为历史，直到明确应用保留策略或永久删除。精确上限为：manifest 4 MiB、session JSON 512 MiB、10,000 个附件、单附件 32 MiB、总计 8 GiB。
+保护快照格式是 `dsh-archived-chats/snapshot` v1，会话载荷是 `dsh-archived-chats/snapshot-session` v1。每个回收记录只引用一个活跃快照，重复恢复/回收产生的旧有效快照保留为历史，直到明确应用保留策略或永久删除。精确上限为：manifest 4 MiB、session JSON 64 MiB、1,000 个附件、单附件 32 MiB、总计 512 MiB；恢复验证先流式校验附件摘要，再在写入 Host 前逐件复读，绝不同时保留全部附件字节。发布、删除与状态文件的 rename 会同步文件和父目录；不支持目录 fsync 的 Windows 文件系统安全降级。
 
 移入顺序为：校验归档所有权 → 处置/停放运行中会话 → 捕获并验证快照 → 再次校验所有权 → 原子写入 `trashed` 记录 → 使缓存失效。普通移入不删除持久层文件。
 
 恢复先检查同 ID 冲突。原会话完好时只恢复归档可见性并移除回收记录，不重写持久层，保护快照保留为历史；原件丢失时先完成所有校验和附件身份重发，然后仅通过公开 `create` / `append` / `saveImage` 能力写入。失败会回滚新建件并保留回收记录。
 
-永久删除在任何物理写入前持久化 `purge-pending`，再删除原会话、该来源的全部已验证快照和回收记录。启动恢复仅重试 `purge-pending`，从不删除普通 `trashed`。旧 `pending-deletions.json` 是严格、只读的迁移输入：每个仍归档的 ID 都转成可恢复回收记录，绝不因旧标记在启动时直接删除。
+永久删除在任何物理写入前持久化 `purge-pending`，再删除原会话、该来源的全部已验证快照和回收记录。工作区、元数据、快照或物理删除任一步骤失败时都保留 `purge-pending`；快照删除后还会重新扫描确认，不会虚假报告成功。启动恢复仅重试 `purge-pending`，从不删除普通 `trashed`。旧 `pending-deletions.json` 是严格、只读的迁移输入：每个仍归档的 ID 都转成可恢复回收记录，绝不因旧标记在启动时直接删除。
 
 ## 浏览器客户端
 

package/lib/client.js

@@ -805,6 +805,11 @@ window.__ModuleLoader__.load({
 				return new Date(ms).toLocaleString();
 			}
 		}
+		function isoTimestamp(ms) {
+			if (typeof ms !== "number" || !Number.isFinite(ms)) return undefined;
+			const date = new Date(ms);
+			return Number.isFinite(date.valueOf()) ? date.toISOString() : undefined;
+		}
 
 		function formatBytes(value) {
 			if (!Number.isFinite(value) || value < 0) return "—";
@@ -1524,8 +1529,8 @@ window.__ModuleLoader__.load({
 			return res.blob();
 		}
 
-		async function fetchArchiveSearch(query, limit = 50) {
-			return post("/search", { query, limit });
+		async function fetchArchiveSearch(query, limit = 50, signal) {
+			return post("/search", { query, limit }, signal);
 		}
 
 			async function saveMetadata(sessionId, tags, note) {
@@ -2240,7 +2245,7 @@ window.__ModuleLoader__.load({
 						setCopied(true);
 					};
 					return (0, jsx.jsxs)("div", { className: "dac-preview-actions", children: [
-						(0, jsx.jsx)("time", { dateTime: Number.isFinite(node.time) ? new Date(node.time).toISOString() : undefined, children: formatDate(t, node.time) }),
+						(0, jsx.jsx)("time", { dateTime: isoTimestamp(node.time), children: formatDate(t, node.time) }),
 						(0, jsx.jsx)("button", { type: "button", onClick: copy, "aria-label": copied ? t("preview.copied") : t("preview.copy"), children: copied ? t("preview.copied") : t("preview.copy") }),
 					] });
 				}
@@ -3273,7 +3278,7 @@ window.__ModuleLoader__.load({
 				const trashReturnFocusRef = _react.useRef(null);
 				const metaReturnFocusRef = _react.useRef(null);
 					const importInputRef = _react.useRef(null);
-					const searchRequestRef = _react.useRef(0);
+					const searchRequestRef = _react.useRef({ sequence: 0, controller: null });
 					const previewReturnFocusRef = _react.useRef(null);
 					const previewRequestRef = _react.useRef({ sequence: 0, controller: null });
 
@@ -3406,16 +3411,18 @@ window.__ModuleLoader__.load({
 				}, [sessions, t]);
 				_react.useEffect(() => {
 					const trimmed = query.trim();
-					const requestId = searchRequestRef.current + 1;
-					searchRequestRef.current = requestId;
+					const current = searchRequestRef.current;
+					current.controller?.abort();
+					const request = { sequence: current.sequence + 1, controller: new AbortController() };
+					searchRequestRef.current = request;
 					if (Array.from(trimmed).length < 2) {
 						setContentSearch({ status: "idle", query: trimmed, hits: [], skipped: [] });
-						return undefined;
+						return () => request.controller.abort();
 					}
 					setContentSearch({ status: "loading", query: trimmed, hits: [], skipped: [] });
 					const timer = setTimeout(() => {
-						fetchArchiveSearch(trimmed, 100).then((result) => {
-							if (searchRequestRef.current !== requestId) return;
+						fetchArchiveSearch(trimmed, 100, request.controller.signal).then((result) => {
+							if (searchRequestRef.current !== request || request.controller.signal.aborted) return;
 							setContentSearch({
 								status: "ready",
 								query: trimmed,
@@ -3423,11 +3430,11 @@ window.__ModuleLoader__.load({
 								skipped: Array.isArray(result?.skipped) ? result.skipped : [],
 							});
 						}).catch(() => {
-							if (searchRequestRef.current !== requestId) return;
+							if (searchRequestRef.current !== request || request.controller.signal.aborted) return;
 							setContentSearch({ status: "error", query: trimmed, hits: [], skipped: [] });
 						});
 					}, 300);
-					return () => clearTimeout(timer);
+					return () => { clearTimeout(timer); request.controller.abort(); };
 				}, [query]);
 				_react.useEffect(() => {
 				if (sessions === null) return;

package/lib/durable.js

@@ -0,0 +1,68 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+
+const DIRECTORY_SYNC_UNSUPPORTED = new Set(['EINVAL', 'ENOTSUP']);
+const WINDOWS_DIRECTORY_SYNC_UNSUPPORTED = new Set(['EACCES', 'EISDIR', 'EPERM']);
+
+function directorySyncUnsupported(error) {
+  return DIRECTORY_SYNC_UNSUPPORTED.has(error?.code)
+    || (process.platform === 'win32' && WINDOWS_DIRECTORY_SYNC_UNSUPPORTED.has(error?.code));
+}
+
+/** Flush a file after it has been written. `r+` is supported on Windows. */
+export async function syncFile(path, openFile = open) {
+  const handle = await openFile(path, 'r+');
+  try { await handle.sync(); } finally { await handle.close(); }
+}
+
+/** Flush directory-entry changes where the platform exposes directory fsync. */
+export async function syncDirectory(path, openFile = open) {
+  let handle;
+  try { handle = await openFile(path, 'r'); }
+  catch (error) {
+    if (directorySyncUnsupported(error)) return false;
+    throw error;
+  }
+  try {
+    await handle.sync();
+    return true;
+  } catch (error) {
+    if (directorySyncUnsupported(error)) return false;
+    throw error;
+  } finally {
+    await handle.close();
+  }
+}
+
+/** Atomically replace one private file and make the rename crash-durable. */
+export async function atomicWriteFile(filePath, data, { encoding = undefined } = {}) {
+  const directory = dirname(filePath);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  let tempPath = null;
+  try {
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+      const candidate = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+      try {
+        await writeFile(candidate, data, {
+          ...(encoding === undefined ? {} : { encoding }),
+          mode: 0o600,
+          flag: 'wx',
+        });
+        tempPath = candidate;
+        break;
+      } catch (error) {
+        await rm(candidate, { force: true }).catch(() => undefined);
+        if (error?.code !== 'EEXIST' || attempt === 7) throw error;
+      }
+    }
+    await chmod(tempPath, 0o600);
+    await syncFile(tempPath);
+    await rename(tempPath, filePath);
+    tempPath = null;
+    await syncDirectory(directory);
+  } finally {
+    if (tempPath !== null) await rm(tempPath, { force: true }).catch(() => undefined);
+  }
+}

package/lib/export.js

@@ -237,6 +237,12 @@ function messageLabel(message) {
   return 'System';
 }
 
+function isoTimestamp(value) {
+  if (!Number.isFinite(value)) return null;
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : null;
+}
+
 /** Render the durable human transcript from append-origin Harness messages. */
 export function renderTranscript(item, events, exportedAt) {
   const lines = [
@@ -262,9 +268,8 @@ export function renderTranscript(item, events, exportedAt) {
     if (!isAppendSurfaceEvent(event)) continue;
     const message = deriveEventMessage(event);
     if (message === null) continue;
-    const timestamp = Number.isFinite(event.time)
-      ? ` - ${new Date(event.time).toISOString()}`
-      : '';
+    const isoTime = isoTimestamp(event.time);
+    const timestamp = isoTime === null ? '' : ` - ${isoTime}`;
     const content = Array.isArray(message.content)
       ? message.content.map(renderContentBlock).filter(Boolean).join('\n\n')
       : fenced('json', jsonText(message.content));

package/lib/history-restore.js

@@ -45,6 +45,12 @@ function compatibleAttachment(left, right) {
     && left.height === right.height;
 }
 
+async function attachmentData(item) {
+  const data = typeof item?.read === 'function' ? await item.read() : item?.data;
+  if (!(data instanceof Uint8Array)) throw failure('history-snapshot-degraded', 'history attachment bytes are unavailable', 409);
+  return data;
+}
+
 function rewriteAttachmentReferences(value, replacements) {
   if (Array.isArray(value)) return value.map((item) => rewriteAttachmentReferences(item, replacements));
   if (value === null || typeof value !== 'object') return value;
@@ -204,20 +210,21 @@ export function createHistoryRestoreService({
       const warnings = workspaceId !== null && workspaceId !== undefined && workspace === null
         ? [{ id: entry.destinationId, reason: 'workspace-unresolved' }]
         : [];
-      let created = false;
-      let attached = false;
-      let metadataChanged = false;
-      let registryChanged = false;
+      let createAttempted = false;
+      let attachmentAttempted = false;
+      let metadataAttempted = false;
+      let registryAttempted = false;
       const rollbackErrors = [];
       try {
+        createAttempted = true;
         await persistence.create(meta);
-        created = true;
 
         const replacements = new Map();
         for (const item of checked.attachments) {
           const original = attachmentReference(item.descriptor);
+          const data = await attachmentData(item);
           const restored = await attachments.saveImage({
-            data: item.data,
+            data,
             mediaType: original.mediaType,
             ...(original.name === undefined ? {} : { name: original.name }),
           });
@@ -234,18 +241,18 @@ export function createHistoryRestoreService({
         if (workspace !== null && !sessionIds(workspace).includes(entry.destinationId)) {
           if (typeof workspace.attachSession !== 'function' || typeof workspace.detachSession !== 'function') warnings.push({ id: entry.destinationId, reason: 'workspace-unresolved' });
           else {
+            attachmentAttempted = true;
             await workspace.attachSession(entry.destinationId);
-            attached = true;
           }
         }
         const tags = Array.isArray(checked.record.archive?.tags) ? checked.record.archive.tags : [];
         const note = typeof checked.record.archive?.note === 'string' ? checked.record.archive.note : '';
         if (tags.length > 0 || note !== '') {
+          metadataAttempted = true;
           await metadataStore.set(entry.destinationId, { tags, note });
-          metadataChanged = true;
         }
+        registryAttempted = true;
         await registry.setState({ ...registry.state, archivedSessionIds: [...originalArchiveIds, entry.destinationId] });
-        registryChanged = true;
         invalidate?.(entry.destinationId, entry.sourceSessionId);
         return {
           restored: [entry.destinationId],
@@ -254,22 +261,23 @@ export function createHistoryRestoreService({
           warnings,
         };
       } catch (cause) {
-        if (registryChanged) {
+        if (registryAttempted
+          && JSON.stringify((registry.archivedSessionIds ?? registry.state?.archivedSessionIds ?? []).map(String)) !== JSON.stringify(originalArchiveIds)) {
           try { await registry.setState({ ...registry.state, archivedSessionIds: originalArchiveIds }); }
           catch (error) { rollbackErrors.push(error); }
         }
-        if (metadataChanged) {
+        if (metadataAttempted) {
           try {
             const previous = originalMetadata.entries?.[entry.destinationId];
             if (previous === undefined) await metadataStore.remove([entry.destinationId]);
             else await metadataStore.set(entry.destinationId, { tags: previous.tags, note: previous.note });
           } catch (error) { rollbackErrors.push(error); }
         }
-        if (attached) {
+        if (attachmentAttempted && sessionIds(workspace).includes(entry.destinationId)) {
           try { await workspace.detachSession(entry.destinationId); }
           catch (error) { rollbackErrors.push(error); }
         }
-        if (created) {
+        if (createAttempted) {
           try { await rollbackCreated(location, entry.destinationId); }
           catch (error) { rollbackErrors.push(error); }
         }

package/lib/import.js

@@ -210,9 +210,22 @@ function requireString(value, path, errors, { nullable = false } = {}) {
   if (typeof value !== 'string' || value === '') errors.push(error('field-invalid', path, `${path} must be a non-empty string`));
 }
 
-function requireFinite(value, path, errors, { nullable = false } = {}) {
+function canonicalTimestamp(value) {
+  if (typeof value !== 'string') return false;
+  const parsed = new Date(value);
+  return Number.isFinite(parsed.valueOf()) && parsed.toISOString() === value;
+}
+
+function requireTimestamp(value, path, errors, { nullable = false } = {}) {
+  if (nullable && value === null) return;
+  if (!canonicalTimestamp(value)) errors.push(error('field-invalid', path, `${path} must be a canonical timestamp`));
+}
+
+function requireDateNumber(value, path, errors, { nullable = false } = {}) {
   if (nullable && value === null) return;
-  if (!Number.isFinite(value)) errors.push(error('field-invalid', path, `${path} must be finite`));
+  if (!Number.isSafeInteger(value) || value < 0 || !Number.isFinite(new Date(value).valueOf())) {
+    errors.push(error('field-invalid', path, `${path} must be a valid millisecond timestamp`));
+  }
 }
 
 function sameJson(left, right) {
@@ -240,19 +253,29 @@ function validateDescriptor(descriptor, path, errors) {
     return;
   }
   requireString(descriptor.id, `${path}.id`, errors);
+  if (forbiddenKeys.has(descriptor.id)) errors.push(error('field-invalid', `${path}.id`, 'session id is unsafe'));
   requireString(descriptor.title, `${path}.title`, errors, { nullable: true });
-  requireFinite(descriptor.createdAt, `${path}.createdAt`, errors, { nullable: true });
+  requireDateNumber(descriptor.createdAt, `${path}.createdAt`, errors, { nullable: true });
   requireString(descriptor.origin, `${path}.origin`, errors, { nullable: true });
-  requireString(descriptor.metadataUpdatedAt, `${path}.metadataUpdatedAt`, errors, { nullable: true });
+  requireTimestamp(descriptor.metadataUpdatedAt, `${path}.metadataUpdatedAt`, errors, { nullable: true });
   if (!Array.isArray(descriptor.tags) || descriptor.tags.some((tag) => typeof tag !== 'string')) errors.push(error('metadata-invalid', `${path}.tags`, 'tags must be an array of strings'));
   if (typeof descriptor.note !== 'string' && descriptor.note !== null) errors.push(error('metadata-invalid', `${path}.note`, 'note must be a string or null'));
   if (!isObject(descriptor.workspace) && descriptor.workspace !== null) errors.push(error('field-invalid', `${path}.workspace`, 'workspace must be an object or null'));
+  else if (isObject(descriptor.workspace)) {
+    const keys = Object.keys(descriptor.workspace).sort();
+    if (!sameJson(keys, ['id', 'title'])) errors.push(error('field-invalid', `${path}.workspace`, 'workspace fields are unsupported'));
+    if (descriptor.workspace.id !== null && (typeof descriptor.workspace.id !== 'string' || descriptor.workspace.id === '')) errors.push(error('field-invalid', `${path}.workspace.id`, 'workspace.id must be a string or null'));
+    if (descriptor.workspace.title !== null && typeof descriptor.workspace.title !== 'string') errors.push(error('field-invalid', `${path}.workspace.title`, 'workspace.title must be a string or null'));
+  }
   if (!isObject(descriptor.storage)) errors.push(error('field-invalid', `${path}.storage`, 'storage must be an object'));
   else {
     if (!['ready', 'unavailable'].includes(descriptor.storage.status)) errors.push(error('field-invalid', `${path}.storage.status`, 'storage status is unsupported'));
     if (descriptor.storage.status === 'ready') {
-      requireFinite(descriptor.storage.sizeBytes, `${path}.storage.sizeBytes`, errors);
-      requireFinite(descriptor.storage.fileCount, `${path}.storage.fileCount`, errors);
+      if (!Number.isSafeInteger(descriptor.storage.sizeBytes) || descriptor.storage.sizeBytes < 0) errors.push(error('field-invalid', `${path}.storage.sizeBytes`, 'storage size must be a nonnegative safe integer'));
+      if (!Number.isSafeInteger(descriptor.storage.fileCount) || descriptor.storage.fileCount < 0) errors.push(error('field-invalid', `${path}.storage.fileCount`, 'storage file count must be a nonnegative safe integer'));
+    } else if (descriptor.storage.status === 'unavailable'
+      && (descriptor.storage.sizeBytes !== null || descriptor.storage.fileCount !== null)) {
+      errors.push(error('field-invalid', `${path}.storage`, 'unavailable storage sizes must be null'));
     }
   }
   if (!isObject(descriptor.files)) errors.push(error('field-invalid', `${path}.files`, 'files must be an object'));
@@ -262,6 +285,35 @@ function validateDescriptor(descriptor, path, errors) {
   }
 }
 
+function validateSource(record, descriptor, jsonName, errors) {
+  if (!isObject(record.source)) {
+    errors.push(error('source-invalid', `${jsonName}.source`, 'session source must be an object'));
+    return;
+  }
+  const sourceKeys = Object.keys(record.source).sort();
+  if (!sameJson(sourceKeys, ['events', 'meta'])) errors.push(error('source-invalid', `${jsonName}.source`, 'session source fields are unsupported'));
+  if (!isObject(record.source.meta)) {
+    errors.push(error('source-invalid', `${jsonName}.source.meta`, 'session source meta must be an object'));
+  } else if (record.source.meta.id !== descriptor.id) {
+    errors.push(error('session-mismatch', `${jsonName}.source.meta.id`, 'source meta id does not match session id'));
+  }
+  if (!Array.isArray(record.source.events)) {
+    errors.push(error('source-invalid', `${jsonName}.source.events`, 'session source events must be an array'));
+    return;
+  }
+  for (let index = 0; index < record.source.events.length; index += 1) {
+    const eventValue = record.source.events[index];
+    const path = `${jsonName}.source.events[${index}]`;
+    if (!isObject(eventValue)) {
+      errors.push(error('source-invalid', path, 'session events must be objects'));
+      continue;
+    }
+    if (Object.hasOwn(eventValue, 'time') && eventValue.time !== null) {
+      requireDateNumber(eventValue.time, `${path}.time`, errors);
+    }
+  }
+}
+
 function normalizeWarnings(item, record) {
   const warnings = [];
   if (hasAttachment(record.source?.events)) warnings.push('attachments-not-included');
@@ -300,6 +352,12 @@ export function inspectImport(source, options = {}) {
     if (manifest.attachmentsIncluded !== false) throw Object.assign(new Error('attachment bytes are not accepted'), { importError: error('attachments-unsupported', 'manifest.attachmentsIncluded', 'version-one packages must not include attachment bytes') });
 
     const errors = [];
+    requireTimestamp(manifest.exportedAt, 'manifest.exportedAt', errors);
+    if (!isObject(manifest.generator)
+      || typeof manifest.generator.name !== 'string' || manifest.generator.name === ''
+      || typeof manifest.generator.version !== 'string' || manifest.generator.version === '') {
+      errors.push(error('field-invalid', 'manifest.generator', 'generator name and version are required'));
+    }
     const ids = new Set();
     const referenced = new Set(['manifest.json']);
     const items = [];
@@ -332,7 +390,9 @@ export function inspectImport(source, options = {}) {
         errors.push(error('session-mismatch', jsonName, 'session JSON format, version, or archive.id does not match manifest'));
         continue;
       }
+      requireTimestamp(record.exportedAt, `${jsonName}.exportedAt`, errors);
       if (!sameJson(record.archive, descriptor)) errors.push(error('session-mismatch', jsonName, 'manifest descriptor does not match session archive descriptor'));
+      validateSource(record, descriptor, jsonName, errors);
       try { normalizeMetadata({ tags: descriptor.tags, note: descriptor.note ?? '' }); }
       catch { errors.push(error('metadata-invalid', `${path}.tags`, 'tags or note exceed metadata limits')); }
       items.push({
@@ -348,7 +408,6 @@ export function inspectImport(source, options = {}) {
         hasAttachmentReferences: hasAttachment(record.source?.events),
         warnings: normalizeWarnings(descriptor, record),
         record,
-        jsonBytes,
         transcriptSizeBytes: markdownBytes.byteLength,
       });
     }