dsh-ferry 0.1.2 → 0.1.3

package/lib/state.js

@@ -15,7 +15,14 @@ import { createHash } from 'node:crypto';
  * move when a log is renumbered, so they are compared as "a reference exists"
  * rather than by value.
  */
-const SEQ_REFERENCE_KEYS = new Set(['headerSeq', 'sourceEventSeq', 'shadowedSeqs', 'shadowedRange']);
+const SEQ_REFERENCE_KEYS = new Set([
+  'headerSeq',
+  'sourceEventSeq',
+  'sourceEventSeqs',
+  'messageSeqs',
+  'shadowedSeqs',
+  'shadowedRange',
+]);
 
 /** Number of trailing events that make up a tail fingerprint. */
 export const TAIL_EVENTS = 8;

package/lib/transfer.js

@@ -771,6 +771,8 @@ export function createTransfer({ ctx, config, rules, log = () => {} }) {
           const seq = nextSeq + index;
           return seq === event.seq ? event : renumberEvent(event, seq, delta, shared);
         });
+        // A mismatch here would write a log the receiver can never open again.
+        assertTailReferences([...local.events, ...tail], nextSeq);
         let handle;
         try {
           handle = await ctx.sessionPersistence.open(sessionId, 'write', { signal });
@@ -1014,6 +1016,44 @@ async function* once(buffer) {
   if (buffer !== undefined && buffer.length > 0) yield buffer;
 }
 
+/**
+ * Check that the references inside a renumbered tail still resolve.
+ *
+ * The stored format validates a few of them on open (`headerSeq` must point at
+ * a request header, `messageSeqs` at human messages). A field this plugin does
+ * not know about cannot be checked, so the known ones are verified before the
+ * write rather than after it.
+ * @param {readonly object[]} events - the receiver's log with the tail appended.
+ * @param {number} from - index of the first appended event.
+ * @throws {HttpError} when a reference would not resolve on the receiver.
+ */
+function assertTailReferences(events, from) {
+  for (let index = from; index < events.length; index += 1) {
+    const data = events[index].data;
+    if (data === null || typeof data !== 'object') continue;
+    const headerSeq = data.headerSeq;
+    if (Number.isSafeInteger(headerSeq) && events[headerSeq]?.type !== 'request/header') {
+      throw new HttpError(
+        409,
+        'session-reference-mismatch',
+        `Cannot renumber this session: event ${events[index].seq} references request header ${headerSeq}, which would not exist`,
+      );
+    }
+    const messageSeqs = data.messageSeqs;
+    if (Array.isArray(messageSeqs)) {
+      for (const seq of messageSeqs) {
+        if (events[seq]?.type !== 'user/message') {
+          throw new HttpError(
+            409,
+            'session-reference-mismatch',
+            `Cannot renumber this session: event ${events[index].seq} references message ${seq}, which would not be a user message`,
+          );
+        }
+      }
+    }
+  }
+}
+
 /**
  * Rewrite one event for a log that numbers the same content differently.
  * @param {object} event - source event.
@@ -1046,7 +1086,7 @@ function shiftSeqRefs(value, delta, from) {
       out[key] = item + delta;
       continue;
     }
-    if (key === 'shadowedSeqs' && Array.isArray(item)) {
+    if ((key === 'shadowedSeqs' || key === 'messageSeqs' || key === 'sourceEventSeqs') && Array.isArray(item)) {
       out[key] = item.map((entry) => (Number.isSafeInteger(entry) && entry >= from ? entry + delta : entry));
       continue;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ferry",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "description": "Move Sessions and their Workspace between DSH instances over any reachable network.",
   "license": "MIT",