or3-provider-sqlite 0.0.1 → 0.0.3

package/dist/runtime/server/db/migrations/013_connect_environment_lifecycle.js

@@ -0,0 +1,261 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const environmentColumns = await tableColumns(db, "connect_environments");
+  if (environmentColumns.has("lifecycle_claim_token")) return;
+  await dropConnectIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_before_lifecycle
+    `.execute(db);
+  await sql`
+        ALTER TABLE connect_environments
+        RENAME TO connect_environments_before_lifecycle
+    `.execute(db);
+  await createAuthorizationTable(db, true);
+  await createEnvironmentTable(db, true);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_before_lifecycle
+    `.execute(db);
+  await sql`
+        INSERT INTO connect_environments (
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext, status, lifecycle_attempts,
+            lifecycle_next_attempt_at, last_seen_at, created_at, updated_at,
+            revoked_at
+        )
+        SELECT
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext, status, 0, 0, last_seen_at,
+            created_at, updated_at, revoked_at
+        FROM connect_environments_before_lifecycle
+    `.execute(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_before_lifecycle
+    `.execute(db);
+  await sql`DROP TABLE connect_environments_before_lifecycle`.execute(db);
+}
+export async function down(db) {
+  const environmentColumns = await tableColumns(db, "connect_environments");
+  if (!environmentColumns.has("lifecycle_claim_token")) return;
+  await dropConnectIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_with_lifecycle
+    `.execute(db);
+  await sql`
+        ALTER TABLE connect_environments
+        RENAME TO connect_environments_with_lifecycle
+    `.execute(db);
+  await createAuthorizationTable(db, false);
+  await createEnvironmentTable(db, false);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash,
+            CASE WHEN status = 'provisioning' THEN 'expired' ELSE status END,
+            host_json, approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_with_lifecycle
+    `.execute(db);
+  await sql`
+        INSERT INTO connect_environments (
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext, status, last_seen_at, created_at,
+            updated_at, revoked_at
+        )
+        SELECT
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext,
+            CASE
+                WHEN status = 'provisioning' THEN 'error'
+                WHEN status = 'revoking' THEN 'revoked'
+                ELSE status
+            END,
+            last_seen_at, created_at, updated_at, revoked_at
+        FROM connect_environments_with_lifecycle
+    `.execute(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_with_lifecycle
+    `.execute(db);
+  await sql`DROP TABLE connect_environments_with_lifecycle`.execute(db);
+}
+async function tableColumns(db, table) {
+  const result = await sql`
+        PRAGMA table_info(${sql.raw(table)})
+    `.execute(db);
+  return new Set(result.rows.map((column) => column.name));
+}
+async function createAuthorizationTable(db, lifecycle) {
+  const statuses = lifecycle ? "'pending', 'provisioning', 'approved', 'delivering', 'denied', 'consumed', 'expired'" : "'pending', 'approved', 'delivering', 'denied', 'consumed', 'expired'";
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (status IN (${sql.raw(statuses)})),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+}
+async function createEnvironmentTable(db, lifecycle) {
+  if (!lifecycle) {
+    await sql`
+            CREATE TABLE connect_environments (
+                id TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL,
+                workspace_id TEXT NOT NULL,
+                name TEXT NOT NULL,
+                platform TEXT NOT NULL,
+                architecture TEXT NOT NULL,
+                host_id TEXT,
+                signing_public_key TEXT,
+                noise_public_key TEXT,
+                hostname TEXT NOT NULL,
+                tunnel_id TEXT NOT NULL,
+                dns_record_id TEXT NOT NULL,
+                control_token_hash TEXT NOT NULL UNIQUE,
+                access_credential_ciphertext TEXT NOT NULL,
+                status TEXT NOT NULL CHECK (
+                    status IN ('active', 'revoked', 'error')
+                ),
+                last_seen_at INTEGER,
+                created_at INTEGER NOT NULL,
+                updated_at INTEGER NOT NULL,
+                revoked_at INTEGER
+            )
+        `.execute(db);
+    await createEnvironmentIndexes(db, false);
+    return;
+  }
+  await sql`
+        CREATE TABLE connect_environments (
+            id TEXT PRIMARY KEY,
+            user_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            name TEXT NOT NULL,
+            platform TEXT NOT NULL,
+            architecture TEXT NOT NULL,
+            host_id TEXT,
+            signing_public_key TEXT,
+            noise_public_key TEXT,
+            authorization_id TEXT,
+            hostname TEXT NOT NULL,
+            tunnel_id TEXT NOT NULL,
+            dns_record_id TEXT NOT NULL,
+            control_token_hash TEXT NOT NULL UNIQUE,
+            access_credential_ciphertext TEXT NOT NULL,
+            tunnel_secret_ciphertext TEXT,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'provisioning', 'active', 'revoking', 'revoked', 'error'
+                )
+            ),
+            lifecycle_attempts INTEGER NOT NULL DEFAULT 0,
+            lifecycle_next_attempt_at INTEGER NOT NULL DEFAULT 0,
+            lifecycle_claim_token TEXT,
+            lifecycle_claimed_until INTEGER,
+            provisioning_deadline_at INTEGER,
+            lifecycle_error TEXT,
+            last_seen_at INTEGER,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL,
+            revoked_at INTEGER
+        )
+    `.execute(db);
+  await createEnvironmentIndexes(db, true);
+}
+async function dropConnectIndexes(db) {
+  const names = [
+    "connect_authorizations_status_expiry",
+    "connect_authorizations_user_code",
+    "connect_authorizations_environment",
+    "connect_environments_user_status",
+    "connect_environments_workspace_status",
+    "connect_environments_user_workspace_status_updated",
+    "connect_environments_user_workspace_control_token",
+    "connect_environments_user_workspace_id",
+    "connect_environments_lifecycle_due"
+  ];
+  for (const name of names) {
+    await sql`DROP INDEX IF EXISTS ${sql.raw(name)}`.execute(db);
+  }
+}
+async function createAuthorizationIndexes(db) {
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+}
+async function createEnvironmentIndexes(db, lifecycle) {
+  await sql`
+        CREATE INDEX connect_environments_user_status
+        ON connect_environments(user_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_workspace_status
+        ON connect_environments(workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_status_updated
+        ON connect_environments(user_id, workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_control_token
+        ON connect_environments(user_id, workspace_id, control_token_hash)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_id
+        ON connect_environments(user_id, workspace_id, id)
+    `.execute(db);
+  if (lifecycle) {
+    await sql`
+            CREATE INDEX connect_environments_lifecycle_due
+            ON connect_environments(
+                status, lifecycle_next_attempt_at, lifecycle_claimed_until
+            )
+        `.execute(db);
+  }
+}

package/dist/runtime/server/db/migrations/014_connect_retention_activation.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Adds bounded retention and unclaimed-activation lifecycle indexes. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/014_connect_retention_activation.js

@@ -0,0 +1,44 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const columns = await sql`
+        PRAGMA table_info(connect_environments)
+    `.execute(db);
+  const names = new Set(columns.rows.map((column) => column.name));
+  if (!names.has("activation_deadline_at")) {
+    await sql`
+            ALTER TABLE connect_environments
+            ADD COLUMN activation_deadline_at INTEGER
+        `.execute(db);
+  }
+  if (!names.has("activation_claimed_at")) {
+    await sql`
+            ALTER TABLE connect_environments
+            ADD COLUMN activation_claimed_at INTEGER
+        `.execute(db);
+  }
+  if (!names.has("relay_authenticator")) {
+    await sql`
+            ALTER TABLE connect_environments
+            ADD COLUMN relay_authenticator TEXT
+        `.execute(db);
+  }
+  await sql`
+        CREATE INDEX IF NOT EXISTS connect_authorizations_status_updated
+        ON connect_device_authorizations(status, updated_at, id)
+    `.execute(db);
+  await sql`
+        CREATE INDEX IF NOT EXISTS connect_environments_status_updated
+        ON connect_environments(status, updated_at, id)
+    `.execute(db);
+  await sql`
+        CREATE INDEX IF NOT EXISTS connect_environments_activation_due
+        ON connect_environments(
+            status, activation_claimed_at, activation_deadline_at, id
+        )
+    `.execute(db);
+}
+export async function down(db) {
+  await sql`DROP INDEX IF EXISTS connect_environments_activation_due`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_environments_status_updated`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_updated`.execute(db);
+}

package/dist/runtime/server/db/migrations/015_rate_limits.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Durable deployment-wide fixed-window request budgets. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/015_rate_limits.js

@@ -0,0 +1,18 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE TABLE IF NOT EXISTS rate_limits (
+            key TEXT PRIMARY KEY,
+            count INTEGER NOT NULL,
+            window_started_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await sql`
+        CREATE INDEX IF NOT EXISTS rate_limits_expiry
+        ON rate_limits(expires_at)
+    `.execute(db);
+}
+export async function down(db) {
+  await sql`DROP TABLE IF EXISTS rate_limits`.execute(db);
+}

package/dist/runtime/server/db/schema.d.ts

@@ -70,6 +70,7 @@ export interface DeviceCursorsTable {
     id: string;
     workspace_id: string;
     device_id: string;
+    owner_user_id: string | null;
     last_seen_version: number;
     updated_at: Generated<number>;
 }
@@ -80,6 +81,8 @@ export interface TombstonesTable {
     pk: string;
     deleted_at: number;
     clock: number;
+    hlc: string;
+    op_id: string;
     server_version: number;
     created_at: Generated<number>;
 }
@@ -90,10 +93,98 @@ export interface SyncedEntityTable {
     clock: number;
     hlc: string;
     device_id: string;
+    op_id: string;
     deleted: Generated<number>;
     created_at: Generated<number>;
     updated_at: Generated<number>;
 }
+export interface SyncSnapshotsTable {
+    id: string;
+    workspace_id: string;
+    high_watermark: number;
+    tables_json: string;
+    created_at: number;
+    expires_at: number;
+}
+export interface SyncSnapshotItemsTable {
+    snapshot_id: string;
+    table_name: string;
+    pk: string;
+    kind: string;
+    payload_json: string | null;
+    clock: number;
+    hlc: string;
+    op_id: string;
+    server_deleted_at: number | null;
+}
+export interface UploadIntentsTable {
+    id: string;
+    workspace_id: string;
+    hash: string;
+    mime_type: string;
+    size_bytes: number;
+    reserved_bytes: number;
+    expires_at: number;
+    status: 'active' | 'consumed' | 'cancelled' | 'expired';
+    storage_id: string | null;
+    created_at: number;
+    consumed_at: number | null;
+    cancelled_at: number | null;
+}
+export interface ConnectDeviceAuthorizationsTable {
+    id: string;
+    device_code_hash: string;
+    user_code_hash: string;
+    status: 'pending' | 'provisioning' | 'approved' | 'delivering' | 'denied' | 'consumed' | 'expired';
+    host_json: string;
+    approved_user_id: string | null;
+    approved_workspace_id: string | null;
+    environment_id: string | null;
+    credential_ciphertext: string | null;
+    credential_delivery_started_at: number | null;
+    credential_redeliver_until: number | null;
+    expires_at: number;
+    created_at: number;
+    updated_at: number;
+}
+export interface ConnectEnvironmentsTable {
+    id: string;
+    user_id: string;
+    workspace_id: string;
+    name: string;
+    platform: string;
+    architecture: string;
+    host_id: string | null;
+    signing_public_key: string | null;
+    noise_public_key: string | null;
+    authorization_id: string | null;
+    hostname: string;
+    tunnel_id: string;
+    dns_record_id: string;
+    control_token_hash: string;
+    access_credential_ciphertext: string;
+    tunnel_secret_ciphertext: string | null;
+    status: 'provisioning' | 'active' | 'revoking' | 'revoked' | 'error';
+    lifecycle_attempts: number;
+    lifecycle_next_attempt_at: number;
+    lifecycle_claim_token: string | null;
+    lifecycle_claimed_until: number | null;
+    provisioning_deadline_at: number | null;
+    activation_deadline_at: number | null;
+    activation_claimed_at: number | null;
+    relay_authenticator: string | null;
+    lifecycle_error: string | null;
+    last_seen_at: number | null;
+    created_at: number;
+    updated_at: number;
+    revoked_at: number | null;
+}
+export interface RateLimitsTable {
+    key: string;
+    count: number;
+    window_started_at: number;
+    expires_at: number;
+}
 export interface AdminUsersTable {
     user_id: string;
     created_at: number;
@@ -116,6 +207,12 @@ export interface Or3SqliteDb {
     change_log: ChangeLogTable;
     device_cursors: DeviceCursorsTable;
     tombstones: TombstonesTable;
+    sync_snapshots: SyncSnapshotsTable;
+    sync_snapshot_items: SyncSnapshotItemsTable;
+    upload_intents: UploadIntentsTable;
+    connect_device_authorizations: ConnectDeviceAuthorizationsTable;
+    connect_environments: ConnectEnvironmentsTable;
+    rate_limits: RateLimitsTable;
     s_threads: SyncedEntityTable;
     s_messages: SyncedEntityTable;
     s_projects: SyncedEntityTable;

package/dist/runtime/server/plugins/register.js

@@ -2,34 +2,55 @@ import { registerAuthWorkspaceStore } from "~~/server/auth/store/registry";
 import { registerProviderAdminAdapter } from "~~/server/admin/providers/registry";
 import { registerAdminStoreProvider } from "~~/server/admin/stores/registry";
 import { registerSyncGatewayAdapter } from "~~/server/sync/gateway/registry";
+import { registerWebhookStore } from "~~/server/utils/webhooks/store/registry";
+import { registerConnectStore } from "~~/server/connect/store/registry";
+import { registerRateLimitProvider } from "~~/server/utils/rate-limit/registry";
 import { createSqliteAuthWorkspaceStore } from "../auth/sqlite-auth-workspace-store.js";
 import { createSqliteSyncGatewayAdapter } from "../sync/sqlite-sync-gateway-adapter.js";
+import { createSqliteWebhookStore } from "../webhooks/sqlite-webhook-store.js";
 import {
   createSqliteAdminUserStore,
   createSqliteWorkspaceAccessStore,
   createSqliteWorkspaceSettingsStore
 } from "../admin/stores/sqlite-store.js";
 import { sqliteSyncAdminAdapter } from "../admin/adapters/sync-sqlite.js";
+import { createSqliteConnectStore } from "../connect/sqlite-connect-store.js";
 import { getSqliteDb } from "../db/kysely.js";
 import { runMigrations } from "../db/migrate.js";
+import { sqliteRateLimitProvider } from "../rate-limit/sqlite-provider.js";
 import { useRuntimeConfig } from "#imports";
 const SQLITE_PROVIDER_ID = "sqlite";
 export default defineNitroPlugin(async () => {
   const config = useRuntimeConfig();
   if (!config.auth?.enabled) return;
-  if (!config.sync?.enabled) return;
-  if (config.sync?.provider !== SQLITE_PROVIDER_ID) return;
+  const syncSelected = config.sync?.enabled === true && config.sync?.provider === SQLITE_PROVIDER_ID;
+  const connectSelected = config.connect?.enabled === true && config.connect?.provider === SQLITE_PROVIDER_ID;
+  if (!syncSelected && !connectSelected) return;
   const db = getSqliteDb();
-  await runMigrations(db);
   registerAuthWorkspaceStore({
     id: SQLITE_PROVIDER_ID,
     order: 100,
     create: createSqliteAuthWorkspaceStore
   });
-  registerSyncGatewayAdapter({
+  registerRateLimitProvider(SQLITE_PROVIDER_ID, sqliteRateLimitProvider);
+  if (syncSelected) {
+    registerSyncGatewayAdapter({
+      id: SQLITE_PROVIDER_ID,
+      order: 100,
+      create: createSqliteSyncGatewayAdapter
+    });
+  }
+  if (connectSelected) {
+    registerConnectStore({
+      id: SQLITE_PROVIDER_ID,
+      order: 100,
+      create: createSqliteConnectStore
+    });
+  }
+  registerWebhookStore({
     id: SQLITE_PROVIDER_ID,
     order: 100,
-    create: createSqliteSyncGatewayAdapter
+    create: createSqliteWebhookStore
   });
   registerAdminStoreProvider({
     id: SQLITE_PROVIDER_ID,
@@ -45,4 +66,5 @@ export default defineNitroPlugin(async () => {
     })
   });
   registerProviderAdminAdapter(sqliteSyncAdminAdapter);
+  await runMigrations(db);
 });

package/dist/runtime/server/rate-limit/sqlite-provider.d.ts

@@ -0,0 +1,7 @@
+import type { RateLimitConfig, RateLimitProvider, RateLimitResult, RateLimitStats } from '~~/server/utils/rate-limit/types';
+export declare class SqliteRateLimitProvider implements RateLimitProvider {
+    readonly name = "sqlite";
+    checkAndRecord(key: string, config: RateLimitConfig): Promise<RateLimitResult>;
+    getStats(key: string, config: RateLimitConfig): Promise<RateLimitStats | null>;
+}
+export declare const sqliteRateLimitProvider: SqliteRateLimitProvider;

package/dist/runtime/server/rate-limit/sqlite-provider.js

@@ -0,0 +1,70 @@
+import { getRawDb } from "../db/kysely.js";
+export class SqliteRateLimitProvider {
+  name = "sqlite";
+  async checkAndRecord(key, config) {
+    requireConfig(config);
+    const now = Date.now();
+    const db = getRawDb();
+    return db.transaction(() => {
+      const row = db.prepare(
+        `SELECT count, window_started_at, expires_at
+                     FROM rate_limits WHERE key = ?`
+      ).get(key);
+      if (!row || row.expires_at <= now) {
+        db.prepare(
+          `INSERT INTO rate_limits (
+                        key, count, window_started_at, expires_at
+                     ) VALUES (?, 1, ?, ?)
+                     ON CONFLICT(key) DO UPDATE SET
+                        count = 1,
+                        window_started_at = excluded.window_started_at,
+                        expires_at = excluded.expires_at`
+        ).run(key, now, now + config.windowMs);
+        return {
+          allowed: true,
+          remaining: config.maxRequests - 1
+        };
+      }
+      if (row.count >= config.maxRequests) {
+        return {
+          allowed: false,
+          remaining: 0,
+          retryAfterMs: Math.max(0, row.expires_at - now)
+        };
+      }
+      db.prepare(
+        `UPDATE rate_limits SET count = count + 1 WHERE key = ?`
+      ).run(key);
+      return {
+        allowed: true,
+        remaining: config.maxRequests - row.count - 1
+      };
+    })();
+  }
+  async getStats(key, config) {
+    requireConfig(config);
+    const now = Date.now();
+    const row = getRawDb().prepare(
+      `SELECT count, window_started_at, expires_at
+                 FROM rate_limits WHERE key = ?`
+    ).get(key);
+    if (!row || row.expires_at <= now) {
+      return {
+        limit: config.maxRequests,
+        remaining: config.maxRequests,
+        resetMs: config.windowMs
+      };
+    }
+    return {
+      limit: config.maxRequests,
+      remaining: Math.max(0, config.maxRequests - row.count),
+      resetMs: Math.max(0, row.expires_at - now)
+    };
+  }
+}
+export const sqliteRateLimitProvider = new SqliteRateLimitProvider();
+function requireConfig(config) {
+  if (!Number.isSafeInteger(config.windowMs) || config.windowMs <= 0 || !Number.isSafeInteger(config.maxRequests) || config.maxRequests <= 0) {
+    throw new Error("Invalid SQLite rate-limit configuration");
+  }
+}

package/dist/runtime/server/sync/history-gc-policy.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Sync history retention is deliberately fail-closed.
+ *
+ * An operator cannot enable this with environment configuration. The policy
+ * may change only after snapshot-at-high-watermark bootstrap is implemented
+ * and verified for SQLite deployments.
+ */
+export declare const SYNC_HISTORY_GC_POLICY: Readonly<{
+    enabled: true;
+    snapshotBootstrapVerified: true;
+    reason: "SQLite history GC is guarded by the verified snapshot-v1 retention contract.";
+}>;
+export declare function canRunSyncHistoryGc(): boolean;

package/dist/runtime/server/sync/history-gc-policy.js

@@ -0,0 +1,8 @@
+export const SYNC_HISTORY_GC_POLICY = Object.freeze({
+  enabled: true,
+  snapshotBootstrapVerified: true,
+  reason: "SQLite history GC is guarded by the verified snapshot-v1 retention contract."
+});
+export function canRunSyncHistoryGc() {
+  return SYNC_HISTORY_GC_POLICY.enabled && SYNC_HISTORY_GC_POLICY.snapshotBootstrapVerified;
+}

package/dist/runtime/server/sync/sqlite-sync-gateway-adapter.d.ts

@@ -6,13 +6,25 @@
  * (BEGIN IMMEDIATE prevents concurrent server_version races).
  */
 import type { H3Event } from 'h3';
-import type { SyncGatewayAdapter } from '~~/server/sync/gateway/types';
-import type { PullRequest, PullResponse, PushBatch, PushResult } from '~~/shared/sync/types';
+import type { CanonicalStorageQueryRequest, CanonicalStorageQueryResponse, SyncGatewayAdapter, UploadIntentConsumptionRequest, UploadIntentReservationRequest } from '~~/server/sync/gateway/types';
+import type { PullRequest, PullResponse, PushBatch, PushResult, SnapshotRequest, SnapshotResponse } from '~~/shared/sync/types';
 export declare class SqliteSyncGatewayAdapter implements SyncGatewayAdapter {
     id: string;
+    readonly capabilities: {
+        readonly snapshotBootstrap: "snapshot-v1";
+        readonly historyRetention: "snapshot-v1";
+    };
     private get db();
+    reserveUploadIntent(event: H3Event, input: UploadIntentReservationRequest): Promise<void>;
+    consumeUploadIntent(event: H3Event, input: UploadIntentConsumptionRequest): Promise<void>;
+    cancelUploadIntent(event: H3Event, input: {
+        workspaceId: string;
+        intentId: string;
+    }): Promise<void>;
+    queryCanonicalStorage(event: H3Event, input: CanonicalStorageQueryRequest): Promise<CanonicalStorageQueryResponse>;
     push(event: H3Event, input: PushBatch): Promise<PushResult>;
     pull(event: H3Event, input: PullRequest): Promise<PullResponse>;
+    snapshot(event: H3Event, input: SnapshotRequest): Promise<SnapshotResponse>;
     updateCursor(event: H3Event, input: {
         scope: {
             workspaceId: string;