selfstore 1.8.25 → 1.8.27

package/README.md

@@ -182,6 +182,23 @@ const proof = await prove(bytes, { notary, label: 'inventory', store, file });
 const done = await completeProof(proof, { notary, store });
 ```
 
+An app does not track which receipts are still waiting: the store already
+knows. At launch, `completePending` asks each notary for the incomplete proofs
+it issued and writes back only those that came back complete; `proofsIn(store)`
+reads every proof back, oldest deposit first, to list a series or rebuild a
+screen on another device.
+
+```ts
+import { completePending, proofsIn } from 'selfstore/proof';
+
+const { completed, pending, refused } = await completePending({ store, notaries: [notary] });
+for (const proof of proofsIn(store)) show(proof.file, proof.depositedAt, proof.complete);
+```
+
+A notary that cannot be reached is not asked again in the same round, and its
+proofs stay pending for the next launch; a completion answering for another
+digest is set apart in `refused` and never overwrites the receipt.
+
 `verify` proves the bytes are the ones the receipt names. That the receipt is
 genuine is what the notary's evidence is for, checked with the notary's own
 verifier.

package/dist/advanced.js

@@ -1,13 +1,13 @@
 import { peer, fromSession as fromSession$3, connect as connect$3 } from './chunk-GHSHIDF3.js';
 import { fromSession as fromSession$2, connect as connect$2 } from './chunk-IDW3WQKF.js';
-export { RESERVED_STORE_MODES, createLocalStore, deriveStatus, gisDriveAuth, indexedDbCache, isLockableCache, isReservedStoreMode, memoryCache, preloadGoogleIdentity } from './chunk-AZWS7YC3.js';
+export { RESERVED_STORE_MODES, createLocalStore, deriveStatus, gisDriveAuth, indexedDbCache, isLockableCache, isReservedStoreMode, memoryCache, preloadGoogleIdentity } from './chunk-DIO6A5IP.js';
 import './chunk-GSZSZGSD.js';
-export { datedName, pickFromDisk, saveToDisk } from './chunk-LQS7AMOD.js';
+export { datedName, pickFromDisk, saveToDisk } from './chunk-ORVB7IJO.js';
 import './chunk-FJGWTBAL.js';
 import { openExisting, isOpenSupported, isSupported, fromSession as fromSession$1, connect as connect$1 } from './chunk-2TIRUEXR.js';
 import { FILE_ID_KEY, secondary, owner, unshare, share, createCompanion, account, renameBackup, deleteBackup, createBackup, listBackups, findOrCreateOwnFile, adopt, preview, fromSession, connect } from './chunk-25U6AKIX.js';
 import './chunk-LF3CC2P3.js';
-export { RESERVED_COLLECTION_PREFIX, checkPasswordPolicy, exportSnapshot, importSnapshot, inspect, isEncrypted } from './chunk-RVOBONZF.js';
+export { RESERVED_COLLECTION_PREFIX, checkPasswordPolicy, exportSnapshot, importSnapshot, inspect, isEncrypted } from './chunk-N6TIEOP5.js';
 import './chunk-QBCU7OOP.js';
 import './chunk-F4ZZEJ5H.js';
 import './chunk-5UYPKCDB.js';

package/dist/backups.js

@@ -2,7 +2,7 @@ export { createBackupsManager, driveBackupsHost } from './chunk-5DAPYC2K.js';
 import './chunk-2BNTCXQN.js';
 import './chunk-25U6AKIX.js';
 import './chunk-LF3CC2P3.js';
-import './chunk-RVOBONZF.js';
+import './chunk-N6TIEOP5.js';
 import './chunk-F4ZZEJ5H.js';
 import './chunk-5UYPKCDB.js';
 import './chunk-WXI2NAPA.js';

package/dist/{chunk-FQ5O4PHK.js → chunk-5V3THD54.js}

@@ -12,18 +12,18 @@ async function load(what, mod) {
   }
 }
 async function webdavConnect(opts) {
-  return (await load("WebDAV", () => import('./webdav-5SHNR7CL.js'))).connect(opts);
+  return (await load("WebDAV", () => import('./webdav-5TRDSFB5.js'))).connect(opts);
 }
 async function webdavFromSession(opts) {
-  return (await load("WebDAV", () => import('./webdav-5SHNR7CL.js'))).fromSession(opts);
+  return (await load("WebDAV", () => import('./webdav-5TRDSFB5.js'))).fromSession(opts);
 }
 async function s3Connect(opts) {
-  return (await load("S3", () => import('./s3-ABKUTTXE.js'))).connect(opts);
+  return (await load("S3", () => import('./s3-UTARQYNR.js'))).connect(opts);
 }
 async function s3FromSession(opts) {
-  return (await load("S3", () => import('./s3-ABKUTTXE.js'))).fromSession(opts);
+  return (await load("S3", () => import('./s3-UTARQYNR.js'))).fromSession(opts);
 }
 
 export { s3Connect, s3FromSession, webdavConnect, webdavFromSession };
-//# sourceMappingURL=chunk-FQ5O4PHK.js.map
-//# sourceMappingURL=chunk-FQ5O4PHK.js.map
+//# sourceMappingURL=chunk-5V3THD54.js.map
+//# sourceMappingURL=chunk-5V3THD54.js.map

package/dist/{chunk-FQ5O4PHK.js.map → chunk-5V3THD54.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/persistence/targets/servers.ts"],"names":[],"mappings":";;;AA4BA,eAAe,IAAA,CAAQ,MAAc,GAAA,EAAmC;AACvE,EAAA,IAAI;AACH,IAAA,OAAO,MAAM,GAAA,EAAI;AAAA,EAClB,SAAS,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,cAAA;AAAA,MACT,oBAAA;AAAA,MACA,CAAA,IAAA,EAAO,IAAI,CAAA,8BAAA,EAAiC,CAAA,YAAa,QAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,EAAA;AAAA,KACvF;AAAA,EACD;AACD;AAEA,eAAsB,cAAc,IAAA,EAA0D;AAC7F,EAAA,OAAA,CAAQ,MAAM,KAAK,QAAA,EAAU,MAAM,OAAO,sBAAU,CAAC,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA;AACrE;AAEA,eAAsB,kBAAkB,IAAA,EAAgD;AACvF,EAAA,OAAA,CAAQ,MAAM,KAAK,QAAA,EAAU,MAAM,OAAO,sBAAU,CAAC,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA;AACzE;AAEA,eAAsB,UAAU,IAAA,EAAsD;AACrF,EAAA,OAAA,CAAQ,MAAM,KAAK,IAAA,EAAM,MAAM,OAAO,kBAAM,CAAC,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA;AAC7D;AAEA,eAAsB,cAAc,IAAA,EAAgD;AACnF,EAAA,OAAA,CAAQ,MAAM,KAAK,IAAA,EAAM,MAAM,OAAO,kBAAM,CAAC,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA;AACjE","file":"chunk-FQ5O4PHK.js","sourcesContent":["// The two destinations that reach a server the user runs - WebDAV and an\n// S3-compatible bucket - loaded on the gesture that uses them instead of with\n// the module that offers them.\n//\n// Why these two and not all four: Drive and the disk file both open a picker or\n// a consent popup, and a browser only allows that inside the transient\n// activation of the user's click. An `await import()` before the call can spend\n// that activation and turn a working button into a silently blocked popup. A\n// WebDAV or S3 connection is plain fetch behind a form the user already\n// submitted - nothing to preserve, so the chunk can arrive late.\n//\n// What it buys: an app that offers Drive and a disk file - the common case -\n// stops shipping the SigV4 request signer and the WebDAV client. Before this,\n// importing the connect journey (so: any of the widgets) pulled both in whether\n// or not the app named them, which made \"destinations are opt-in\" true of the\n// API and false of the bytes.\n//\n// `selfstore/advanced` keeps its STATIC `webdavTarget` / `s3Target`: naming one\n// of those is the opt-in, and an app that wrote the import wants the code.\n\nimport { SelfstoreError } from '../../selfstore/errors';\nimport type { BackupTarget } from '../target';\nimport type { KV } from '../cache';\nimport type { WebdavConnectOptions } from './webdav';\nimport type { S3ConnectOptions } from './s3';\n\n/** A chunk that does not arrive is the destination not answering: same code,\n *  same retry, rather than a bare Error escaping a public path. */\nasync function load<T>(what: string, mod: () => Promise<T>): Promise<T> {\n\ttry {\n\t\treturn await mod();\n\t} catch (e) {\n\t\tthrow new SelfstoreError(\n\t\t\t'TARGET_UNAVAILABLE',\n\t\t\t`The ${what} support could not be loaded (${e instanceof Error ? e.message : String(e)}).`\n\t\t);\n\t}\n}\n\nexport async function webdavConnect(opts: WebdavConnectOptions): Promise<BackupTarget | null> {\n\treturn (await load('WebDAV', () => import('./webdav'))).connect(opts);\n}\n\nexport async function webdavFromSession(opts: { kv: KV }): Promise<BackupTarget | null> {\n\treturn (await load('WebDAV', () => import('./webdav'))).fromSession(opts);\n}\n\nexport async function s3Connect(opts: S3ConnectOptions): Promise<BackupTarget | null> {\n\treturn (await load('S3', () => import('./s3'))).connect(opts);\n}\n\nexport async function s3FromSession(opts: { kv: KV }): Promise<BackupTarget | null> {\n\treturn (await load('S3', () => import('./s3'))).fromSession(opts);\n}\n"]}
+{"version":3,"sources":["../src/persistence/targets/servers.ts"],"names":[],"mappings":";;;AA4BA,eAAe,IAAA,CAAQ,MAAc,GAAA,EAAmC;AACvE,EAAA,IAAI;AACH,IAAA,OAAO,MAAM,GAAA,EAAI;AAAA,EAClB,SAAS,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,cAAA;AAAA,MACT,oBAAA;AAAA,MACA,CAAA,IAAA,EAAO,IAAI,CAAA,8BAAA,EAAiC,CAAA,YAAa,QAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,EAAA;AAAA,KACvF;AAAA,EACD;AACD;AAEA,eAAsB,cAAc,IAAA,EAA0D;AAC7F,EAAA,OAAA,CAAQ,MAAM,KAAK,QAAA,EAAU,MAAM,OAAO,sBAAU,CAAC,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA;AACrE;AAEA,eAAsB,kBAAkB,IAAA,EAAgD;AACvF,EAAA,OAAA,CAAQ,MAAM,KAAK,QAAA,EAAU,MAAM,OAAO,sBAAU,CAAC,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA;AACzE;AAEA,eAAsB,UAAU,IAAA,EAAsD;AACrF,EAAA,OAAA,CAAQ,MAAM,KAAK,IAAA,EAAM,MAAM,OAAO,kBAAM,CAAC,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA;AAC7D;AAEA,eAAsB,cAAc,IAAA,EAAgD;AACnF,EAAA,OAAA,CAAQ,MAAM,KAAK,IAAA,EAAM,MAAM,OAAO,kBAAM,CAAC,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA;AACjE","file":"chunk-5V3THD54.js","sourcesContent":["// The two destinations that reach a server the user runs - WebDAV and an\n// S3-compatible bucket - loaded on the gesture that uses them instead of with\n// the module that offers them.\n//\n// Why these two and not all four: Drive and the disk file both open a picker or\n// a consent popup, and a browser only allows that inside the transient\n// activation of the user's click. An `await import()` before the call can spend\n// that activation and turn a working button into a silently blocked popup. A\n// WebDAV or S3 connection is plain fetch behind a form the user already\n// submitted - nothing to preserve, so the chunk can arrive late.\n//\n// What it buys: an app that offers Drive and a disk file - the common case -\n// stops shipping the SigV4 request signer and the WebDAV client. Before this,\n// importing the connect journey (so: any of the widgets) pulled both in whether\n// or not the app named them, which made \"destinations are opt-in\" true of the\n// API and false of the bytes.\n//\n// `selfstore/advanced` keeps its STATIC `webdavTarget` / `s3Target`: naming one\n// of those is the opt-in, and an app that wrote the import wants the code.\n\nimport { SelfstoreError } from '../../selfstore/errors';\nimport type { BackupTarget } from '../target';\nimport type { KV } from '../cache';\nimport type { WebdavConnectOptions } from './webdav';\nimport type { S3ConnectOptions } from './s3';\n\n/** A chunk that does not arrive is the destination not answering: same code,\n *  same retry, rather than a bare Error escaping a public path. */\nasync function load<T>(what: string, mod: () => Promise<T>): Promise<T> {\n\ttry {\n\t\treturn await mod();\n\t} catch (e) {\n\t\tthrow new SelfstoreError(\n\t\t\t'TARGET_UNAVAILABLE',\n\t\t\t`The ${what} support could not be loaded (${e instanceof Error ? e.message : String(e)}).`\n\t\t);\n\t}\n}\n\nexport async function webdavConnect(opts: WebdavConnectOptions): Promise<BackupTarget | null> {\n\treturn (await load('WebDAV', () => import('./webdav'))).connect(opts);\n}\n\nexport async function webdavFromSession(opts: { kv: KV }): Promise<BackupTarget | null> {\n\treturn (await load('WebDAV', () => import('./webdav'))).fromSession(opts);\n}\n\nexport async function s3Connect(opts: S3ConnectOptions): Promise<BackupTarget | null> {\n\treturn (await load('S3', () => import('./s3'))).connect(opts);\n}\n\nexport async function s3FromSession(opts: { kv: KV }): Promise<BackupTarget | null> {\n\treturn (await load('S3', () => import('./s3'))).fromSession(opts);\n}\n"]}

package/dist/{chunk-AZWS7YC3.js → chunk-DIO6A5IP.js}

@@ -1,5 +1,5 @@
 import { createNode, createMeta, gcTombstones, stamp, merge, unsyncableCounts, idPathFor, detectConflicts, changes } from './chunk-GSZSZGSD.js';
-import { inspect, checkPasswordPolicy, writeBox, BACKUP_MIME, readBoxWithSync, asBytes } from './chunk-RVOBONZF.js';
+import { inspect, checkPasswordPolicy, writeBox, BACKUP_MIME, readBoxWithSync, asBytes } from './chunk-N6TIEOP5.js';
 import { seal, isEnvelope, unseal, newDeviceKey } from './chunk-QBCU7OOP.js';
 import { openManifest, GROUP_KEYING } from './chunk-F4ZZEJ5H.js';
 import { mintSlot, MAX_KEY_SLOTS, mintExternalSlot, openSlot } from './chunk-5UYPKCDB.js';
@@ -74,6 +74,14 @@ var storeError = (code, message) => ({
   message
 });
 var RESERVED = "__store";
+function isBookkeeping(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return false;
+  const { schemaVersion, meta } = v;
+  if (schemaVersion !== void 0 && !(Number.isInteger(schemaVersion) && schemaVersion >= 0)) {
+    return false;
+  }
+  return meta === void 0 || meta === null || typeof meta === "object" && !Array.isArray(meta);
+}
 var KEY = {
   mode: "mode",
   version: "version",
@@ -389,8 +397,11 @@ function createLocalStore(opts) {
   }
   function readBookkeeping(snap, sidecar) {
     if (RESERVED in snap.collections) delete snap.collections[RESERVED];
-    const s = sidecar;
-    return { fromVersion: s?.schemaVersion ?? 0, sync: s?.meta ?? null };
+    if (sidecar === null) return { fromVersion: 0, sync: null };
+    if (!isBookkeeping(sidecar)) {
+      throw new SelfstoreError("BAD_FORMAT", "Unreadable sync metadata (sync.json).");
+    }
+    return { fromVersion: sidecar.schemaVersion ?? 0, sync: sidecar.meta ?? null };
   }
   const migrated = (snap, fromV) => opts.migrate && fromV < version ? opts.migrate(fromV, snap) : snap;
   function mergeFiles(local, remote) {
@@ -559,6 +570,24 @@ function createLocalStore(opts) {
       );
     }
   }
+  async function convergeBeforeRewrite(where) {
+    await requireReady(where);
+    const seen = await statRemote();
+    if (seen === null || remoteVersion === null || seen === remoteVersion) return;
+    const pulled = await pullRemoteIntoLocal("push", seen);
+    if (locked() || needsAttention) {
+      throw new SelfstoreError(
+        "TARGET_WRITE_FAILED",
+        `${where}(): the pre-rewrite converge needs attention; resolve it first.`
+      );
+    }
+    if (pulled === "unreachable") {
+      throw new SelfstoreError(
+        "TARGET_WRITE_FAILED",
+        `${where}(): the destination is unreachable; try again online.`
+      );
+    }
+  }
   async function setRemoteVersion(v) {
     remoteVersion = v;
     if (v === null) await kv.del(KEY.remoteVersion);
@@ -593,8 +622,12 @@ function createLocalStore(opts) {
       }
       const seen = await statRemote();
       if (seen !== null && remoteVersion !== null && seen !== remoteVersion) {
-        await pullRemoteIntoLocal(source, seen);
+        const pulled = await pullRemoteIntoLocal(source, seen);
         if (locked() || needsAttention) return false;
+        if (pulled === "unreachable") {
+          lastError = transient("Save deferred: destination momentarily unreachable.");
+          return false;
+        }
       }
       const snap = await gather();
       const digest = await contentDigest(snap);
@@ -763,10 +796,12 @@ function createLocalStore(opts) {
   async function pullRemoteIntoLocal(source, seen) {
     if (!durable) return null;
     const marker = seen === void 0 ? await statRemote() : seen;
-    let remote = null;
+    let remote;
     try {
       remote = await takeFreshPrefetch(durable) ?? await durable.load();
-    } catch {
+    } catch (e) {
+      logger.warn("[selfstore] download of the durable copy failed", e);
+      return "unreachable";
     }
     if (!remote) return null;
     const decoded = await importLocked(remote);
@@ -891,7 +926,7 @@ function createLocalStore(opts) {
     if (durable) {
       const r = await pullRemoteIntoLocal(source);
       if (r === "locked") return null;
-      entry = r;
+      entry = r === "unreachable" ? null : r;
     }
     entry = await foldPeers(source) ?? entry;
     if (durable) await pushDurable(source);
@@ -1458,17 +1493,7 @@ function createLocalStore(opts) {
         );
       }
       return serialize(async () => {
-        await requireReady("setEncryption");
-        const seen = await statRemote();
-        if (seen !== null && remoteVersion !== null && seen !== remoteVersion) {
-          await pullRemoteIntoLocal("push", seen);
-          if (locked() || needsAttention) {
-            throw new SelfstoreError(
-              "TARGET_WRITE_FAILED",
-              "setEncryption(): the pre-rewrite converge needs attention; resolve it first."
-            );
-          }
-        }
+        await convergeBeforeRewrite("setEncryption");
         const prevEncrypted = encrypted;
         const prevPass = pass;
         const prevEnvelope = envelope;
@@ -1524,17 +1549,7 @@ function createLocalStore(opts) {
         );
       }
       return serialize(async () => {
-        await requireReady("addEncryptionKey");
-        const seen = await statRemote();
-        if (seen !== null && remoteVersion !== null && seen !== remoteVersion) {
-          await pullRemoteIntoLocal("push", seen);
-          if (locked() || needsAttention) {
-            throw new SelfstoreError(
-              "TARGET_WRITE_FAILED",
-              "addEncryptionKey(): the pre-rewrite converge needs attention; resolve it first."
-            );
-          }
-        }
+        await convergeBeforeRewrite("addEncryptionKey");
         if (!envelope) {
           const dataKey = crypto.getRandomValues(new Uint8Array(32));
           envelope = { dataKey, slots: [await mintSlot(pass, dataKey)] };
@@ -1590,17 +1605,7 @@ function createLocalStore(opts) {
         throw new TypeError("removeEncryptionKey(): the backup has no password.");
       }
       return serialize(async () => {
-        await requireReady("removeEncryptionKey");
-        const seen = await statRemote();
-        if (seen !== null && remoteVersion !== null && seen !== remoteVersion) {
-          await pullRemoteIntoLocal("push", seen);
-          if (locked() || needsAttention) {
-            throw new SelfstoreError(
-              "TARGET_WRITE_FAILED",
-              "removeEncryptionKey(): the pre-rewrite converge needs attention; resolve it first."
-            );
-          }
-        }
+        await convergeBeforeRewrite("removeEncryptionKey");
         if (!envelope) {
           throw new TypeError(
             "removeEncryptionKey(): no key slots known - the file predates the envelope or has not been read yet."
@@ -1667,17 +1672,7 @@ function createLocalStore(opts) {
         );
       }
       return serialize(async () => {
-        await requireReady("setExternalEncryption");
-        const seen = await statRemote();
-        if (seen !== null && remoteVersion !== null && seen !== remoteVersion) {
-          await pullRemoteIntoLocal("push", seen);
-          if (locked() || needsAttention) {
-            throw new SelfstoreError(
-              "TARGET_WRITE_FAILED",
-              "setExternalEncryption(): the pre-rewrite converge needs attention; resolve it first."
-            );
-          }
-        }
+        await convergeBeforeRewrite("setExternalEncryption");
         const prevEncrypted = encrypted;
         const prevPass = pass;
         const prevEnvelope = envelope;
@@ -1738,17 +1733,7 @@ function createLocalStore(opts) {
         );
       }
       return serialize(async () => {
-        await requireReady("addExternalKey");
-        const seen = await statRemote();
-        if (seen !== null && remoteVersion !== null && seen !== remoteVersion) {
-          await pullRemoteIntoLocal("push", seen);
-          if (locked() || needsAttention) {
-            throw new SelfstoreError(
-              "TARGET_WRITE_FAILED",
-              "addExternalKey(): the pre-rewrite converge needs attention; resolve it first."
-            );
-          }
-        }
+        await convergeBeforeRewrite("addExternalKey");
         if (!envelope && pass) {
           const dataKey = crypto.getRandomValues(new Uint8Array(32));
           envelope = { dataKey, slots: [await mintSlot(pass, dataKey)] };
@@ -2165,5 +2150,5 @@ function gisDriveAuth(opts) {
 }
 
 export { RESERVED_STORE_MODES, createLocalStore, deriveStatus, gisDriveAuth, indexedDbCache, isLockableCache, isReservedStoreMode, memoryCache, preloadGoogleIdentity };
-//# sourceMappingURL=chunk-AZWS7YC3.js.map
-//# sourceMappingURL=chunk-AZWS7YC3.js.map
+//# sourceMappingURL=chunk-DIO6A5IP.js.map
+//# sourceMappingURL=chunk-DIO6A5IP.js.map