sliftutils 1.7.87 → 1.7.89

package/storage/remoteStorage/dist/validation.ts.cache

@@ -1,12 +1,22 @@
-"use strict"; var console = (function shimConsole() {             let baseConsole = globalThis.console;             if (typeof window !== "undefined")                 return baseConsole;             let name = __filename.replaceAll("\\", "/").split("/").pop();             let dirName = __dirname.replaceAll("\\", "/").split("/").pop();             let context = {                 __FILE__: __filename,                 __DIR__: __dirname,                 __NAME__: name,                 __DIRNAME__: dirName             };             let newConsole = {                 ...baseConsole             };             for (let shim of ["log", "info", "warn", "error"]) {                 newConsole[shim] = (...args) => {                     args.push(context);                     baseConsole[shim](...args);                 };             }             newConsole.__context = context;             return newConsole;         })(); "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.assertValidArgs = exports.assertValidPath = exports.assertValidName = void 0;
+//exports.assertValidArgs = exports.assertValidPath = exports.assertValidSourceName = exports.assertValidName = void 0;
 function assertValidName(value, kind) {
     if (!/^[\w-]{1,64}$/.test(value)) {
         throw new Error(`Invalid ${kind} ${JSON.stringify(value)}, expected 1-64 characters of letters/numbers/underscore/dash`);
     }
 }
 exports.assertValidName = assertValidName;
+/** A store's name (see CommonConfig.name), which also allows dots - a name is often a host or a version, and both read wrong without them. It is one path segment of the store's folder, so the two names that would mean a different folder entirely are rejected: everything else containing dots is just a name. */
+function assertValidSourceName(value) {
+    if (!/^[\w.-]{1,64}$/.test(value)) {
+        throw new Error(`Invalid source name ${JSON.stringify(value)}, expected 1-64 characters of letters/numbers/underscore/dash/dot`);
+    }
+    if (/^\.+$/.test(value)) {
+        throw new Error(`Invalid source name ${JSON.stringify(value)}: a name of only dots refers to a directory rather than naming one`);
+    }
+}
+exports.assertValidSourceName = assertValidSourceName;
 function assertValidPath(path) {
     if (Buffer.from(path, "utf8").length > 1000) {
         throw new Error(`Path too long: ${path.length} characters > 1000. Path: ${path.slice(0, 200)}`);
@@ -36,5 +46,5 @@ function assertValidArgs(target, key, descriptor) {
     };
 }
 exports.assertValidArgs = assertValidArgs;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsU0FBZ0IsZUFBZSxDQUFDLEtBQWEsRUFBRSxJQUFZO0lBQ3ZELElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxXQUFXLElBQUksSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQzdILENBQUM7QUFDTCxDQUFDO0FBSkQsMENBSUM7QUFFRCxTQUFnQixlQUFlLENBQUMsSUFBWTtJQUN4QyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksS0FBSyxDQUFDLGtCQUFrQixJQUFJLENBQUMsTUFBTSw2QkFBNkIsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BHLENBQUM7SUFDRCxJQUFJLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzdILE1BQU0sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsOEZBQThGLENBQUMsQ0FBQztJQUN0SyxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ2pILENBQUM7QUFDTCxDQUFDO0FBVkQsMENBVUM7QUFFRCw0V0FBNFc7QUFDNVcsU0FBZ0IsZUFBZSxDQUFDLE1BQWUsRUFBRSxHQUFXLEVBQUUsVUFBOEI7SUFDeEYsSUFBSSxRQUFRLEdBQUcsVUFBVSxDQUFDLEtBQXdDLENBQUM7SUFDbkUsVUFBVSxDQUFDLEtBQUssR0FBRyxVQUFVLEdBQUcsSUFBZTtRQUMzQyxJQUFJLE1BQU0sR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUF5RSxDQUFDO1FBQzdGLElBQUksTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3ZDLElBQUksU0FBUyxJQUFJLE1BQU07Z0JBQUUsZUFBZSxDQUFDLE1BQU0sQ0FBQyxPQUFpQixFQUFFLFNBQVMsQ0FBQyxDQUFDO1lBQzlFLElBQUksWUFBWSxJQUFJLE1BQU07Z0JBQUUsZUFBZSxDQUFDLE1BQU0sQ0FBQyxVQUFvQixFQUFFLGFBQWEsQ0FBQyxDQUFDO1lBQ3hGLElBQUksTUFBTSxJQUFJLE1BQU07Z0JBQUUsZUFBZSxDQUFDLE1BQU0sQ0FBQyxJQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN0QyxDQUFDLENBQUM7QUFDTixDQUFDO0FBWEQsMENBV0MiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgZnVuY3Rpb24gYXNzZXJ0VmFsaWROYW1lKHZhbHVlOiBzdHJpbmcsIGtpbmQ6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmICghL15bXFx3LV17MSw2NH0kLy50ZXN0KHZhbHVlKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEludmFsaWQgJHtraW5kfSAke0pTT04uc3RyaW5naWZ5KHZhbHVlKX0sIGV4cGVjdGVkIDEtNjQgY2hhcmFjdGVycyBvZiBsZXR0ZXJzL251bWJlcnMvdW5kZXJzY29yZS9kYXNoYCk7XG4gICAgfVxufVxuXG5leHBvcnQgZnVuY3Rpb24gYXNzZXJ0VmFsaWRQYXRoKHBhdGg6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChCdWZmZXIuZnJvbShwYXRoLCBcInV0ZjhcIikubGVuZ3RoID4gMTAwMCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYFBhdGggdG9vIGxvbmc6ICR7cGF0aC5sZW5ndGh9IGNoYXJhY3RlcnMgPiAxMDAwLiBQYXRoOiAke3BhdGguc2xpY2UoMCwgMjAwKX1gKTtcbiAgICB9XG4gICAgaWYgKCFwYXRoIHx8IHBhdGguc3RhcnRzV2l0aChcIi9cIikgfHwgcGF0aC5lbmRzV2l0aChcIi9cIikgfHwgcGF0aC5pbmNsdWRlcyhcIi8vXCIpIHx8IHBhdGguaW5jbHVkZXMoXCJcXFxcXCIpIHx8IHBhdGguaW5jbHVkZXMoXCJcXHgwMFwiKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEludmFsaWQgcGF0aCAke0pTT04uc3RyaW5naWZ5KHBhdGguc2xpY2UoMCwgMjAwKSl9LCBwYXRocyBjYW5ub3QgYmUgZW1wdHksIHN0YXJ0IG9yIGVuZCB3aXRoIC8sIG9yIGNvbnRhaW4gLy8sIGJhY2tzbGFzaGVzLCBvciBudWxsIGNoYXJhY3RlcnNgKTtcbiAgICB9XG4gICAgaWYgKHBhdGguc3BsaXQoXCIvXCIpLnNvbWUocGFydCA9PiBwYXJ0ID09PSBcIi5cIiB8fCBwYXJ0ID09PSBcIi4uXCIpKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgSW52YWxpZCBwYXRoICR7SlNPTi5zdHJpbmdpZnkocGF0aC5zbGljZSgwLCAyMDApKX0sIHBhdGhzIGNhbm5vdCBjb250YWluIC4gb3IgLi4gc2VnbWVudHNgKTtcbiAgICB9XG59XG5cbi8qKiBNZXRob2QgZGVjb3JhdG9yOiB2YWxpZGF0ZXMgdGhlIHdlbGwta25vd24gZmllbGRzIG9mIHRoZSBtZXRob2QncyBzaW5nbGUgY29uZmlnLW9iamVjdCBhcmd1bWVudCAtIGFjY291bnQvYnVja2V0TmFtZSBhcyBuYW1lcywgcGF0aCBhcyBhIHBhdGggLSBiZWZvcmUgdGhlIG1ldGhvZCBydW5zLiBGaWVsZHMgdGhlIGNvbmZpZyBkb2Vzbid0IGhhdmUgYXJlIHNraXBwZWQsIHNvIGl0IGFwcGxpZXMgdG8gZXZlcnkgQVBJIG1ldGhvZCB1bmlmb3JtbHkuIHByZWZpeCBpcyBkZWxpYmVyYXRlbHkgTk9UIHZhbGlkYXRlZDogcHJlZml4ZXMgbWF5IGJlIGVtcHR5IG9yIGVuZCB3aXRoIFwiL1wiLCBib3RoIGludmFsaWQgZm9yIHBhdGhzLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFzc2VydFZhbGlkQXJncyh0YXJnZXQ6IHVua25vd24sIGtleTogc3RyaW5nLCBkZXNjcmlwdG9yOiBQcm9wZXJ0eURlc2NyaXB0b3IpOiB2b2lkIHtcbiAgICBsZXQgb3JpZ2luYWwgPSBkZXNjcmlwdG9yLnZhbHVlIGFzICguLi5hcmdzOiB1bmtub3duW10pID0+IHVua25vd247XG4gICAgZGVzY3JpcHRvci52YWx1ZSA9IGZ1bmN0aW9uICguLi5hcmdzOiB1bmtub3duW10pOiB1bmtub3duIHtcbiAgICAgICAgbGV0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgeyBhY2NvdW50Pzogc3RyaW5nOyBidWNrZXROYW1lPzogc3RyaW5nOyBwYXRoPzogc3RyaW5nIH0gfCB1bmRlZmluZWQ7XG4gICAgICAgIGlmIChjb25maWcgJiYgdHlwZW9mIGNvbmZpZyA9PT0gXCJvYmplY3RcIikge1xuICAgICAgICAgICAgaWYgKFwiYWNjb3VudFwiIGluIGNvbmZpZykgYXNzZXJ0VmFsaWROYW1lKGNvbmZpZy5hY2NvdW50IGFzIHN0cmluZywgXCJhY2NvdW50XCIpO1xuICAgICAgICAgICAgaWYgKFwiYnVja2V0TmFtZVwiIGluIGNvbmZpZykgYXNzZXJ0VmFsaWROYW1lKGNvbmZpZy5idWNrZXROYW1lIGFzIHN0cmluZywgXCJidWNrZXQgbmFtZVwiKTtcbiAgICAgICAgICAgIGlmIChcInBhdGhcIiBpbiBjb25maWcpIGFzc2VydFZhbGlkUGF0aChjb25maWcucGF0aCBhcyBzdHJpbmcpO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBvcmlnaW5hbC5hcHBseSh0aGlzLCBhcmdzKTtcbiAgICB9O1xufVxuIl19
- /* _JS_SOURCE_HASH = "05503760cddd9cddffc575307a41c7effd2a063244c8cff7064c8aeb7b0aa0f9"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsU0FBZ0IsZUFBZSxDQUFDLEtBQWEsRUFBRSxJQUFZO0lBQ3ZELElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxXQUFXLElBQUksSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQzdILENBQUM7QUFDTCxDQUFDO0FBSkQsMENBSUM7QUFFRCx1VEFBdVQ7QUFDdlQsU0FBZ0IscUJBQXFCLENBQUMsS0FBYTtJQUMvQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1QkFBdUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1QkFBdUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUN0SSxDQUFDO0FBQ0wsQ0FBQztBQVBELHNEQU9DO0FBRUQsU0FBZ0IsZUFBZSxDQUFDLElBQVk7SUFDeEMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsSUFBSSxFQUFFLENBQUM7UUFDMUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQkFBa0IsSUFBSSxDQUFDLE1BQU0sNkJBQTZCLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM3SCxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLDhGQUE4RixDQUFDLENBQUM7SUFDdEssQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEtBQUssR0FBRyxJQUFJLElBQUksS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzlELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUNqSCxDQUFDO0FBQ0wsQ0FBQztBQVZELDBDQVVDO0FBRUQsNFdBQTRXO0FBQzVXLFNBQWdCLGVBQWUsQ0FBQyxNQUFlLEVBQUUsR0FBVyxFQUFFLFVBQThCO0lBQ3hGLElBQUksUUFBUSxHQUFHLFVBQVUsQ0FBQyxLQUF3QyxDQUFDO0lBQ25FLFVBQVUsQ0FBQyxLQUFLLEdBQUcsVUFBVSxHQUFHLElBQWU7UUFDM0MsSUFBSSxNQUFNLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBeUUsQ0FBQztRQUM3RixJQUFJLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN2QyxJQUFJLFNBQVMsSUFBSSxNQUFNO2dCQUFFLGVBQWUsQ0FBQyxNQUFNLENBQUMsT0FBaUIsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUM5RSxJQUFJLFlBQVksSUFBSSxNQUFNO2dCQUFFLGVBQWUsQ0FBQyxNQUFNLENBQUMsVUFBb0IsRUFBRSxhQUFhLENBQUMsQ0FBQztZQUN4RixJQUFJLE1BQU0sSUFBSSxNQUFNO2dCQUFFLGVBQWUsQ0FBQyxNQUFNLENBQUMsSUFBYyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDdEMsQ0FBQyxDQUFDO0FBQ04sQ0FBQztBQVhELDBDQVdDIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0IGZ1bmN0aW9uIGFzc2VydFZhbGlkTmFtZSh2YWx1ZTogc3RyaW5nLCBraW5kOiBzdHJpbmcpOiB2b2lkIHtcbiAgICBpZiAoIS9eW1xcdy1dezEsNjR9JC8udGVzdCh2YWx1ZSkpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBJbnZhbGlkICR7a2luZH0gJHtKU09OLnN0cmluZ2lmeSh2YWx1ZSl9LCBleHBlY3RlZCAxLTY0IGNoYXJhY3RlcnMgb2YgbGV0dGVycy9udW1iZXJzL3VuZGVyc2NvcmUvZGFzaGApO1xuICAgIH1cbn1cblxuLyoqIEEgc3RvcmUncyBuYW1lIChzZWUgQ29tbW9uQ29uZmlnLm5hbWUpLCB3aGljaCBhbHNvIGFsbG93cyBkb3RzIC0gYSBuYW1lIGlzIG9mdGVuIGEgaG9zdCBvciBhIHZlcnNpb24sIGFuZCBib3RoIHJlYWQgd3Jvbmcgd2l0aG91dCB0aGVtLiBJdCBpcyBvbmUgcGF0aCBzZWdtZW50IG9mIHRoZSBzdG9yZSdzIGZvbGRlciwgc28gdGhlIHR3byBuYW1lcyB0aGF0IHdvdWxkIG1lYW4gYSBkaWZmZXJlbnQgZm9sZGVyIGVudGlyZWx5IGFyZSByZWplY3RlZDogZXZlcnl0aGluZyBlbHNlIGNvbnRhaW5pbmcgZG90cyBpcyBqdXN0IGEgbmFtZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhc3NlcnRWYWxpZFNvdXJjZU5hbWUodmFsdWU6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmICghL15bXFx3Li1dezEsNjR9JC8udGVzdCh2YWx1ZSkpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBJbnZhbGlkIHNvdXJjZSBuYW1lICR7SlNPTi5zdHJpbmdpZnkodmFsdWUpfSwgZXhwZWN0ZWQgMS02NCBjaGFyYWN0ZXJzIG9mIGxldHRlcnMvbnVtYmVycy91bmRlcnNjb3JlL2Rhc2gvZG90YCk7XG4gICAgfVxuICAgIGlmICgvXlxcLiskLy50ZXN0KHZhbHVlKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEludmFsaWQgc291cmNlIG5hbWUgJHtKU09OLnN0cmluZ2lmeSh2YWx1ZSl9OiBhIG5hbWUgb2Ygb25seSBkb3RzIHJlZmVycyB0byBhIGRpcmVjdG9yeSByYXRoZXIgdGhhbiBuYW1pbmcgb25lYCk7XG4gICAgfVxufVxuXG5leHBvcnQgZnVuY3Rpb24gYXNzZXJ0VmFsaWRQYXRoKHBhdGg6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChCdWZmZXIuZnJvbShwYXRoLCBcInV0ZjhcIikubGVuZ3RoID4gMTAwMCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYFBhdGggdG9vIGxvbmc6ICR7cGF0aC5sZW5ndGh9IGNoYXJhY3RlcnMgPiAxMDAwLiBQYXRoOiAke3BhdGguc2xpY2UoMCwgMjAwKX1gKTtcbiAgICB9XG4gICAgaWYgKCFwYXRoIHx8IHBhdGguc3RhcnRzV2l0aChcIi9cIikgfHwgcGF0aC5lbmRzV2l0aChcIi9cIikgfHwgcGF0aC5pbmNsdWRlcyhcIi8vXCIpIHx8IHBhdGguaW5jbHVkZXMoXCJcXFxcXCIpIHx8IHBhdGguaW5jbHVkZXMoXCJcXHgwMFwiKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEludmFsaWQgcGF0aCAke0pTT04uc3RyaW5naWZ5KHBhdGguc2xpY2UoMCwgMjAwKSl9LCBwYXRocyBjYW5ub3QgYmUgZW1wdHksIHN0YXJ0IG9yIGVuZCB3aXRoIC8sIG9yIGNvbnRhaW4gLy8sIGJhY2tzbGFzaGVzLCBvciBudWxsIGNoYXJhY3RlcnNgKTtcbiAgICB9XG4gICAgaWYgKHBhdGguc3BsaXQoXCIvXCIpLnNvbWUocGFydCA9PiBwYXJ0ID09PSBcIi5cIiB8fCBwYXJ0ID09PSBcIi4uXCIpKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgSW52YWxpZCBwYXRoICR7SlNPTi5zdHJpbmdpZnkocGF0aC5zbGljZSgwLCAyMDApKX0sIHBhdGhzIGNhbm5vdCBjb250YWluIC4gb3IgLi4gc2VnbWVudHNgKTtcbiAgICB9XG59XG5cbi8qKiBNZXRob2QgZGVjb3JhdG9yOiB2YWxpZGF0ZXMgdGhlIHdlbGwta25vd24gZmllbGRzIG9mIHRoZSBtZXRob2QncyBzaW5nbGUgY29uZmlnLW9iamVjdCBhcmd1bWVudCAtIGFjY291bnQvYnVja2V0TmFtZSBhcyBuYW1lcywgcGF0aCBhcyBhIHBhdGggLSBiZWZvcmUgdGhlIG1ldGhvZCBydW5zLiBGaWVsZHMgdGhlIGNvbmZpZyBkb2Vzbid0IGhhdmUgYXJlIHNraXBwZWQsIHNvIGl0IGFwcGxpZXMgdG8gZXZlcnkgQVBJIG1ldGhvZCB1bmlmb3JtbHkuIHByZWZpeCBpcyBkZWxpYmVyYXRlbHkgTk9UIHZhbGlkYXRlZDogcHJlZml4ZXMgbWF5IGJlIGVtcHR5IG9yIGVuZCB3aXRoIFwiL1wiLCBib3RoIGludmFsaWQgZm9yIHBhdGhzLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFzc2VydFZhbGlkQXJncyh0YXJnZXQ6IHVua25vd24sIGtleTogc3RyaW5nLCBkZXNjcmlwdG9yOiBQcm9wZXJ0eURlc2NyaXB0b3IpOiB2b2lkIHtcbiAgICBsZXQgb3JpZ2luYWwgPSBkZXNjcmlwdG9yLnZhbHVlIGFzICguLi5hcmdzOiB1bmtub3duW10pID0+IHVua25vd247XG4gICAgZGVzY3JpcHRvci52YWx1ZSA9IGZ1bmN0aW9uICguLi5hcmdzOiB1bmtub3duW10pOiB1bmtub3duIHtcbiAgICAgICAgbGV0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgeyBhY2NvdW50Pzogc3RyaW5nOyBidWNrZXROYW1lPzogc3RyaW5nOyBwYXRoPzogc3RyaW5nIH0gfCB1bmRlZmluZWQ7XG4gICAgICAgIGlmIChjb25maWcgJiYgdHlwZW9mIGNvbmZpZyA9PT0gXCJvYmplY3RcIikge1xuICAgICAgICAgICAgaWYgKFwiYWNjb3VudFwiIGluIGNvbmZpZykgYXNzZXJ0VmFsaWROYW1lKGNvbmZpZy5hY2NvdW50IGFzIHN0cmluZywgXCJhY2NvdW50XCIpO1xuICAgICAgICAgICAgaWYgKFwiYnVja2V0TmFtZVwiIGluIGNvbmZpZykgYXNzZXJ0VmFsaWROYW1lKGNvbmZpZy5idWNrZXROYW1lIGFzIHN0cmluZywgXCJidWNrZXQgbmFtZVwiKTtcbiAgICAgICAgICAgIGlmIChcInBhdGhcIiBpbiBjb25maWcpIGFzc2VydFZhbGlkUGF0aChjb25maWcucGF0aCBhcyBzdHJpbmcpO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBvcmlnaW5hbC5hcHBseSh0aGlzLCBhcmdzKTtcbiAgICB9O1xufVxuIl19
+ /* _JS_SOURCE_HASH = "52f73d0ef7e2f65848acc68373c50e34bd39c017c3ff908220fc66a6f3d0296f"; */

package/storage/remoteStorage/intermediateManagement.d.ts

@@ -0,0 +1,12 @@
+import { RemoteConfig } from "../IArchives";
+import { BucketState } from "./storageServerState";
+/** Called whenever a bucket's state is (re)built: arms the scans its upcoming window boundaries need. Each scan is scheduled once - the key includes the boundary it is for - so re-arming on every config change is harmless. */
+export declare function scheduleBoundaryWork(loaded: BucketState): void;
+/** An operator's config knows nothing about a switchover that is in flight right now, so writing it as-is would cancel one mid-handover. The in-flight windows are put back into it first. */
+export declare function reinjectIntermediates(current: RemoteConfig | undefined, incoming: RemoteConfig): RemoteConfig;
+/** Started by deployTakeover once we are actually a deploy successor listening on an alternate port. Until then there are no switchover windows to write or expire, so nothing polls. */
+export declare const startIntermediateMaintenance: {
+    (): void;
+    reset(): void;
+    set(newValue: void): void;
+};

package/storage/remoteStorage/intermediateManagement.ts

@@ -0,0 +1,264 @@
+import { lazy } from "socket-function/src/caching";
+import { runInfinitePoll } from "socket-function/src/batching";
+import { RemoteConfig, SourceConfig, HostedConfig } from "../IArchives";
+import { ROUTING_FILE, getConfigVersion, serializeRemoteConfig, parseHostedUrl, replaceHostedUrlPort } from "./remoteConfig";
+import { injectIntermediateSource, expireIntermediateSources, getIntermediateSources, nextIntermediateVersion, INTERMEDIATE_EXPIRE_GRACE } from "./intermediateSources";
+import { getTakeoverIntermediate } from "./deployTakeover";
+import { getStorageServerConfig } from "./serverConfig";
+import { createApiArchives, listServerActiveBucketKeys } from "./createArchives";
+import { findSelfIndexes, previousWindowOwners } from "./storePlan";
+import { BucketState, getBucketStates, getLoadedBucket, writeRoutingConfig } from "./storageServerState";
+import { DEFAULT_FAST_WRITE_DELAY } from "./ArchivesDelayed";
+import { WINDOW_END_FLUSH_MARGIN } from "./blobStore";
+
+// Deploy switchovers, and the handovers they cause. A switchover is a source moving to a new port for a few minutes: we give it a virtual valid window on that port (an "intermediate"), which means the write target changes twice in quick succession, which means the store taking over has to go and collect the writes that landed just before it did. None of that is storage - it is scheduling - so it lives here rather than in the store or in the server's bucket state.
+
+const MAX_TIMER_DELAY = 2 ** 31 - 1;
+const BOUNDARY_BUFFER = 1000;
+// A handover is scanned just before the boundary, just after, and again a little later - the last writes to the old target can land after the boundary itself
+const BOUNDARY_SCAN_OFFSETS = [-30 * 1000, 2 * 1000, 30 * 1000];
+// How far back a boundary scan asks for changes: everything that could still have been buffered when the window ended
+const BOUNDARY_SCAN_LOOKBACK = DEFAULT_FAST_WRITE_DELAY + WINDOW_END_FLUSH_MARGIN;
+const STARTUP_BOUNDARY_SCAN_DELAY = 30 * 1000;
+const OWN_CONFIG_WRITE_THROTTLE = 30 * 1000;
+const INTERMEDIATE_MAINTAIN_INTERVAL = 60 * 1000;
+
+const scheduledBoundaryScans = new Set<string>();
+const boundaryScansRunning = new Set<string>();
+
+/** Called whenever a bucket's state is (re)built: arms the scans its upcoming window boundaries need. Each scan is scheduled once - the key includes the boundary it is for - so re-arming on every config change is harmless. */
+export function scheduleBoundaryWork(loaded: BucketState): void {
+    let key = `${loaded.account}/${loaded.bucketName}`;
+    let now = Date.now();
+    let starts = new Set<number>();
+    for (let self of loaded.selfEntries) {
+        let start = self.validWindow[0];
+        if (start > now && start < Number.MAX_SAFE_INTEGER) {
+            starts.add(start);
+        }
+    }
+    // A window we have only just taken over, on a server that has only just started: the boundary happened while we were not running, so its scan still has to happen
+    for (let self of loaded.selfEntries) {
+        let [start, end] = self.validWindow;
+        if (!(start <= now && now < end) || start <= 0) continue;
+        if (now - start > BOUNDARY_SCAN_LOOKBACK) continue;
+        let scheduleKey = `${key}|${start}|startup`;
+        if (scheduledBoundaryScans.has(scheduleKey)) continue;
+        scheduledBoundaryScans.add(scheduleKey);
+        let timer = setTimeout(() => {
+            void runBoundaryScan(loaded, start, STARTUP_BOUNDARY_SCAN_DELAY, "startup+30s").catch((e: Error) => console.error(`Boundary scan for bucket ${key} failed: ${e.stack ?? e}`));
+        }, STARTUP_BOUNDARY_SCAN_DELAY);
+        (timer as { unref?: () => void }).unref?.();
+    }
+    for (let start of starts) {
+        for (let offset of BOUNDARY_SCAN_OFFSETS) {
+            let at = start + offset;
+            if (at <= now) continue;
+            let scheduleKey = `${key}|${start}|${offset}`;
+            if (scheduledBoundaryScans.has(scheduleKey)) continue;
+            scheduledBoundaryScans.add(scheduleKey);
+            // Re-armed rather than trusted: a long timer can fire early after a suspend, and firing early would scan for a handover that has not happened
+            let arm = () => {
+                let timer = setTimeout(() => {
+                    if (Date.now() < at) {
+                        arm();
+                        return;
+                    }
+                    void runBoundaryScan(loaded, start, offset).catch((e: Error) => console.error(`Boundary scan for bucket ${key} failed: ${e.stack ?? e}`));
+                }, Math.min(at - Date.now(), MAX_TIMER_DELAY));
+                (timer as { unref?: () => void }).unref?.();
+            };
+            arm();
+        }
+    }
+}
+
+/** Collects the writes that landed on the previous window's owners just before a boundary, into the store that has just taken over. Who owned what is worked out purely from the config (see previousWindowOwners); this only does the pulling. */
+async function runBoundaryScan(loaded: BucketState, windowStart: number, offset: number, offsetLabel?: string): Promise<void> {
+    let key = `${loaded.account}/${loaded.bucketName}`;
+    let label = `bucket ${key}, window starting ${new Date(windowStart).toISOString()}, offset ${offsetLabel || `${offset / 1000}s`}`;
+    if (boundaryScansRunning.has(key)) {
+        console.log(`Skipping boundary scan (${label}): the previous boundary scan is still running`);
+        return;
+    }
+    boundaryScansRunning.add(key);
+    try {
+        let effective = loaded.routing;
+        if (!effective) return;
+        let handovers = previousWindowOwners(effective, windowStart, findSelfIndexes(effective, loaded.account, loaded.bucketName));
+        if (!handovers.length) return;
+        console.log(`Boundary scan (${label}): ${handovers.length} route(s) taking over: ${handovers.map(x => `${JSON.stringify(x.route)} from ${x.scanOwnDisk && "our own disk" || ""}${x.scanOwnDisk && x.remotes.size && " + " || ""}${[...x.remotes.keys()].map(i => `source ${i}`).join(", ")}`).join("; ")}`);
+        let since = windowStart - BOUNDARY_SCAN_LOOKBACK;
+        for (let handover of handovers) {
+            let selfStore = loaded.stores.find(x => x.name === handover.name);
+            if (!selfStore) continue;
+            if (handover.scanOwnDisk) {
+                await selfStore.store.rescanBase();
+            }
+            for (let [sourceIndex, route] of handover.remotes) {
+                let ownerSource = effective.sources[sourceIndex];
+                if (typeof ownerSource === "string") continue;
+                try {
+                    await selfStore.store.boundaryScanRemote(createApiArchives(ownerSource), { since, route });
+                } catch (e) {
+                    console.error(`Boundary scan (${label}) of previous-window owner (source index ${sourceIndex}) failed: ${(e as Error).stack ?? e}`);
+                }
+            }
+        }
+    } finally {
+        boundaryScansRunning.delete(key);
+    }
+}
+
+/** An operator's config knows nothing about a switchover that is in flight right now, so writing it as-is would cancel one mid-handover. The in-flight windows are put back into it first. */
+export function reinjectIntermediates(current: RemoteConfig | undefined, incoming: RemoteConfig): RemoteConfig {
+    if (!current) return incoming;
+    let stored = incoming;
+    let reinjected = 0;
+    for (let intermediate of getIntermediateSources(expireIntermediateSources(current, Date.now()))) {
+        stored = injectIntermediateSource(stored, {
+            splitUrl: intermediate.intermediate || intermediate.url,
+            intermediateUrl: intermediate.url,
+            start: intermediate.validWindow[0],
+            end: intermediate.validWindow[1],
+        });
+        reinjected++;
+    }
+    if (reinjected) {
+        console.log(`Re-injected ${reinjected} in-flight switchover window(s) into an incoming routing config (version ${getConfigVersion(incoming)})`);
+    }
+    return stored;
+}
+
+// Per bucket, not global: a switchover has to write every bucket's windows at once, and a shared throttle would let only one bucket through per interval
+const lastOwnConfigWrite = new Map<string, number>();
+
+async function writeOwnRoutingConfig(loaded: BucketState, updated: RemoteConfig, reason: string): Promise<void> {
+    let key = `${loaded.account}/${loaded.bucketName}`;
+    let sinceLast = Date.now() - (lastOwnConfigWrite.get(key) || 0);
+    if (sinceLast < OWN_CONFIG_WRITE_THROTTLE) {
+        console.log(`Not writing our own routing config update for bucket ${key} (${reason}): the last one was ${sinceLast}ms ago, under the ${OWN_CONFIG_WRITE_THROTTLE}ms throttle. Retrying on the next maintenance pass.`);
+        return;
+    }
+    lastOwnConfigWrite.set(key, Date.now());
+    // A switchover writes on top of whatever the bucket is running; with no config at all there is nothing to switch over
+    if (!loaded.routing) return;
+    let currentVersion = getConfigVersion(loaded.routing);
+    let version = nextIntermediateVersion(currentVersion);
+    let next: RemoteConfig = { ...updated, version };
+    console.log(`Writing ${ROUTING_FILE} for bucket ${key} (${reason}), version ${currentVersion} -> ${version}: ${JSON.stringify(next)}`);
+    let data = Buffer.from(serializeRemoteConfig(next));
+    // Into one of our own stores - it applies it and its peers pull it - and directly to the other servers, which is what makes a switchover take effect in seconds rather than at the next poll
+    let ourStore = loaded.stores[0];
+    if (ourStore) {
+        await writeRoutingConfig(loaded.account, loaded.bucketName, ourStore.name, data);
+    }
+    await propagateRoutingConfig(loaded, next, data);
+}
+
+async function propagateRoutingConfig(loaded: BucketState, next: RemoteConfig, data: Buffer): Promise<void> {
+    let targets = new Map<string, SourceConfig>();
+    for (let source of [...loaded.routing?.sources || [], ...next.sources]) {
+        if (typeof source === "string" || source.intermediate) continue;
+        if (source.type === "remote") {
+            let parsed = parseHostedUrl(source.url);
+            if (parsed.account !== loaded.account || parsed.bucketName !== loaded.bucketName) continue;
+        }
+        if (targets.has(source.url)) continue;
+        targets.set(source.url, source);
+    }
+    for (let [url, source] of targets) {
+        try {
+            await createApiArchives(source).set(ROUTING_FILE, data);
+            console.log(`Wrote ${ROUTING_FILE} for bucket ${loaded.account}/${loaded.bucketName} to ${url}`);
+        } catch (e) {
+            console.error(`Propagating our routing config update to ${url} failed: ${(e as Error).stack ?? e}`);
+        }
+    }
+}
+
+/** Keeps every loaded bucket's switchover windows current: gives our alternate port its window while a takeover is in flight, and takes expired ones back out. */
+async function maintainIntermediates(): Promise<void> {
+    let { domain, port } = getStorageServerConfig();
+    let takeover = getTakeoverIntermediate();
+    let written: string[] = [];
+    let alreadyCorrect: string[] = [];
+    let notOurs: string[] = [];
+    // ONLY buckets already in memory. A switchover must never load a bucket: loading starts its synchronization, and buckets nothing has touched (legacy ones especially) have no writes to hand off in the first place. One that does get used mid-switchover loads on that access, and the next pass gives it its window.
+    let states = getBucketStates();
+    for (let loaded of states) {
+        let key = `${loaded.account}/${loaded.bucketName}`;
+        let routing = loaded.routing;
+        if (!routing) continue;
+        let expired = expireIntermediateSources(routing, Date.now());
+        if (JSON.stringify(expired) !== JSON.stringify(routing)) {
+            await writeOwnRoutingConfig(loaded, expired, `switchover windows expired more than ${INTERMEDIATE_EXPIRE_GRACE / 1000}s ago`);
+            written.push(key);
+            continue;
+        }
+        if (!takeover) continue;
+        let mainUrl = routing.sources.find(x => {
+            if (typeof x === "string" || x.type !== "remote" || x.intermediate) return false;
+            let parsed = parseHostedUrl(x.url);
+            return parsed.address === domain && parsed.port === port;
+        }) as HostedConfig | undefined;
+        if (!mainUrl) {
+            notOurs.push(key);
+            continue;
+        }
+        let injected = injectIntermediateSource(routing, {
+            splitUrl: mainUrl.url,
+            intermediateUrl: replaceHostedUrlPort(mainUrl.url, takeover.altPort),
+            start: takeover.start,
+            end: takeover.end,
+        });
+        if (JSON.stringify(injected) === JSON.stringify(routing)) {
+            alreadyCorrect.push(key);
+            continue;
+        }
+        await writeOwnRoutingConfig(loaded, injected, `we are a deploy successor: writes route to our alternate port ${takeover.altPort} from ${new Date(takeover.start).toISOString()} until our predecessor is killed at ${new Date(takeover.end).toISOString()}`);
+        written.push(key);
+    }
+    if (!takeover) return;
+    if (!states.length) {
+        console.log(`No active buckets, so no config files to write the intermediate into (a bucket is only active once something uses it)`);
+        return;
+    }
+    if (!written.length) {
+        console.log(`Wrote no config files: of ${states.length} active buckets, ${alreadyCorrect.length} already contain the intermediate and ${notOurs.length} are not hosted by us`);
+    }
+}
+
+/** Our predecessor still holds the main port and has been serving all along, so it - not us - knows which buckets are in use. We activate exactly those, which is what makes their config files get the intermediate; nothing else on disk is touched. */
+async function activatePredecessorBuckets(): Promise<void> {
+    let { domain, port } = getStorageServerConfig();
+    let url = `https://${domain}:${port}`;
+    let keys: { account: string; bucketName: string }[];
+    try {
+        keys = await listServerActiveBucketKeys({ url });
+    } catch (e) {
+        console.error(`Could not ask our predecessor on ${url} which buckets are active, so only buckets used on this process get the intermediate: ${(e as Error).stack ?? e}`);
+        return;
+    }
+    if (!keys.length) {
+        console.log(`Our predecessor on ${url} has no active buckets, so there are no config files to write the intermediate into`);
+        return;
+    }
+    console.log(`Our predecessor on ${url} has ${keys.length} active buckets, activating them here so their config files get the intermediate: ${keys.map(x => `${x.account}/${x.bucketName}`).join(", ")}`);
+    for (let { account, bucketName } of keys) {
+        try {
+            await getLoadedBucket(account, bucketName);
+        } catch (e) {
+            console.error(`Activating bucket ${account}/${bucketName} (active on our predecessor) failed: ${(e as Error).stack ?? e}`);
+        }
+    }
+}
+
+/** Started by deployTakeover once we are actually a deploy successor listening on an alternate port. Until then there are no switchover windows to write or expire, so nothing polls. */
+export const startIntermediateMaintenance = lazy(() => {
+    void (async () => {
+        await activatePredecessorBuckets();
+        await maintainIntermediates();
+    })().catch((e: Error) => console.error(`Writing the intermediate into the config files failed: ${e.stack ?? e}`));
+    runInfinitePoll(INTERMEDIATE_MAINTAIN_INTERVAL, maintainIntermediates);
+});

package/storage/remoteStorage/remoteConfig.d.ts

@@ -26,7 +26,39 @@ export declare function parseBackblazeUrl(url: string): {
     bucketName: string;
 };
 export declare function replaceHostedUrlPort(url: string, port: number): string;
+/**
+ * Puts a source into the shape the code expects. It does NOT judge it: this runs every time a config
+ * is READ, and a config that is already on disk has to keep working - a server that cannot parse its
+ * own routing file is a server that cannot serve, and it would stay that way forever. Anything
+ * missing or unusable is filled in with the safest equivalent instead, loudly where it matters.
+ *
+ * Judging happens on the way IN, in assertValidRemoteConfig.
+ */
 export declare function normalizeSource(source: RemoteConfigBase): SourceConfig;
+/** Puts a whole config into the shape the code expects, without judging it - see normalizeSource, and see assertValidRemoteConfig for the judging. */
 export declare function normalizeRemoteConfig(config: RemoteConfig | RemoteConfigBase): RemoteConfig;
+/**
+ * Whether a config may be WRITTEN. Everything here is a rule about the config as a whole, which is
+ * exactly why it cannot run on read: a config that is already stored somewhere has to keep being
+ * readable, or a server that once accepted a bad one could never start again. Rejecting it at the
+ * point it is introduced is what keeps a bad one from ever being stored in the first place.
+ */
+export declare function assertValidRemoteConfig(config: RemoteConfig): void;
+/**
+ * The identity of one of a store's SOURCE SLOTS - which is the endpoint it talks to, and not the same
+ * question as which store this is (that is CommonConfig.name). A switchover's alternate port is a
+ * distinct slot even though it names the same storage, because a slot holds a connection to a port.
+ *
+ * ONLY the type, the url, and the intermediate's alternate port are part of it: everything else is
+ * policy about how we USE the endpoint, and changing policy must never make a store believe it is
+ * looking at a NEW source - that would drop every index entry the old one held and rescan it from
+ * scratch, so the files it holds go missing from listings until the rescan finishes, for a flag flip.
+ *
+ * Built by hand rather than by serializing the config, so it cannot change just because the routing
+ * file was written with its keys in a different order.
+ */
+export declare function sourceIdentity(sourceConfig: SourceConfig | undefined): string;
+/** What an index entry records as the holder of its bytes (see ArchivesSource.url), so it must name the endpoint FOREVER. An intermediate is a switchover's temporary alternate port onto another source, and that port is gone for good once its window passes - so it is recorded as the source it was split out of, which holds the same bucket and outlives it. */
+export declare function sourcePersistentUrl(sourceConfig: SourceConfig | undefined, folder: string): string;
 export declare function parseRoutingData(data: Buffer): RemoteConfig;
 export declare function serializeRemoteConfig(config: RemoteConfig): Buffer;

package/storage/remoteStorage/remoteConfig.ts

@@ -3,6 +3,7 @@ import { getBufferInt } from "socket-function/src/bits";
 import { setFlag } from "socket-function/require/compileFlags";
 import jsSha256 from "js-sha256";
 import { RemoteConfig, RemoteConfigBase, SourceConfig, ArchiveFileInfo, ChangesAfterConfig, FULL_VALID_WINDOW, FULL_ROUTE, VARIABLE_SHARD } from "../IArchives";
+import { assertValidSourceName } from "./validation";
 
 setFlag(require, "js-sha256", "allowclient", true);
 
@@ -109,38 +110,86 @@ export function replaceHostedUrlPort(url: string, port: number): string {
     return u.toString();
 }
 
+/**
+ * Puts a source into the shape the code expects. It does NOT judge it: this runs every time a config
+ * is READ, and a config that is already on disk has to keep working - a server that cannot parse its
+ * own routing file is a server that cannot serve, and it would stay that way forever. Anything
+ * missing or unusable is filled in with the safest equivalent instead, loudly where it matters.
+ *
+ * Judging happens on the way IN, in assertValidRemoteConfig.
+ */
 export function normalizeSource(source: RemoteConfigBase): SourceConfig {
     if (typeof source !== "string") {
-        let window = source.validWindow;
-        if (!Array.isArray(window) || window.length !== 2 || !window.every(x => typeof x === "number")) {
-            throw new Error(`Object source configs must specify validWindow ([startMs, endMs] of the write times the source is valid for) - configuration changes must be scheduled, not flipped instantly. Use FULL_VALID_WINDOW when the source is always valid. Was ${JSON.stringify(window)} on ${JSON.stringify(source).slice(0, 500)}`);
-        }
-        let route = source.route;
-        if (route !== undefined && (!Array.isArray(route) || route.length !== 2 || !route.every(x => typeof x === "number") || route[0] < 0 || route[1] > 1 || route[0] >= route[1])) {
-            throw new Error(`Source route must be a [start, end) fraction range within [0, 1] with start < end, was ${JSON.stringify(route)} on ${JSON.stringify(source).slice(0, 500)}`);
-        }
-        if (source.readerDiskLimit !== undefined) {
-            if (typeof source.readerDiskLimit !== "number" || source.readerDiskLimit <= 0) {
-                throw new Error(`readerDiskLimit must be a positive byte count, was ${JSON.stringify(source.readerDiskLimit)} on ${JSON.stringify(source).slice(0, 500)}`);
-            }
-            if (!source.noFullSync) {
-                throw new Error(`readerDiskLimit requires noFullSync: a full copy cannot be bounded, only a read cache can. On ${JSON.stringify(source).slice(0, 500)}`);
+        let normalized = { ...source };
+        // Configs written before names existed have none, and a name that could not be a folder cannot be used as one. Both get the derived name: deterministic, so every server picks the same one for the same entry.
+        if (!isUsableSourceName(normalized.name)) {
+            let derived = derivedSourceName(normalized);
+            if (normalized.name !== undefined) {
+                console.error(`Source name ${JSON.stringify(normalized.name)} in a routing config cannot be used as a folder name, so this entry is being read as ${JSON.stringify(derived)}: ${JSON.stringify(source).slice(0, 500)}`);
             }
+            normalized.name = derived;
         }
-        if (source.type === "remote") {
-            // Throws if the URL is malformed, so bad configs are rejected before they're stored
-            parseHostedUrl(source.url);
+        let window = normalized.validWindow;
+        if (!Array.isArray(window) || window.length !== 2 || !window.every(x => typeof x === "number")) {
+            console.error(`Source ${JSON.stringify(normalized.name)} has no usable validWindow (${JSON.stringify(window)}), reading it as always valid: ${JSON.stringify(source).slice(0, 500)}`);
+            normalized.validWindow = FULL_VALID_WINDOW;
+        }
+        let route = normalized.route;
+        if (route !== undefined && !isUsableRoute(route)) {
+            console.error(`Source ${JSON.stringify(normalized.name)} has an unusable route (${JSON.stringify(route)}), reading it as the whole key space: ${JSON.stringify(source).slice(0, 500)}`);
+            normalized.route = undefined;
         }
-        return source;
+        return normalized;
     }
     let hostname = new URL(source).hostname;
     if (hostname.endsWith(".backblazeb2.com")) {
         // Validates the URL (throws on malformed) before it's stored; the bucket name is read back out of the URL at use sites, never stored on the config.
-        parseBackblazeUrl(source);
-        return { type: "backblaze", url: source, validWindow: FULL_VALID_WINDOW, public: true };
+        let parsed = parseBackblazeUrl(source);
+        return { type: "backblaze", url: source, name: sanitizeSourceName(parsed.bucketName), validWindow: FULL_VALID_WINDOW, public: true };
+    }
+    let parsed = parseHostedUrl(source);
+    return { type: "remote", url: source, name: sanitizeSourceName(`${parsed.address}-${parsed.port}`), validWindow: FULL_VALID_WINDOW, public: true };
+}
+
+function isUsableSourceName(name: string | undefined): boolean {
+    if (!name) return false;
+    try {
+        assertValidSourceName(name);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+function isUsableRoute(route: [number, number]): boolean {
+    if (!Array.isArray(route) || route.length !== 2 || !route.every(x => typeof x === "number")) return false;
+    return route[0] >= 0 && route[1] <= 1 && route[0] < route[1];
+}
+
+/** The name an entry gets when it has no usable one of its own: the endpoint it points at, plus its route when it has one - so entries that were distinct storage before names existed stay distinct now. */
+function derivedSourceName(source: SourceConfig): string {
+    let endpoint = source.url;
+    if (source.type === "remote") {
+        let parsed = parseHostedUrl(source.url);
+        endpoint = `${parsed.address}-${parsed.port}`;
+    } else {
+        endpoint = parseBackblazeUrl(source.url).bucketName;
+    }
+    let route = source.route;
+    if (route && isUsableRoute(route) && !(route[0] === FULL_ROUTE[0] && route[1] === FULL_ROUTE[1])) {
+        endpoint += `-route-${route[0]}-${route[1]}`;
+    }
+    return sanitizeSourceName(endpoint);
+}
+
+/** A name built from something that was never meant to be one (a host, a bucket), made usable as a folder. Periods survive, so it still reads as what it came from. */
+function sanitizeSourceName(from: string): string {
+    let name = from.replace(/[^\w.-]/g, "-").slice(0, 64);
+    if (!isUsableSourceName(name)) {
+        // Only reachable from something with no usable characters at all; the name still has to exist
+        return "source";
     }
-    parseHostedUrl(source);
-    return { type: "remote", url: source, validWindow: FULL_VALID_WINDOW, public: true };
+    return name;
 }
 
 /** How far up from 0 the sources' routes reach without a gap (1 means the whole key space). */
@@ -155,15 +204,23 @@ function getRouteCoverage(sources: SourceConfig[]): number {
     return covered;
 }
 
+/** Puts a whole config into the shape the code expects, without judging it - see normalizeSource, and see assertValidRemoteConfig for the judging. */
 export function normalizeRemoteConfig(config: RemoteConfig | RemoteConfigBase): RemoteConfig {
-    let result: RemoteConfig;
     if (typeof config !== "string" && "sources" in config) {
-        result = { version: config.version, sources: config.sources.map(normalizeSource) };
-    } else {
-        result = { sources: [normalizeSource(config)] };
+        return { version: config.version, sources: config.sources.map(normalizeSource) };
     }
+    return { sources: [normalizeSource(config)] };
+}
+
+/**
+ * Whether a config may be WRITTEN. Everything here is a rule about the config as a whole, which is
+ * exactly why it cannot run on read: a config that is already stored somewhere has to keep being
+ * readable, or a server that once accepted a bad one could never start again. Rejecting it at the
+ * point it is introduced is what keeps a bad one from ever being stored in the first place.
+ */
+export function assertValidRemoteConfig(config: RemoteConfig): void {
+    let sources = config.sources.map(normalizeSource);
     // Mixed immutability makes no sense AMONG sources valid at the same time: a mutable source would accept overwrites that its immutable peers refuse to synchronize, forking their contents. Sources are grouped by transitively overlapping valid windows (absorb everything overlapping the group, extend the group's end, repeat) - a soft check that is correct as long as windows have clean breaks (a group ends exactly where the next begins).
-    let sources = result.sources.map(normalizeSource);
     let sorted = [...sources];
     sort(sorted, x => x.validWindow[0]);
     let group: typeof sources = [];
@@ -178,22 +235,7 @@ export function normalizeRemoteConfig(config: RemoteConfig | RemoteConfigBase):
         if (covered < 1) {
             throw new Error(`Sources with overlapping valid windows must cover the full route space [0, 1); coverage stops at ${covered}. Sources: ${JSON.stringify(group.map(x => ({ url: x.url, validWindow: x.validWindow, route: x.route || FULL_ROUTE })))}`);
         }
-        // Every bucket must ALSO cover the full route space across its own entries, because all of a bucket's entries share one disk. A bucket that only ever synchronizes part of the key space never learns about deletions in the rest of it - and tombstones expire, so files it still holds from a route it no longer serves eventually look like live files again, and get resurrected into the chain by its next scan. An entry with no route (implicitly the full space) satisfies this on its own, which is why the usual configuration lists each bucket once per shard AND once unsharded.
-        let byUrl = new Map<string, typeof group>();
-        for (let source of group) {
-            let entries = byUrl.get(source.url);
-            if (!entries) {
-                entries = [];
-                byUrl.set(source.url, entries);
-            }
-            entries.push(source);
-        }
-        for (let [url, entries] of byUrl) {
-            let urlCovered = getRouteCoverage(entries);
-            if (urlCovered < 1) {
-                throw new Error(`Every bucket must cover the full route space [0, 1) across its own entries with overlapping valid windows, but ${url} only covers up to ${urlCovered} (its routes: ${JSON.stringify(entries.map(x => x.route || FULL_ROUTE))}). Add an entry for it with no route (or entries whose routes span the rest), alongside its sharded entries. This is enforced because a bucket's entries all share one disk: if it only ever synchronizes part of the key space, it never sees deletions in the rest, and once those tombstones expire the files it still holds are resurrected into the chain by its next scan.`);
-            }
-        }
+        // A store is NOT required to cover the whole key space on its own. It once was, because a store that holds keys outside the route it synchronizes never learns of their deletions and eventually resurrects them - but a store's data now lives under its name rather than its route, and a scan only ever indexes keys inside the route the store is configured for, so keys outside it are never taken into the index that could resurrect them. What replaces that rule is the naming discipline: a name is one storage, and pointing a name at a different route later is what would hand it keys it never synchronized.
     }
     for (let source of sorted) {
         if (group.length && source.validWindow[0] >= groupEnd) {
@@ -204,23 +246,46 @@ export function normalizeRemoteConfig(config: RemoteConfig | RemoteConfigBase):
         groupEnd = Math.max(groupEnd, source.validWindow[1]);
     }
     checkGroup();
-    // Two entries with the EXACT same URL and the SAME route may never be valid at the same time: on that server the route maps to exactly one on-disk folder and one store, so simultaneous duplicates would collide on it. A different port is a different server. Non-overlapping windows are fine; that is how transitions between windows work.
+    // ONE entry per store at any instant. A name is a store - one folder, one index - so two entries naming it at the same time would be two answers to "what is this store configured to be right now", and every route and flag it reads would depend on which entry you happened to look at. Non-overlapping windows are fine, and are how a store's configuration changes over time.
     for (let i = 0; i < sources.length; i++) {
         for (let j = i + 1; j < sources.length; j++) {
             let a = sources[i];
             let b = sources[j];
-            if (sourceRouteIdentity(a) !== sourceRouteIdentity(b)) continue;
+            if (storeIdentity(a) !== storeIdentity(b)) continue;
             if (a.validWindow[0] < b.validWindow[1] && b.validWindow[0] < a.validWindow[1]) {
-                throw new Error(`Two sources with the same URL have the same route with overlapping valid windows - on that server the route maps to one on-disk folder, so these would collide. Give same-route entries non-overlapping windows instead. Conflicting: ${JSON.stringify(a)} and ${JSON.stringify(b)}`);
+                throw new Error(`The name ${JSON.stringify(a.name)} is reused with multiple source configurations at the same time:\n    ${JSON.stringify(a)}\n    ${JSON.stringify(b)}\nA name is one store - one folder, one index - so it can only be configured one way at a time. Give them non-overlapping valid windows, or different names if they are meant to be different storage.`);
             }
         }
     }
-    return result;
 }
 
-/** The per-store identity of a source: its exact URL plus its route. Entries sharing this identity map to the same store/folder on the same server, so they may never overlap in time (see normalizeRemoteConfig). */
-function sourceRouteIdentity(source: SourceConfig): string {
-    return `${source.url}|${JSON.stringify(source.route || FULL_ROUTE)}`;
+/**
+ * The identity of one of a store's SOURCE SLOTS - which is the endpoint it talks to, and not the same
+ * question as which store this is (that is CommonConfig.name). A switchover's alternate port is a
+ * distinct slot even though it names the same storage, because a slot holds a connection to a port.
+ *
+ * ONLY the type, the url, and the intermediate's alternate port are part of it: everything else is
+ * policy about how we USE the endpoint, and changing policy must never make a store believe it is
+ * looking at a NEW source - that would drop every index entry the old one held and rescan it from
+ * scratch, so the files it holds go missing from listings until the rescan finishes, for a flag flip.
+ *
+ * Built by hand rather than by serializing the config, so it cannot change just because the routing
+ * file was written with its keys in a different order.
+ */
+export function sourceIdentity(sourceConfig: SourceConfig | undefined): string {
+    if (!sourceConfig) return "disk";
+    return `${sourceConfig.type}|${sourceConfig.url}|${sourceConfig.intermediate || ""}`;
+}
+
+/** What an index entry records as the holder of its bytes (see ArchivesSource.url), so it must name the endpoint FOREVER. An intermediate is a switchover's temporary alternate port onto another source, and that port is gone for good once its window passes - so it is recorded as the source it was split out of, which holds the same bucket and outlives it. */
+export function sourcePersistentUrl(sourceConfig: SourceConfig | undefined, folder: string): string {
+    if (!sourceConfig) return folder;
+    return sourceConfig.intermediate || sourceConfig.url;
+}
+
+/** Which store an entry configures: its name, on the server it points at. A switchover's alternate port is the same server (so it is compared against the entry it was split out of, whose window it must not overlap); a genuinely different server with the same name is a different store, on a different machine. */
+function storeIdentity(source: SourceConfig): string {
+    return `${source.intermediate || source.url}|${source.name}`;
 }
 
 export function parseRoutingData(data: Buffer): RemoteConfig {

package/storage/remoteStorage/serverConfig.d.ts

@@ -23,5 +23,5 @@ export declare function setTrustedMachines(config: {
 }): Promise<void>;
 export declare function addExtraListenPort(port: number): void;
 export declare function removeExtraListenPort(port: number): void;
-/** Whether address:port is this server process. The ONE self test - findSelfIndexes, createApiArchives, and SourceWrapper all consult it, so "is this me" cannot disagree between the routing plan and connection building: a URL that is us on an extra listen port must never become a network client to ourselves, which is how infinite self-request loops form. */
+/** Whether address:port is this server process, including its extra listen ports (a deploy switchover's alternate port is still us). Used to tell which config entries are OUR copy of a bucket - the stores we run - as opposed to peers we synchronize with. Talking to ourselves is not one of the things it prevents: a source that happens to be us is reached over the API like any other. */
 export declare function isOwnAddress(address: string, port: number): boolean;