Cloud Sync Module

Authoring a cloudSyncModule.ts

A module reconciles LocalState (what the app holds, from Redux) with DistantState (what is stored encrypted in Cloud Sync). createAggregator composes every module into one blob shared by all of the user's instances (LWD, LWM, web-tools).

Concepts: 05-wallet-sync-data-manager, then 06-watch-loop for when each hook fires. Steps and a video: cookbook. Testing layers: test-strategy. Contract: @shared/cloud-sync-module. Copy account-name (simplest); accounts for async + injected ctx; recent-addresses for the tolerant-list schema only — its .transform() use is a known bug (see below).

The three hooks

Live under domain/entity/<name>/src/cloudSyncModule.ts beside schema.ts + slice.ts (see domain/entity/README.md). Type it CloudSyncDataManager<LocalState, Update, typeof schema>, with hasChanges: false as const so the union narrows. A 4th generic DistantState defaults to z.infer<Schema> — pass the raw wire type explicitly if your schema transforms, since that is what the hooks actually receive.

Invariants — break one and the loop misbehaves

1. resolveIncrementalUpdate short-circuits on incoming == null, on incoming === latest, and on incoming being content-equal to local. The reference check alone only covers makeLocalIncrementalUpdate, which passes one object as both args every tick; every pull hands you a freshly decrypted one (incrementalUpdates.ts, makeSaveNewUpdate). Without the content check, an unchanged pull dispatches → re-renders → pushes, forever.
2. diffLocalToDistant(emptyLocal, null) → hasChanges: false, or every user who never touched the feature creates Cloud Sync data on first launch.
3. Stability: re-diffing against your own nextState yields hasChanges: false. No Date.now(), no random ids, no unstable key order.
4. Round-trip: the comparator must ignore any field applyUpdate cannot reproduce exactly (recent-addresses stores lastUsed but never compares it — comparing it would loop forever).
5. Convergence: after applyUpdate from an incoming state, diffing against that state reports no changes.
6. Purity: LocalState comes from Redux and is Immer-frozen. Never mutate — return new objects.

Risks to evaluate before writing a line

• Wiping every instance's data. Persist LocalState with the same lifetime as walletSyncState.version (exportWalletState / importWalletState, both apps). Otherwise a restart finds the version "up-to-date", never pulls, and diffLocalToDistant(empty, latest) pushes an empty state that deletes the data everywhere.
• A too-strict schema kills sync, or overwrites data. CloudSyncSDK parses the whole aggregate on every pull and push, so one module rejecting another version's payload stops sync for accounts, names, everything. On the persisted path parseDistantState (walletSyncComposition.ts) safeParses and returns null instead — which the loop reads as "no distant state" and pushes over. Stay permissive: optional fields, z.unknown() + safeParse-and-filter for lists, never .strict().
• A .transform()'s output is discarded in production. Both call sites above do parse — the transform executes — then pass the raw JSON on, to preserve unknown fields. Hooks therefore get un-normalised data typed as the transform's output, a lie TypeScript will not catch; normalise in the hooks instead. The contract suite won't catch it either: it only ever replays states your own diffLocalToDistant produced (the idempotence case runs one back through schema.parse()), never the legacy payload an older version actually wrote.
• No migrations, ever. The wire format is permanent and shared across app versions: add optional fields only, never rename, repurpose or require a key. Rebuilding nextState from scratch (account-name, recent-addresses) is safe only while your subtree is a total function of LocalState — once it can carry a field you don't own, apply your diff on top of latest as accounts does, or you silently delete the other version's data. recent-addresses already violates this: it drops the ensName its own schema declares.
• Payload and privacy. One blob holds every module: store the minimum needed to restore the state (descriptors, ids), nothing refetchable, no raw device/user ids (client-ids).
• Async blocks the loop. resolveIncrementalUpdate runs inside the pull's atomic lock. Network work must be batched and recoverable — see accounts' nonImportedAccountInfos + backoff queue.
• Injected dependencies? The interface has no ctx: export a bindCtx(ctx) factory, as accounts does.