@agent-native/core 0.207.1 → 0.207.2-nightly-20261013011333

package/dist/client/action-query-cache.js

@@ -2,11 +2,11 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { persistQueryClient, } from "@tanstack/query-persist-client-core";
 import { IsRestoringProvider, useQueryClient, } from "@tanstack/react-query";
 import { clear as clearStore, createStore, del as deleteEntry, get as getEntry, keys as listKeys, set as setEntry, } from "idb-keyval";
-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import { actionErrorStatus } from "./action-failure-circuit.js";
 import { clientBuildId } from "./build-compatibility.js";
-import { isBrowserPersistableActionQuery, markRestoredBrowserPersistableActionQuery, revokeBrowserPersistableActionQuery, } from "./use-action.js";
-import { useSession } from "./use-session.js";
+import { getAccessDeniedActionQueryBinding, isBrowserPersistableActionQueryForBinding, markRestoredBrowserPersistableActionQuery, registerActionQueryCacheRevoker, revokeBrowserPersistableActionQuery, setActionQueryCacheBindingToken, } from "./use-action.js";
+import { isSessionFromFirstRead, useSession } from "./use-session.js";
 // Bump when a cached result's shape or meaning changes. A record stored under
 // another buster is discarded on restore instead of being hydrated.
 const ACTION_QUERY_CACHE_BUSTER = "action-query-cache-v1";
@@ -17,7 +17,18 @@ const WRITE_DELAY_MS = 1_000;
 // Restoring holds every query, so a store that never answers must not hold
 // the app.
 const RESTORE_TIMEOUT_MS = 2_000;
+const INITIAL_CLEAR_TIMEOUT_MS = 2_000;
+const BIND_WAIT_BUDGET_MS = 2_000;
 const ACTION_QUERY_KEY = ["action"];
+function isAccessDeniedActionQuery(query) {
+    if (query.queryKey[0] !== "action")
+        return false;
+    const status = actionErrorStatus(query.state.error);
+    return status === 401 || status === 403 || status === 404;
+}
+function clearAccessDeniedActionQueryData(query) {
+    query.setState({ data: undefined, dataUpdatedAt: 0 });
+}
 const indexedDbStore = createStore("agent-native-action-query-cache", "queries");
 const indexedDbStorage = {
     get: (key) => getEntry(key, indexedDbStore),
@@ -27,6 +38,207 @@ const indexedDbStorage = {
     clear: () => clearStore(indexedDbStore),
 };
 let storage = indexedDbStorage;
+let storageClearGeneration = 0;
+let storageClearInFlight;
+let storageClearRequired = false;
+let bindAttemptGeneration = 0;
+const inFlightStorageWrites = new Set();
+const inFlightStorageDeletes = new Set();
+const failedStorageDeleteScopes = new Set();
+const CACHE_EPOCH_KEY = "agent-native.action-query-cache.epoch";
+const CLEAR_INTENT_PREFIX = "agent-native.action-query-cache.clear-required:";
+let cacheSafetyUnavailable = false;
+function newCacheToken() {
+    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+function readCacheSafetyState(probeWrite = false) {
+    if (cacheSafetyUnavailable || typeof window === "undefined")
+        return undefined;
+    try {
+        const local = window.localStorage;
+        let epoch = local.getItem(CACHE_EPOCH_KEY);
+        if (!epoch) {
+            epoch = newCacheToken();
+            local.setItem(CACHE_EPOCH_KEY, epoch);
+            if (local.getItem(CACHE_EPOCH_KEY) !== epoch) {
+                cacheSafetyUnavailable = true;
+                return undefined;
+            }
+        }
+        else if (probeWrite) {
+            const probeKey = `${CACHE_EPOCH_KEY}.probe:${newCacheToken()}`;
+            const probeValue = newCacheToken();
+            try {
+                local.setItem(probeKey, probeValue);
+                if (local.getItem(probeKey) !== probeValue) {
+                    throw new Error("Unable to verify cache epoch storage access");
+                }
+            }
+            finally {
+                local.removeItem(probeKey);
+            }
+            if (local.getItem(CACHE_EPOCH_KEY) !== epoch) {
+                cacheSafetyUnavailable = true;
+                return undefined;
+            }
+        }
+        const pendingClearIntents = [];
+        for (let index = 0; index < local.length; index += 1) {
+            const key = local.key(index);
+            if (key?.startsWith(CLEAR_INTENT_PREFIX)) {
+                pendingClearIntents.push({ key, value: local.getItem(key) });
+            }
+        }
+        return { epoch, pendingClearIntents };
+    }
+    catch {
+        cacheSafetyUnavailable = true;
+        return undefined;
+    }
+}
+function beginDurableClearIntent() {
+    const local = (() => {
+        try {
+            return typeof window === "undefined" ? undefined : window.localStorage;
+        }
+        catch {
+            cacheSafetyUnavailable = true;
+            return undefined;
+        }
+    })();
+    if (!local || cacheSafetyUnavailable)
+        return undefined;
+    const value = newCacheToken();
+    const key = `${CLEAR_INTENT_PREFIX}${value}`;
+    let intent;
+    let epochAdvanced = false;
+    try {
+        local.setItem(key, value);
+        if (local.getItem(key) !== value)
+            throw new Error("Unable to persist cache clear intent");
+        intent = { key, value };
+    }
+    catch (error) {
+        console.warn("Unable to persist cache clear intent; trying epoch invalidation", error);
+    }
+    try {
+        const epoch = newCacheToken();
+        local.setItem(CACHE_EPOCH_KEY, epoch);
+        if (local.getItem(CACHE_EPOCH_KEY) !== epoch)
+            throw new Error("Unable to persist cache epoch");
+        epochAdvanced = true;
+    }
+    catch (error) {
+        console.warn("Unable to persist cache epoch; relying on clear intent", error);
+    }
+    if (intent || epochAdvanced)
+        return intent;
+    cacheSafetyUnavailable = true;
+    return undefined;
+}
+function removeCompletedClearIntents(intents) {
+    try {
+        if (typeof window === "undefined")
+            return;
+        const local = window.localStorage;
+        for (const intent of intents) {
+            if (intent.key.startsWith(CLEAR_INTENT_PREFIX) &&
+                local.getItem(intent.key) === intent.value) {
+                local.removeItem(intent.key);
+            }
+        }
+    }
+    catch (error) {
+        console.warn("Unable to remove completed cache clear intent; later binds will retry", error);
+    }
+}
+function clearIntents() {
+    return readCacheSafetyState()?.pendingClearIntents ?? [];
+}
+function matchesCacheEpoch(epoch) {
+    const current = readCacheSafetyState();
+    return (current !== undefined &&
+        current.epoch === epoch &&
+        current.pendingClearIntents.length === 0);
+}
+function trackStorageWrite(write) {
+    inFlightStorageWrites.add(write);
+    void write.then(() => inFlightStorageWrites.delete(write), () => inFlightStorageWrites.delete(write));
+}
+function trackStorageDelete(deletion) {
+    inFlightStorageDeletes.add(deletion);
+    void deletion.then(() => inFlightStorageDeletes.delete(deletion), () => inFlightStorageDeletes.delete(deletion));
+    return deletion;
+}
+function beginStorageClear() {
+    if (storageClearInFlight)
+        return storageClearInFlight;
+    storageClearRequired = true;
+    beginDurableClearIntent();
+    const intentsToClear = clearIntents();
+    const generation = ++storageClearGeneration;
+    let clear;
+    clear = (async () => {
+        await waitForStorageOperations();
+        await storage.clear();
+        failedStorageDeleteScopes.clear();
+        removeCompletedClearIntents(intentsToClear);
+        storageClearRequired = clearIntents().length > 0;
+    })().finally(() => {
+        if (storageClearInFlight === clear &&
+            storageClearGeneration === generation) {
+            storageClearInFlight = undefined;
+        }
+    });
+    storageClearInFlight = clear;
+    return clear;
+}
+async function waitForStorageClear() {
+    while (storageClearInFlight) {
+        const clear = storageClearInFlight;
+        await clear;
+    }
+    if (storageClearRequired) {
+        await beginStorageClear();
+    }
+}
+async function waitForStorageClearWithinBound(timeoutMs = INITIAL_CLEAR_TIMEOUT_MS) {
+    if (timeoutMs <= 0) {
+        console.warn("Cached action results could not be cleared within the binding deadline");
+        return false;
+    }
+    let timer;
+    const timedOut = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(false), timeoutMs);
+    });
+    try {
+        return await Promise.race([
+            waitForStorageClear().then(() => true),
+            timedOut,
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function releaseWithoutCache(client, attempt) {
+    closeBinding();
+    client.removeQueries({ queryKey: ACTION_QUERY_KEY });
+    registerActionQueryCacheRevoker(client, () => {
+        if (attempt !== bindAttemptGeneration || binding !== undefined) {
+            return;
+        }
+        void clearActionQueryCache().catch((error) => console.warn("Unable to clear cached action results", error));
+    });
+}
+async function waitForStorageOperations() {
+    while (inFlightStorageWrites.size > 0 || inFlightStorageDeletes.size > 0) {
+        await Promise.allSettled([
+            ...inFlightStorageWrites,
+            ...inFlightStorageDeletes,
+        ]);
+    }
+}
 /** @internal exported for tests */
 export function setActionQueryCacheStorage(next) {
     storage = next ?? indexedDbStorage;
@@ -60,46 +272,67 @@ function withinMaxAge(stored) {
     };
 }
 // ponytail: one record holds every persisted result for the scope, with no size cap; split per query or cap bytes if restore shows up in traces.
-function scopedPersister(scope) {
+function scopedPersister(scope, cacheEpoch) {
+    const createdDuringClearGeneration = storageClearGeneration;
     let open = true;
+    let persistBlocked = false;
     let latest;
     let timer;
     let restored = new Map();
     let restoredSources = new Map();
     let restoreAccepted = false;
+    let restoreBlocked = false;
     let restoreRevision = 0;
+    const writesInFlight = new Set();
     const clearRestoredState = () => {
         restoreAccepted = false;
         restored = new Map();
         restoredSources = new Map();
     };
+    const canUseCache = () => {
+        const safe = matchesCacheEpoch(cacheEpoch);
+        if (!safe) {
+            persistBlocked = true;
+            restoreBlocked = true;
+            clearRestoredState();
+            latest = undefined;
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        return safe;
+    };
     const flush = () => {
         timer = undefined;
         const next = latest;
         latest = undefined;
-        if (!open || !next)
+        if (!open || persistBlocked || !next || !canUseCache())
             return;
-        storage
+        const write = storage
             .set(scope, next)
             .catch((error) => console.warn("Unable to save cached action results", error));
+        writesInFlight.add(write);
+        trackStorageWrite(write);
+        void write.then(() => writesInFlight.delete(write), () => writesInFlight.delete(write));
     };
     return {
         persistClient(client) {
-            if (!open)
+            if (!open || persistBlocked || !canUseCache())
                 return;
             latest = client;
             timer ??= setTimeout(flush, WRITE_DELAY_MS);
         },
         async restoreClient() {
             clearRestoredState();
-            if (!open)
+            if (!open || restoreBlocked || !canUseCache())
                 return undefined;
             const revision = restoreRevision;
             const stored = await storage.get(scope);
             // A revoked record can still be in an outstanding storage read. Do not
             // return it to the persister after discard, even if the read was started
             // before the matching access-denied response.
-            const record = open && revision === restoreRevision ? withinMaxAge(stored) : undefined;
+            const record = open && !restoreBlocked && revision === restoreRevision && canUseCache()
+                ? withinMaxAge(stored)
+                : undefined;
             restored = new Map(record?.clientState.queries.map((query) => [
                 query.queryHash,
                 query.state.dataUpdatedAt,
@@ -114,7 +347,10 @@ function scopedPersister(scope) {
                 },
             ]));
             restoreAccepted =
-                open && revision === restoreRevision && record !== undefined;
+                open &&
+                    !restoreBlocked &&
+                    revision === restoreRevision &&
+                    record !== undefined;
             return record;
         },
         restoredStates() {
@@ -124,14 +360,24 @@ function scopedPersister(scope) {
             return restoredSources;
         },
         restoreWasAccepted() {
-            return open && restoreAccepted;
+            return open && !restoreBlocked && restoreAccepted;
+        },
+        releaseRestorePayload() {
+            restoreAccepted = false;
+            restoredSources = new Map();
         },
         removeClient() {
+            restoreBlocked = true;
             restoreRevision += 1;
             clearRestoredState();
-            return storage.del(scope);
+            if (createdDuringClearGeneration !== storageClearGeneration) {
+                return Promise.resolve();
+            }
+            return trackStorageDelete(storage.del(scope));
         },
         discard() {
+            persistBlocked = true;
+            restoreBlocked = true;
             restoreRevision += 1;
             clearRestoredState();
             // A debounced write still holds the client as it was before the revoke,
@@ -139,12 +385,31 @@ function scopedPersister(scope) {
             latest = undefined;
             clearTimeout(timer);
             timer = undefined;
-            storage
-                .del(scope)
-                .catch((error) => console.warn("Unable to delete cached action results", error));
+            if (createdDuringClearGeneration !== storageClearGeneration)
+                return;
+            const currentSafety = readCacheSafetyState();
+            if (currentSafety && currentSafety.epoch !== cacheEpoch)
+                return;
+            storageClearRequired = true;
+            beginDurableClearIntent();
+            const deletion = (async () => {
+                await Promise.all([...writesInFlight]);
+                await storage.del(scope);
+            })();
+            trackRevokedScopeDelete(scope, deletion);
+        },
+        blockRestoreAndPersistence() {
+            persistBlocked = true;
+            restoreBlocked = true;
+            restoreRevision += 1;
+            clearRestoredState();
+            latest = undefined;
+            clearTimeout(timer);
+            timer = undefined;
         },
         close() {
             open = false;
+            restoreBlocked = true;
             restoreRevision += 1;
             clearRestoredState();
             latest = undefined;
@@ -155,24 +420,74 @@ function scopedPersister(scope) {
 }
 let binding;
 let bindingGeneration = 0;
+const bindingScopes = new WeakMap();
+function trackRevokedScopeDelete(scope, deletion) {
+    const trackedDeletion = deletion.then(() => {
+        failedStorageDeleteScopes.delete(scope);
+    }, (error) => {
+        failedStorageDeleteScopes.add(scope);
+        storageClearRequired = true;
+        beginDurableClearIntent();
+        throw error;
+    });
+    trackStorageDelete(trackedDeletion);
+    void trackedDeletion.catch((error) => console.warn("Unable to delete cached action results", error));
+    return trackedDeletion;
+}
 /** Stops persisting and drops this document's action results. Storage is
  * untouched. */
 function closeBinding() {
     bindingGeneration += 1;
-    if (!binding)
-        return;
-    binding.persister.close();
-    binding.unsubscribe();
-    binding.client.removeQueries({ queryKey: ACTION_QUERY_KEY });
+    const closing = binding;
     binding = undefined;
+    setActionQueryCacheBindingToken(undefined);
+    if (!closing)
+        return;
+    closing.persister.close();
+    closing.unsubscribe();
+    // Keep access-denied errors as evidence for the next bind. A cached success
+    // for the same key must not be restored after a 401/403/404 was observed.
+    for (const query of closing.client
+        .getQueryCache()
+        .findAll({ queryKey: ACTION_QUERY_KEY })) {
+        if (isAccessDeniedActionQuery(query)) {
+            clearAccessDeniedActionQueryData(query);
+        }
+        else {
+            closing.client.removeQueries({ queryKey: query.queryKey, exact: true });
+        }
+    }
 }
-async function waitForRestore(restored) {
+async function waitForCleanup(cleanup, timeoutMessage = "Cached action results could not be prepared in time; loading without them.", timeoutMs = RESTORE_TIMEOUT_MS) {
+    if (timeoutMs <= 0) {
+        void cleanup.catch((error) => console.warn("Cache cleanup failed after its deadline", error));
+        return false;
+    }
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            console.warn(timeoutMessage);
+            resolve(false);
+        }, timeoutMs);
+    });
+    try {
+        return await Promise.race([cleanup.then(() => true), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function waitForRestore(restored, timeoutMs = RESTORE_TIMEOUT_MS) {
+    if (timeoutMs <= 0) {
+        console.warn("Cached action results did not restore in time; loading without them.");
+        return;
+    }
     let timer;
     const timeout = new Promise((resolve) => {
         timer = setTimeout(() => {
             console.warn("Cached action results did not restore in time; loading without them.");
             resolve();
-        }, RESTORE_TIMEOUT_MS);
+        }, timeoutMs);
     });
     try {
         await Promise.race([
@@ -188,161 +503,304 @@ async function waitForRestore(restored) {
  * Points the client's action results at one scope's record and restores it.
  * Resolves once the record is in the client or the restore has given up.
  */
-export async function bindActionQueryCache(client, scope) {
-    // Nothing is cleared here: closeBinding has already dropped any previous
-    // scope's results, and results fetched before the session resolved (a hinted
-    // preload) belong to this session and must survive the bind.
-    closeBinding();
-    const generation = bindingGeneration;
-    // One record at a time: a record for any other scope belongs to another user
-    // or org.
-    for (const key of await storage.keys()) {
-        if (key !== scope)
-            await storage.del(key);
-    }
-    if (generation !== bindingGeneration)
+export async function bindActionQueryCache(client, scope, options = {}) {
+    const attempt = ++bindAttemptGeneration;
+    const bindDeadline = Date.now() + BIND_WAIT_BUDGET_MS;
+    const remainingBindBudget = () => Math.max(0, bindDeadline - Date.now());
+    let cacheSafety = readCacheSafetyState(true);
+    if (!cacheSafety) {
+        releaseWithoutCache(client, attempt);
         return;
-    const persister = scopedPersister(scope);
-    let payloadMappingValid = true;
-    let deserializeIndex = 0;
-    const deserializedByHash = new Map();
-    let cachedSourceEntries;
-    const sourceEntries = () => {
-        cachedSourceEntries ??= [...persister.restoredSources()].filter(([, source]) => source.data !== undefined);
-        return cachedSourceEntries;
-    };
-    const clientHydrateOptions = client.getDefaultOptions().hydrate;
-    const clientDeserializeData = clientHydrateOptions?.deserializeData;
-    const hydrateOptions = {
-        defaultOptions: {
-            ...clientHydrateOptions,
-            deserializeData: (data) => {
-                const result = clientDeserializeData
-                    ? clientDeserializeData(data)
-                    : data;
-                const expected = sourceEntries()[deserializeIndex++];
-                if (!expected || !Object.is(expected[1].data, data)) {
-                    payloadMappingValid = false;
-                }
-                else {
-                    deserializedByHash.set(expected[0], {
-                        dataUpdatedAt: expected[1].dataUpdatedAt,
-                        data: result,
-                    });
-                }
-                return result;
-            },
-        },
-    };
-    const hydratedQueryHashes = new Set();
-    const unsubscribeHydration = client.getQueryCache().subscribe((event) => {
-        if (!persister.restoreWasAccepted())
-            return;
-        const hash = event.query.queryHash;
-        const source = persister.restoredSources().get(hash);
-        const deserialized = deserializedByHash.get(hash);
-        if (!source || !deserialized)
+    }
+    if (!storageClearInFlight) {
+        storageClearRequired = cacheSafety.pendingClearIntents.length > 0;
+    }
+    if (storageClearInFlight || storageClearRequired) {
+        let clearFinished;
+        try {
+            clearFinished = await waitForStorageClearWithinBound(remainingBindBudget());
+        }
+        catch (error) {
+            if (attempt === bindAttemptGeneration) {
+                releaseWithoutCache(client, attempt);
+            }
+            throw error;
+        }
+        if (attempt !== bindAttemptGeneration) {
             return;
-        // An unrelated local setState can happen while restore is pending. Count
-        // it only when its payload is the object produced by SDK deserialization.
-        const isHydratedState = (state) => state.status === source.status &&
-            state.dataUpdatedAt === source.dataUpdatedAt &&
-            Object.is(state.data, deserialized.data);
-        if (event.type === "added" && isHydratedState(event.query.state)) {
-            hydratedQueryHashes.add(hash);
         }
-        else if (event.type === "updated" &&
-            event.action.type === "setState" &&
-            isHydratedState(event.action.state)) {
-            hydratedQueryHashes.add(hash);
+        if (!clearFinished || remainingBindBudget() <= 0) {
+            releaseWithoutCache(client, attempt);
+            return;
         }
+    }
+    cacheSafety = readCacheSafetyState(true);
+    if (!cacheSafety || cacheSafety.pendingClearIntents.length > 0) {
+        releaseWithoutCache(client, attempt);
+        return;
+    }
+    const trustPrebindResults = options.trustPrebindResults === true;
+    const previousBinding = binding;
+    const alreadyBoundClient = previousBinding?.client === client;
+    const deniedBeforeBind = client
+        .getQueryCache()
+        .getAll()
+        .filter(isAccessDeniedActionQuery);
+    const denialsKnownFromDifferentScope = deniedBeforeBind.filter((query) => {
+        const token = getAccessDeniedActionQueryBinding(query);
+        const denialScope = token ? bindingScopes.get(token) : undefined;
+        return denialScope !== undefined && denialScope !== scope;
     });
-    const [unsubscribe, restored] = persistQueryClient({
-        queryClient: client,
+    const everyDenialKnownFromDifferentScope = deniedBeforeBind.length > 0 &&
+        denialsKnownFromDifferentScope.length === deniedBeforeBind.length;
+    const earlierDeletes = [...inFlightStorageDeletes];
+    closeBinding();
+    // An unverified result fetched before the first scope was known must not be
+    // consumed by the newly authenticated tree. Trusted first-read preloads stay
+    // in memory, but their fetch-start token remains absent, so they are never
+    // adopted into this scope's persisted record.
+    if (!alreadyBoundClient && !trustPrebindResults) {
+        client.removeQueries({
+            queryKey: ACTION_QUERY_KEY,
+            predicate: (query) => !isAccessDeniedActionQuery(query),
+        });
+    }
+    const generation = bindingGeneration;
+    const persister = scopedPersister(scope, cacheSafety.epoch);
+    const token = {};
+    registerActionQueryCacheRevoker(client, () => persister.discard(), token);
+    bindingScopes.set(token, scope);
+    let unsubscribePersist = () => { };
+    let stopHydrationTracking = () => { };
+    let unsubscribeRevoked = () => { };
+    const currentBinding = {
+        client,
+        scope,
+        token,
         persister,
-        buster: ACTION_QUERY_CACHE_BUSTER,
-        maxAge: ACTION_QUERY_CACHE_MAX_AGE_MS,
-        hydrateOptions,
-        dehydrateOptions: {
-            shouldDehydrateQuery: isBrowserPersistableActionQuery,
-            // A mutation replayed from disk would look like a write that succeeded.
-            shouldDehydrateMutation: () => false,
+        unsubscribe: () => {
+            unsubscribePersist();
+            unsubscribeRevoked();
+            stopHydrationTracking();
         },
-    });
-    // Subscribed before persistQueryClient's own listener (which subscribes only
-    // after the restore), so the delete runs before the error's rewrite.
-    const unsubscribeRevoked = client.getQueryCache().subscribe((event) => {
+    };
+    binding = currentBinding;
+    setActionQueryCacheBindingToken(token);
+    const isCurrentBinding = () => binding === currentBinding && generation === bindingGeneration;
+    unsubscribeRevoked = client.getQueryCache().subscribe((event) => {
         if (event.type !== "updated" || event.action.type !== "error")
             return;
         if (event.query.queryKey[0] !== "action")
             return;
         const status = actionErrorStatus(event.action.error);
-        // The record may still hold this result from before the refetch. Only a
-        // successful query is dehydrated, so the rewrite after this error leaves
-        // it out.
         if (status === 401 || status === 403 || status === 404) {
+            const deniedBinding = getAccessDeniedActionQueryBinding(event.query);
+            const deniedScope = deniedBinding
+                ? bindingScopes.get(deniedBinding)
+                : undefined;
+            if (deniedScope !== undefined && deniedScope !== scope)
+                return;
             revokeBrowserPersistableActionQuery(event.query);
             persister.discard();
+            clearAccessDeniedActionQueryData(event.query);
         }
     });
-    binding = {
-        client,
-        persister,
-        unsubscribe: () => {
-            unsubscribe();
-            unsubscribeRevoked();
-            unsubscribeHydration();
-        },
-    };
-    const finishAcceptedRestore = () => {
-        const expectedDataCount = sourceEntries().length;
-        if (deserializeIndex !== expectedDataCount)
-            payloadMappingValid = false;
-        if (!payloadMappingValid ||
-            generation !== bindingGeneration ||
-            !persister.restoreWasAccepted()) {
-            return;
+    if (deniedBeforeBind.length > 0) {
+        if (!everyDenialKnownFromDifferentScope)
+            persister.discard();
+        for (const query of deniedBeforeBind) {
+            revokeBrowserPersistableActionQuery(query);
+            if (everyDenialKnownFromDifferentScope) {
+                query.setState({
+                    data: undefined,
+                    dataUpdatedAt: 0,
+                    error: null,
+                    errorUpdatedAt: 0,
+                    fetchFailureCount: 0,
+                    fetchFailureReason: null,
+                    status: "pending",
+                    fetchStatus: "idle",
+                });
+            }
+            else {
+                clearAccessDeniedActionQueryData(query);
+            }
         }
-        const restoredStates = persister.restoredStates();
-        const restoredSources = persister.restoredSources();
-        for (const query of client.getQueryCache().getAll()) {
-            const source = restoredSources.get(query.queryHash);
-            const deserialized = deserializedByHash.get(query.queryHash);
-            if (hydratedQueryHashes.has(query.queryHash) &&
-                source?.queryKey[0] === "action" &&
-                source.status === "success" &&
-                query.queryKey[0] === "action" &&
-                query.state.status === "success" &&
-                restoredStates.get(query.queryHash) === query.state.dataUpdatedAt &&
-                source.dataUpdatedAt === deserialized?.dataUpdatedAt &&
-                Object.is(query.state.data, deserialized?.data)) {
-                markRestoredBrowserPersistableActionQuery(query);
+    }
+    const cleanup = (async () => {
+        await Promise.allSettled(earlierDeletes);
+        if (!isCurrentBinding())
+            return;
+        let blockPersistenceForScope = false;
+        if (failedStorageDeleteScopes.has(scope)) {
+            try {
+                await trackRevokedScopeDelete(scope, storage.del(scope));
+            }
+            catch (error) {
+                blockPersistenceForScope = true;
             }
         }
-    };
-    // This runs after SDK hydration settles even if the UI's bounded wait has
-    // already released the app; a later scope generation cannot be authorized.
-    void restored.then(() => {
-        finishAcceptedRestore();
-        unsubscribeHydration();
-    }, () => unsubscribeHydration());
-    await waitForRestore(restored);
-    // A scope change during the restore can hydrate the old scope after the new
-    // one has started; drop those results before the new scope saves them. A
-    // query the new scope has refetched since holds newer data and is kept.
-    if (generation !== bindingGeneration) {
-        const restoredStates = persister.restoredStates();
-        client.removeQueries({
-            predicate: (query) => query.queryKey[0] === "action" &&
-                restoredStates.get(query.queryHash) === query.state.dataUpdatedAt,
+        if (blockPersistenceForScope)
+            persister.blockRestoreAndPersistence();
+        if (!isCurrentBinding())
+            return;
+        await waitForStorageOperations();
+        if (!isCurrentBinding())
+            return;
+        const keys = await storage.keys();
+        if (!isCurrentBinding())
+            return;
+        for (const key of keys) {
+            if (key === scope)
+                continue;
+            if (!isCurrentBinding())
+                return;
+            await trackRevokedScopeDelete(key, storage.del(key));
+        }
+    })();
+    try {
+        if (!(await waitForCleanup(cleanup, undefined, remainingBindBudget())) ||
+            remainingBindBudget() <= 0) {
+            if (isCurrentBinding())
+                persister.blockRestoreAndPersistence();
+            return;
+        }
+        if (!isCurrentBinding())
+            return;
+        let payloadMappingValid = true;
+        let deserializeIndex = 0;
+        const deserializedByHash = new Map();
+        let cachedSourceEntries;
+        const sourceEntries = () => {
+            cachedSourceEntries ??= [...persister.restoredSources()].filter(([, source]) => source.data !== undefined);
+            return cachedSourceEntries;
+        };
+        const clientHydrateOptions = client.getDefaultOptions().hydrate;
+        const clientDeserializeData = clientHydrateOptions?.deserializeData;
+        const hydrateOptions = {
+            defaultOptions: {
+                ...clientHydrateOptions,
+                deserializeData: (data) => {
+                    const result = clientDeserializeData
+                        ? clientDeserializeData(data)
+                        : data;
+                    const expected = sourceEntries()[deserializeIndex++];
+                    if (!expected || !Object.is(expected[1].data, data)) {
+                        payloadMappingValid = false;
+                    }
+                    else {
+                        deserializedByHash.set(expected[0], {
+                            dataUpdatedAt: expected[1].dataUpdatedAt,
+                            data: result,
+                        });
+                    }
+                    return result;
+                },
+            },
+        };
+        const hydratedQueryHashes = new Set();
+        stopHydrationTracking = client.getQueryCache().subscribe((event) => {
+            if (!persister.restoreWasAccepted())
+                return;
+            const hash = event.query.queryHash;
+            const source = persister.restoredSources().get(hash);
+            const deserialized = deserializedByHash.get(hash);
+            if (!source || !deserialized)
+                return;
+            // An unrelated local setState can happen while restore is pending. Count
+            // it only when its payload is the object produced by SDK deserialization.
+            const isHydratedState = (state) => state.status === source.status &&
+                state.dataUpdatedAt === source.dataUpdatedAt &&
+                Object.is(state.data, deserialized.data);
+            if (event.type === "added" && isHydratedState(event.query.state)) {
+                hydratedQueryHashes.add(hash);
+            }
+            else if (event.type === "updated" &&
+                event.action.type === "setState" &&
+                isHydratedState(event.action.state)) {
+                hydratedQueryHashes.add(hash);
+            }
+        });
+        const [unsubscribe, restored] = persistQueryClient({
+            queryClient: client,
+            persister,
+            buster: `${ACTION_QUERY_CACHE_BUSTER}:${cacheSafety.epoch}`,
+            maxAge: ACTION_QUERY_CACHE_MAX_AGE_MS,
+            hydrateOptions,
+            dehydrateOptions: {
+                shouldDehydrateQuery: (query) => isBrowserPersistableActionQueryForBinding(query, token),
+                // A mutation replayed from disk would look like a write that succeeded.
+                shouldDehydrateMutation: () => false,
+            },
         });
+        unsubscribePersist = unsubscribe;
+        const finishAcceptedRestore = () => {
+            const expectedDataCount = sourceEntries().length;
+            if (deserializeIndex !== expectedDataCount)
+                payloadMappingValid = false;
+            if (!payloadMappingValid ||
+                generation !== bindingGeneration ||
+                !persister.restoreWasAccepted()) {
+                return;
+            }
+            const restoredStates = persister.restoredStates();
+            const restoredSources = persister.restoredSources();
+            for (const query of client.getQueryCache().getAll()) {
+                const source = restoredSources.get(query.queryHash);
+                const deserialized = deserializedByHash.get(query.queryHash);
+                if (hydratedQueryHashes.has(query.queryHash) &&
+                    source?.queryKey[0] === "action" &&
+                    source.status === "success" &&
+                    query.queryKey[0] === "action" &&
+                    query.state.status === "success" &&
+                    restoredStates.get(query.queryHash) === query.state.dataUpdatedAt &&
+                    source.dataUpdatedAt === deserialized?.dataUpdatedAt &&
+                    Object.is(query.state.data, deserialized?.data)) {
+                    markRestoredBrowserPersistableActionQuery(query, token);
+                }
+            }
+        };
+        // This runs after SDK hydration settles even if the UI's bounded wait has
+        // already released the app; a later scope generation cannot be authorized.
+        void restored
+            .then(() => {
+            finishAcceptedRestore();
+        }, () => { })
+            .finally(() => {
+            cachedSourceEntries = undefined;
+            deserializedByHash.clear();
+            hydratedQueryHashes.clear();
+            persister.releaseRestorePayload();
+            stopHydrationTracking();
+            stopHydrationTracking = () => { };
+        });
+        await waitForRestore(restored, remainingBindBudget());
+        // A scope change during the restore can hydrate the old scope after the new
+        // one has started; drop those results before the new scope saves them. A
+        // query the new scope has refetched since holds newer data and is kept.
+        if (generation !== bindingGeneration) {
+            const restoredStates = persister.restoredStates();
+            client.removeQueries({
+                predicate: (query) => query.queryKey[0] === "action" &&
+                    restoredStates.get(query.queryHash) === query.state.dataUpdatedAt,
+            });
+        }
+    }
+    catch (error) {
+        if (binding === currentBinding)
+            closeBinding();
+        throw error;
     }
 }
 /** Sign-out: stop, drop this document's results, and delete every stored
  * record. */
 export async function clearActionQueryCache() {
     closeBinding();
-    await storage.clear();
+    const clear = beginStorageClear();
+    const clearFinished = await waitForCleanup(clear, "Cached action results could not be cleared in time; cleanup remains required.");
+    if (!clearFinished) {
+        throw new Error("Cached action result clearing timed out; cleanup remains required.");
+    }
 }
 /**
  * Holds action queries until the session's cached results are in the client,
@@ -355,31 +813,40 @@ export function ActionQueryCacheGate({ children }) {
     const scope = session
         ? actionQueryCacheScope(session, clientBuildId())
         : null;
-    const [restoredScope, setRestoredScope] = useState(null);
+    const terminalUnauthenticated = status === "unauthenticated";
+    const bindAttempt = useMemo(() => ({
+        trustPrebindResults: scope !== null && !terminalUnauthenticated && isSessionFromFirstRead(),
+    }), [queryClient, scope, terminalUnauthenticated]);
+    const [settledAttempt, setSettledAttempt] = useState(null);
     useEffect(() => {
-        // "loading", "unavailable" and "signing-out" are not an ended session:
-        // signOut() clears the store itself, and a transient read must not wipe it.
-        if (status === "unauthenticated") {
+        // A transient session reread does not replace a same-scope cache binding.
+        if (terminalUnauthenticated) {
             clearActionQueryCache().catch((error) => console.warn("Unable to clear cached action results", error));
+            setSettledAttempt(bindAttempt);
             return;
         }
-        if (!scope)
+        if (!scope) {
+            setSettledAttempt(bindAttempt);
             return;
+        }
         let current = true;
-        setRestoredScope(null);
         const finish = () => {
             if (current)
-                setRestoredScope(scope);
+                setSettledAttempt(bindAttempt);
         };
-        bindActionQueryCache(queryClient, scope).then(finish, (error) => {
+        bindActionQueryCache(queryClient, scope, {
+            trustPrebindResults: bindAttempt.trustPrebindResults,
+        }).then(finish, (error) => {
             console.warn("Unable to use cached action results", error);
             finish();
         });
         return () => {
             current = false;
+            bindAttemptGeneration += 1;
             closeBinding();
         };
-    }, [queryClient, scope, status]);
-    const restoring = scope !== null && restoredScope !== scope;
-    return (_jsx(IsRestoringProvider, { value: restoring, children: children }));
+    }, [bindAttempt, queryClient, scope, terminalUnauthenticated]);
+    const restoring = scope !== null && settledAttempt !== bindAttempt;
+    const holdUntrustedChildren = scope !== null && !bindAttempt.trustPrebindResults && restoring;
+    return (_jsx(IsRestoringProvider, { value: restoring, children: holdUntrustedChildren ? null : children }));
 }