@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/sync/reconciliation/service.js

@@ -0,0 +1,282 @@
+import { getOrCreateDomainSyncCoordinator, } from "../../data/sync/syncCoordinator.js";
+import { acknowledgeContainerForce, activateContainer, enqueueKnownContainersForIdleBackfill, markContainerForced, } from "./idleBackfill.js";
+import { createInitialDocumentProbe } from "./initialDocumentProbe.js";
+import { clearPendingDiscoveryRetries, isCurrentReconciliationLifecycle, reconcileMarkedContainer, sweepKnownContainers, } from "./knownContainerSweep.js";
+import { rearmFailedContainer } from "./laneFailure.js";
+import { clearOriginatedDocuments } from "./originatedDocuments.js";
+import { createReconcileQueue } from "./queue.js";
+function canReconcile(status) {
+    return status.dbStatus === "ready" && status.isAuthenticated && status.online;
+}
+async function runReconcileLane(host, state) {
+    if (!state.active || !canReconcile(host.getRuntimeStatus())) {
+        return;
+    }
+    const lifecycleGeneration = state.lifecycleGeneration;
+    const containerId = state.queue.dequeue();
+    if (!containerId) {
+        await state.initialDocumentProbe.run();
+        scheduleProbeContinuation(host, state);
+        return;
+    }
+    // Double-check at run time: a container may have been discovered (by an
+    // explicit refresh or an earlier lane pass) after it was queued. Mark it
+    // discovered up front to collapse concurrent re-enqueues into one fetch, but
+    // roll the mark back on failure so a transient error can be retried later.
+    const forceGeneration = state.forcedContainerGenerations.get(containerId);
+    const shouldForce = forceGeneration !== undefined;
+    if (shouldForce || !state.discoveredContainerIds.has(containerId)) {
+        state.discoveredContainerIds.add(containerId);
+        try {
+            const reconciled = await reconcileMarkedContainer(host, state, containerId, shouldForce);
+            if (reconciled) {
+                acknowledgeContainerForce(state, containerId, forceGeneration);
+            }
+        }
+        catch (error) {
+            rearmFailedContainer(state, containerId, forceGeneration, lifecycleGeneration);
+            throw error;
+        }
+    }
+    // Keep draining: schedule another pass while the queue holds work.
+    if (state.queue.size > 0) {
+        state.lane?.requestSync();
+    }
+    else {
+        scheduleProbeContinuation(host, state);
+    }
+}
+function scheduleProbeContinuation(host, state) {
+    state.probeContinuationCancel?.();
+    const canContinue = () => state.active &&
+        state.queue.size === 0 &&
+        canReconcile(host.getRuntimeStatus()) &&
+        state.initialDocumentProbe.hasPendingWork();
+    if (!canContinue()) {
+        state.probeContinuationCancel = null;
+        return;
+    }
+    const timeout = setTimeout(() => {
+        if (canContinue()) {
+            state.probeContinuationCancel = null;
+            state.lane?.requestSync();
+        }
+    }, state.initialDocumentProbe.continuationDelayMs());
+    state.probeContinuationCancel = () => clearTimeout(timeout);
+}
+function forgetIneligibleDiscoveredContainers(host, state) {
+    for (const containerId of state.discoveredContainerIds) {
+        if (!host.canDiscoverContainerDocuments(containerId)) {
+            state.discoveredContainerIds.delete(containerId);
+        }
+    }
+}
+async function refreshAndReconcileContainers(input) {
+    const { host, listContainerIds, refreshTree, state } = input;
+    if (!canReconcile(host.getRuntimeStatus())) {
+        return;
+    }
+    const lifecycleGeneration = state.lifecycleGeneration;
+    if (input.forceAllDocumentContentPulls) {
+        state.queue.clear();
+    }
+    try {
+        // A resync_required structural refresh runs independently of this service.
+        // If it already removed a container after the forced document lane won its
+        // race against the old tree, forget the stale discovered bit before this
+        // refresh can re-add the same id.
+        forgetIneligibleDiscoveredContainers(host, state);
+        await refreshTree();
+        if (!isCurrentReconciliationLifecycle(state, lifecycleGeneration)) {
+            return;
+        }
+        // Structural hydration can revoke and remove a container after a targeted
+        // force already reconciled it against the old tree. Forget every id that
+        // is no longer remotely listable so a later share of the same container id
+        // is treated as newly surfaced instead of being suppressed for the rest of
+        // the session.
+        forgetIneligibleDiscoveredContainers(host, state);
+        await sweepKnownContainers({
+            forceAllDocumentContentPulls: input.forceAllDocumentContentPulls,
+            host,
+            knownIds: listContainerIds(),
+            lifecycleGeneration,
+            state,
+        });
+        if (!isCurrentReconciliationLifecycle(state, lifecycleGeneration)) {
+            return;
+        }
+    }
+    catch (error) {
+        if (!isCurrentReconciliationLifecycle(state, lifecycleGeneration)) {
+            return;
+        }
+        if (!host.isIgnorableError(error)) {
+            throw error;
+        }
+    }
+}
+// Sweeps share the queue and discovered set, so they must run serially.
+// Root requests join either kind of sweep; a full request after a root sweep
+// must wait for it and then refresh the whole tree.
+function requestContainerRefresh(input) {
+    const { state, scope } = input;
+    const pending = state.pendingRefresh;
+    if (pending && (scope === "root" || pending.scope === "full")) {
+        return pending.promise;
+    }
+    const promise = (pending?.promise ?? Promise.resolve())
+        // A failed root sweep must not prevent the queued full refresh.
+        .catch(() => undefined)
+        .then(() => refreshAndReconcileContainers({
+        forceAllDocumentContentPulls: scope === "full",
+        host: input.host,
+        listContainerIds: input.listContainerIds,
+        refreshTree: input.refreshTree,
+        state,
+    }))
+        .finally(() => {
+        if (state.pendingRefresh?.promise === promise) {
+            state.pendingRefresh = null;
+        }
+    });
+    state.pendingRefresh = { promise, scope };
+    return promise;
+}
+function listFullRefreshContainerIds(host, state) {
+    const knownIds = host.listKnownContainerIds();
+    const activeContainerId = state.activeContainerId;
+    if (!activeContainerId ||
+        knownIds.includes(activeContainerId) ||
+        !host.canDiscoverContainerDocuments(activeContainerId)) {
+        return knownIds;
+    }
+    // Explicit refresh also retries an open foreign system container that the
+    // background discovery list excludes.
+    return [...knownIds, activeContainerId];
+}
+function startReconciliationLane(host, state) {
+    if (state.active) {
+        return;
+    }
+    state.lifecycleGeneration += 1;
+    state.active = true;
+    state.lane = getOrCreateDomainSyncCoordinator(host.domainScope).registerLane("reconciliation:documents", {
+        label: "Device-first document reconciliation",
+        // Document discovery runs in the document phase, after structural
+        // container hydration/metadata sync settles for the scope.
+        phase: "document",
+        onUnexpectedError: (error) => {
+            console.error("Device-first reconciliation failed:", error);
+        },
+        // Fixed literal: no container or document id may reach a report. The
+        // mapped stack identifies which lane body threw. Returning the host's
+        // result hands a rejection to the lane reporter's wrapper; discarding it
+        // would surface as an unhandled rejection instead.
+        reportUnexpectedError: (error) => host.logError?.("Reconciliation: sync lane failed", error),
+        run: () => runReconcileLane(host, state),
+        shouldIgnoreError: host.isIgnorableError,
+    });
+}
+function createReconciliationState(host) {
+    return {
+        active: false,
+        activeContainerId: null,
+        automaticRetryGenerations: new Map(),
+        discoveredContainerIds: new Set(),
+        forcedContainerGenerations: new Map(),
+        initialDocumentProbe: createInitialDocumentProbe(host),
+        lane: null,
+        lifecycleGeneration: 0,
+        nextForceGeneration: 0,
+        probeContinuationCancel: null,
+        queue: createReconcileQueue(),
+        pendingRefresh: null,
+    };
+}
+function stopReconciliationService(host, state) {
+    clearPendingDiscoveryRetries(state);
+    state.active = false;
+    state.probeContinuationCancel?.();
+    state.probeContinuationCancel = null;
+    state.queue.clear();
+    state.automaticRetryGenerations.clear();
+    state.forcedContainerGenerations.clear();
+    state.pendingRefresh = null;
+    state.initialDocumentProbe.resetPending();
+    // Drop the per-session discovered suppression cache too: a stopped
+    // reconciler is being torn down (scope/identity change) or paused across
+    // a prerequisite loss, after which every container must be re-validated.
+    state.discoveredContainerIds.clear();
+    // Drop pending self-echo originations too — they are session-scoped and a
+    // teardown invalidates them.
+    clearOriginatedDocuments(host.domainScope);
+}
+export function createReconciliationService(host) {
+    const state = createReconciliationState(host);
+    const scheduleDrain = () => {
+        if (!state.active ||
+            (state.queue.size === 0 && !state.initialDocumentProbe.canRun())) {
+            return;
+        }
+        if (!canReconcile(host.getRuntimeStatus())) {
+            return;
+        }
+        state.probeContinuationCancel?.();
+        state.probeContinuationCancel = null;
+        state.lane?.requestSync();
+    };
+    const enqueueContainer = (containerId, priority, force = false) => {
+        if (!containerId) {
+            return;
+        }
+        // Skip containers already reconciled this session unless forced. Events
+        // force re-discovery; passive active/backfill scheduling does not, so
+        // opening Explorer does not re-fetch every container on each navigation.
+        if (!force && state.discoveredContainerIds.has(containerId)) {
+            return;
+        }
+        if (force) {
+            markContainerForced(state, containerId);
+        }
+        state.queue.enqueue(containerId, priority);
+        scheduleDrain();
+    };
+    const enqueueIdleBackfill = () => {
+        enqueueKnownContainersForIdleBackfill({
+            host,
+            scheduleDrain,
+            state,
+        });
+    };
+    return {
+        start: () => {
+            startReconciliationLane(host, state);
+            scheduleDrain();
+        },
+        // Reconcile the active container first; siblings remain lazy until visited.
+        setActiveContainer: (containerId) => activateContainer(state, containerId, (activeId, force) => enqueueContainer(activeId, "active", force)),
+        enqueueContainer,
+        enqueueIdleBackfill,
+        resetDiscovered: () => {
+            state.discoveredContainerIds.clear();
+            state.initialDocumentProbe.resetSkippedListings();
+        },
+        reconcileRootContainersNow: () => requestContainerRefresh({
+            host,
+            state,
+            refreshTree: host.refreshRootTree,
+            listContainerIds: host.listAutomaticRootCatchupContainerIds,
+            scope: "root",
+        }),
+        reconcileNow: () => requestContainerRefresh({
+            host,
+            state,
+            refreshTree: host.refreshTree,
+            listContainerIds: () => listFullRefreshContainerIds(host, state),
+            scope: "full",
+        }),
+        stop: () => stopReconciliationService(host, state),
+    };
+}
+//# sourceMappingURL=service.js.map

package/sync/reconciliation/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,GAEjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,qCAAqC,EAErC,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAA0B,MAAM,SAAS,CAAC;AAOvE,SAAS,YAAY,CAAC,MAAmC;IACvD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC;AAChF,CAAC;AAeD,KAAK,UAAU,gBAAgB,CAC7B,IAAwB,EACxB,KAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAEtD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;QACvC,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,eAAe,KAAK,SAAS,CAAC;IAClD,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAC/C,IAAI,EACJ,KAAK,EACL,WAAW,EACX,WAAW,CACZ,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,yBAAyB,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oBAAoB,CAClB,KAAK,EACL,WAAW,EACX,eAAe,EACf,mBAAmB,CACpB,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAwB,EACxB,KAA0B;IAE1B,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,GAAG,EAAE,CACvB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACrC,KAAK,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC;IAC9C,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACnB,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACrC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,uBAAuB,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC,CAC3C,IAAwB,EACxB,KAA0B;IAE1B,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAM5C;IACC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAEtD,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC;QACvC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACH,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,kCAAkC;QAClC,oCAAoC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,WAAW,EAAE,CAAC;QACpB,IAAI,CAAC,gCAAgC,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAClE,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,eAAe;QACf,oCAAoC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,oBAAoB,CAAC;YACzB,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;YAChE,IAAI;YACJ,QAAQ,EAAE,gBAAgB,EAAE;YAC5B,mBAAmB;YACnB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,gCAAgC,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAClE,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,gCAAgC,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAClE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,6EAA6E;AAC7E,oDAAoD;AACpD,SAAS,uBAAuB,CAAC,KAMhC;IACC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrD,gEAAgE;SAC/D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtB,IAAI,CAAC,GAAG,EAAE,CACT,6BAA6B,CAAC;QAC5B,4BAA4B,EAAE,KAAK,KAAK,MAAM;QAC9C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK;KACN,CAAC,CACH;SACA,OAAO,CAAC,GAAG,EAAE;QACZ,IAAI,KAAK,CAAC,cAAc,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;YAC9C,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IACL,KAAK,CAAC,cAAc,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAwB,EACxB,KAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC9C,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClD,IACE,CAAC,iBAAiB;QAClB,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,CAAC,IAAI,CAAC,6BAA6B,CAAC,iBAAiB,CAAC,EACtD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,0EAA0E;IAC1E,sCAAsC;IACtC,OAAO,CAAC,GAAG,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAwB,EACxB,KAA0B;IAE1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;IAC/B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,CAC1E,0BAA0B,EAC1B;QACE,KAAK,EAAE,sCAAsC;QAC7C,kEAAkE;QAClE,2DAA2D;QAC3D,KAAK,EAAE,UAAU;QACjB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC,kCAAkC,EAAE,KAAK,CAAC;QAC5D,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC;QACxC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB;KACzC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAwB;IAExB,OAAO;QACL,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,IAAI;QACvB,yBAAyB,EAAE,IAAI,GAAG,EAAE;QACpC,sBAAsB,EAAE,IAAI,GAAG,EAAE;QACjC,0BAA0B,EAAE,IAAI,GAAG,EAAE;QACrC,oBAAoB,EAAE,0BAA0B,CAAC,IAAI,CAAC;QACtD,IAAI,EAAE,IAAI;QACV,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,uBAAuB,EAAE,IAAI;QAC7B,KAAK,EAAE,oBAAoB,EAAE;QAC7B,cAAc,EAAE,IAAI;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAwB,EACxB,KAA0B;IAE1B,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;IAClC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;IACrC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,KAAK,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IACxC,KAAK,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;IACzC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC;IAC1C,mEAAmE;IACnE,yEAAyE;IACzE,yEAAyE;IACzE,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;IACrC,0EAA0E;IAC1E,6BAA6B;IAC7B,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAwB;IAExB,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,IACE,CAAC,KAAK,CAAC,MAAM;YACb,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CACvB,WAAmB,EACnB,QAA2B,EAC3B,KAAK,GAAG,KAAK,EACb,EAAE;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3C,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,qCAAqC,CAAC;YACpC,IAAI;YACJ,aAAa;YACb,KAAK;SACN,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,aAAa,EAAE,CAAC;QAClB,CAAC;QACD,4EAA4E;QAC5E,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAClC,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CACxD,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC5C;QACH,gBAAgB;QAChB,mBAAmB;QACnB,eAAe,EAAE,GAAG,EAAE;YACpB,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,CAAC;QACpD,CAAC;QACD,0BAA0B,EAAE,GAAG,EAAE,CAC/B,uBAAuB,CAAC;YACtB,IAAI;YACJ,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,eAAe;YACjC,gBAAgB,EAAE,IAAI,CAAC,oCAAoC;YAC3D,KAAK,EAAE,MAAM;SACd,CAAC;QACJ,YAAY,EAAE,GAAG,EAAE,CACjB,uBAAuB,CAAC;YACtB,IAAI;YACJ,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,gBAAgB,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC;YAChE,KAAK,EAAE,MAAM;SACd,CAAC;QACJ,IAAI,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOrCreateDomainSyncCoordinator,\n  type SyncLane,\n} from \"../../data/sync/syncCoordinator\";\nimport {\n  acknowledgeContainerForce,\n  activateContainer,\n  enqueueKnownContainersForIdleBackfill,\n  type IdleBackfillState,\n  markContainerForced,\n} from \"./idleBackfill\";\nimport { createInitialDocumentProbe } from \"./initialDocumentProbe\";\nimport {\n  clearPendingDiscoveryRetries,\n  isCurrentReconciliationLifecycle,\n  reconcileMarkedContainer,\n  sweepKnownContainers,\n} from \"./knownContainerSweep\";\nimport { rearmFailedContainer } from \"./laneFailure\";\nimport { clearOriginatedDocuments } from \"./originatedDocuments\";\nimport { createReconcileQueue, type ReconcilePriority } from \"./queue\";\nimport type {\n  ReconciliationHost,\n  ReconciliationRuntimeStatus,\n  ReconciliationService,\n} from \"./serviceTypes\";\n\nfunction canReconcile(status: ReconciliationRuntimeStatus): boolean {\n  return status.dbStatus === \"ready\" && status.isAuthenticated && status.online;\n}\n\ntype RefreshScope = \"root\" | \"full\";\n\ninterface ReconciliationState extends IdleBackfillState {\n  active: boolean;\n  lane: SyncLane | null;\n  lifecycleGeneration: number;\n  probeContinuationCancel: (() => void) | null;\n  pendingRefresh: {\n    readonly promise: Promise<void>;\n    readonly scope: RefreshScope;\n  } | null;\n}\n\nasync function runReconcileLane(\n  host: ReconciliationHost,\n  state: ReconciliationState,\n): Promise<void> {\n  if (!state.active || !canReconcile(host.getRuntimeStatus())) {\n    return;\n  }\n  const lifecycleGeneration = state.lifecycleGeneration;\n\n  const containerId = state.queue.dequeue();\n  if (!containerId) {\n    await state.initialDocumentProbe.run();\n    scheduleProbeContinuation(host, state);\n    return;\n  }\n  // Double-check at run time: a container may have been discovered (by an\n  // explicit refresh or an earlier lane pass) after it was queued. Mark it\n  // discovered up front to collapse concurrent re-enqueues into one fetch, but\n  // roll the mark back on failure so a transient error can be retried later.\n  const forceGeneration = state.forcedContainerGenerations.get(containerId);\n  const shouldForce = forceGeneration !== undefined;\n  if (shouldForce || !state.discoveredContainerIds.has(containerId)) {\n    state.discoveredContainerIds.add(containerId);\n    try {\n      const reconciled = await reconcileMarkedContainer(\n        host,\n        state,\n        containerId,\n        shouldForce,\n      );\n      if (reconciled) {\n        acknowledgeContainerForce(state, containerId, forceGeneration);\n      }\n    } catch (error) {\n      rearmFailedContainer(\n        state,\n        containerId,\n        forceGeneration,\n        lifecycleGeneration,\n      );\n      throw error;\n    }\n  }\n\n  // Keep draining: schedule another pass while the queue holds work.\n  if (state.queue.size > 0) {\n    state.lane?.requestSync();\n  } else {\n    scheduleProbeContinuation(host, state);\n  }\n}\n\nfunction scheduleProbeContinuation(\n  host: ReconciliationHost,\n  state: ReconciliationState,\n): void {\n  state.probeContinuationCancel?.();\n  const canContinue = () =>\n    state.active &&\n    state.queue.size === 0 &&\n    canReconcile(host.getRuntimeStatus()) &&\n    state.initialDocumentProbe.hasPendingWork();\n  if (!canContinue()) {\n    state.probeContinuationCancel = null;\n    return;\n  }\n  const timeout = setTimeout(() => {\n    if (canContinue()) {\n      state.probeContinuationCancel = null;\n      state.lane?.requestSync();\n    }\n  }, state.initialDocumentProbe.continuationDelayMs());\n  state.probeContinuationCancel = () => clearTimeout(timeout);\n}\n\nfunction forgetIneligibleDiscoveredContainers(\n  host: ReconciliationHost,\n  state: ReconciliationState,\n): void {\n  for (const containerId of state.discoveredContainerIds) {\n    if (!host.canDiscoverContainerDocuments(containerId)) {\n      state.discoveredContainerIds.delete(containerId);\n    }\n  }\n}\n\nasync function refreshAndReconcileContainers(input: {\n  forceAllDocumentContentPulls: boolean;\n  host: ReconciliationHost;\n  listContainerIds: () => ReadonlyArray<string>;\n  refreshTree: () => Promise<void>;\n  state: ReconciliationState;\n}): Promise<void> {\n  const { host, listContainerIds, refreshTree, state } = input;\n  if (!canReconcile(host.getRuntimeStatus())) {\n    return;\n  }\n  const lifecycleGeneration = state.lifecycleGeneration;\n\n  if (input.forceAllDocumentContentPulls) {\n    state.queue.clear();\n  }\n  try {\n    // A resync_required structural refresh runs independently of this service.\n    // If it already removed a container after the forced document lane won its\n    // race against the old tree, forget the stale discovered bit before this\n    // refresh can re-add the same id.\n    forgetIneligibleDiscoveredContainers(host, state);\n    await refreshTree();\n    if (!isCurrentReconciliationLifecycle(state, lifecycleGeneration)) {\n      return;\n    }\n    // Structural hydration can revoke and remove a container after a targeted\n    // force already reconciled it against the old tree. Forget every id that\n    // is no longer remotely listable so a later share of the same container id\n    // is treated as newly surfaced instead of being suppressed for the rest of\n    // the session.\n    forgetIneligibleDiscoveredContainers(host, state);\n    await sweepKnownContainers({\n      forceAllDocumentContentPulls: input.forceAllDocumentContentPulls,\n      host,\n      knownIds: listContainerIds(),\n      lifecycleGeneration,\n      state,\n    });\n    if (!isCurrentReconciliationLifecycle(state, lifecycleGeneration)) {\n      return;\n    }\n  } catch (error) {\n    if (!isCurrentReconciliationLifecycle(state, lifecycleGeneration)) {\n      return;\n    }\n    if (!host.isIgnorableError(error)) {\n      throw error;\n    }\n  }\n}\n\n// Sweeps share the queue and discovered set, so they must run serially.\n// Root requests join either kind of sweep; a full request after a root sweep\n// must wait for it and then refresh the whole tree.\nfunction requestContainerRefresh(input: {\n  host: ReconciliationHost;\n  state: ReconciliationState;\n  refreshTree: () => Promise<void>;\n  listContainerIds: () => ReadonlyArray<string>;\n  scope: RefreshScope;\n}): Promise<void> {\n  const { state, scope } = input;\n  const pending = state.pendingRefresh;\n  if (pending && (scope === \"root\" || pending.scope === \"full\")) {\n    return pending.promise;\n  }\n\n  const promise = (pending?.promise ?? Promise.resolve())\n    // A failed root sweep must not prevent the queued full refresh.\n    .catch(() => undefined)\n    .then(() =>\n      refreshAndReconcileContainers({\n        forceAllDocumentContentPulls: scope === \"full\",\n        host: input.host,\n        listContainerIds: input.listContainerIds,\n        refreshTree: input.refreshTree,\n        state,\n      }),\n    )\n    .finally(() => {\n      if (state.pendingRefresh?.promise === promise) {\n        state.pendingRefresh = null;\n      }\n    });\n  state.pendingRefresh = { promise, scope };\n  return promise;\n}\n\nfunction listFullRefreshContainerIds(\n  host: ReconciliationHost,\n  state: ReconciliationState,\n): ReadonlyArray<string> {\n  const knownIds = host.listKnownContainerIds();\n  const activeContainerId = state.activeContainerId;\n  if (\n    !activeContainerId ||\n    knownIds.includes(activeContainerId) ||\n    !host.canDiscoverContainerDocuments(activeContainerId)\n  ) {\n    return knownIds;\n  }\n  // Explicit refresh also retries an open foreign system container that the\n  // background discovery list excludes.\n  return [...knownIds, activeContainerId];\n}\n\nfunction startReconciliationLane(\n  host: ReconciliationHost,\n  state: ReconciliationState,\n): void {\n  if (state.active) {\n    return;\n  }\n  state.lifecycleGeneration += 1;\n  state.active = true;\n  state.lane = getOrCreateDomainSyncCoordinator(host.domainScope).registerLane(\n    \"reconciliation:documents\",\n    {\n      label: \"Device-first document reconciliation\",\n      // Document discovery runs in the document phase, after structural\n      // container hydration/metadata sync settles for the scope.\n      phase: \"document\",\n      onUnexpectedError: (error) => {\n        console.error(\"Device-first reconciliation failed:\", error);\n      },\n      // Fixed literal: no container or document id may reach a report. The\n      // mapped stack identifies which lane body threw. Returning the host's\n      // result hands a rejection to the lane reporter's wrapper; discarding it\n      // would surface as an unhandled rejection instead.\n      reportUnexpectedError: (error) =>\n        host.logError?.(\"Reconciliation: sync lane failed\", error),\n      run: () => runReconcileLane(host, state),\n      shouldIgnoreError: host.isIgnorableError,\n    },\n  );\n}\n\nfunction createReconciliationState(\n  host: ReconciliationHost,\n): ReconciliationState {\n  return {\n    active: false,\n    activeContainerId: null,\n    automaticRetryGenerations: new Map(),\n    discoveredContainerIds: new Set(),\n    forcedContainerGenerations: new Map(),\n    initialDocumentProbe: createInitialDocumentProbe(host),\n    lane: null,\n    lifecycleGeneration: 0,\n    nextForceGeneration: 0,\n    probeContinuationCancel: null,\n    queue: createReconcileQueue(),\n    pendingRefresh: null,\n  };\n}\n\nfunction stopReconciliationService(\n  host: ReconciliationHost,\n  state: ReconciliationState,\n): void {\n  clearPendingDiscoveryRetries(state);\n  state.active = false;\n  state.probeContinuationCancel?.();\n  state.probeContinuationCancel = null;\n  state.queue.clear();\n  state.automaticRetryGenerations.clear();\n  state.forcedContainerGenerations.clear();\n  state.pendingRefresh = null;\n  state.initialDocumentProbe.resetPending();\n  // Drop the per-session discovered suppression cache too: a stopped\n  // reconciler is being torn down (scope/identity change) or paused across\n  // a prerequisite loss, after which every container must be re-validated.\n  state.discoveredContainerIds.clear();\n  // Drop pending self-echo originations too — they are session-scoped and a\n  // teardown invalidates them.\n  clearOriginatedDocuments(host.domainScope);\n}\n\nexport function createReconciliationService(\n  host: ReconciliationHost,\n): ReconciliationService {\n  const state = createReconciliationState(host);\n\n  const scheduleDrain = () => {\n    if (\n      !state.active ||\n      (state.queue.size === 0 && !state.initialDocumentProbe.canRun())\n    ) {\n      return;\n    }\n    if (!canReconcile(host.getRuntimeStatus())) {\n      return;\n    }\n    state.probeContinuationCancel?.();\n    state.probeContinuationCancel = null;\n    state.lane?.requestSync();\n  };\n\n  const enqueueContainer = (\n    containerId: string,\n    priority: ReconcilePriority,\n    force = false,\n  ) => {\n    if (!containerId) {\n      return;\n    }\n    // Skip containers already reconciled this session unless forced. Events\n    // force re-discovery; passive active/backfill scheduling does not, so\n    // opening Explorer does not re-fetch every container on each navigation.\n    if (!force && state.discoveredContainerIds.has(containerId)) {\n      return;\n    }\n    if (force) {\n      markContainerForced(state, containerId);\n    }\n    state.queue.enqueue(containerId, priority);\n    scheduleDrain();\n  };\n\n  const enqueueIdleBackfill = () => {\n    enqueueKnownContainersForIdleBackfill({\n      host,\n      scheduleDrain,\n      state,\n    });\n  };\n\n  return {\n    start: () => {\n      startReconciliationLane(host, state);\n      scheduleDrain();\n    },\n    // Reconcile the active container first; siblings remain lazy until visited.\n    setActiveContainer: (containerId) =>\n      activateContainer(state, containerId, (activeId, force) =>\n        enqueueContainer(activeId, \"active\", force),\n      ),\n    enqueueContainer,\n    enqueueIdleBackfill,\n    resetDiscovered: () => {\n      state.discoveredContainerIds.clear();\n      state.initialDocumentProbe.resetSkippedListings();\n    },\n    reconcileRootContainersNow: () =>\n      requestContainerRefresh({\n        host,\n        state,\n        refreshTree: host.refreshRootTree,\n        listContainerIds: host.listAutomaticRootCatchupContainerIds,\n        scope: \"root\",\n      }),\n    reconcileNow: () =>\n      requestContainerRefresh({\n        host,\n        state,\n        refreshTree: host.refreshTree,\n        listContainerIds: () => listFullRefreshContainerIds(host, state),\n        scope: \"full\",\n      }),\n    stop: () => stopReconciliationService(host, state),\n  };\n}\n"]}

package/sync/reconciliation/serviceTypes.d.ts

@@ -0,0 +1,66 @@
+import type { DocumentSummary } from "../../data/documents/documentSummary.js";
+import type { DomainScope } from "../../data/domainScope.js";
+import type { LocalProjectionReconciledDelta } from "../../stores/local-projection/index.js";
+import type { InitialDocumentProbeHost } from "./initialDocumentProbe.js";
+import type { ReconcilePriority } from "./queue.js";
+export interface ReconciliationRuntimeStatus {
+    dbStatus: string;
+    isAuthenticated: boolean;
+    online: boolean;
+}
+/**
+ * Host contract injected by the device-first facade. Keeps the reconciler
+ * React-free and decoupled from runtime/persistence construction — it only
+ * orchestrates *when* these run and routes their results into Layer A.
+ */
+export interface ReconciliationHost extends InitialDocumentProbeHost {
+    domainScope: DomainScope;
+    getRuntimeStatus: () => ReconciliationRuntimeStatus;
+    /** True when this container has enough remote state to list documents. */
+    canDiscoverContainerDocuments: (containerId: string) => boolean;
+    /** Known container ids eligible for idle document reconciliation. */
+    listKnownContainerIds: () => ReadonlyArray<string>;
+    /** Known ids eligible after an automatic root-lane discovery hint. */
+    listAutomaticRootCatchupContainerIds: () => ReadonlyArray<string>;
+    /** Discover + persist documents; `null` means the lane was not fully listed. */
+    discoverContainerDocuments: (containerId: string, onFullListing?: ((documentIds: ReadonlyArray<string>) => void) | undefined, onPendingDiscovery?: ((delayMs: number) => void) | undefined) => Promise<ReadonlyArray<DocumentSummary> | null>;
+    /** Read a container's freshly-persisted summaries+links from SQLite. */
+    loadContainerDelta: (containerId: string) => Promise<LocalProjectionReconciledDelta>;
+    /** Push a reconciled delta into the local projection store. */
+    applyReconciled: (delta: LocalProjectionReconciledDelta) => void;
+    /**
+     * Sync document bodies for a reconciled container. `force` (an explicit
+     * refresh) revalidates registered ordinary documents and retries system
+     * documents; otherwise only unopened system documents are synced, so a
+     * background pass can materialize projection-owned content without eagerly
+     * opening every ordinary document.
+     */
+    requestDocumentContentPull: (containerId: string, documents: ReadonlyArray<DocumentSummary>, force: boolean) => void;
+    /** Refresh the container tree from the server (explicit refresh). */
+    refreshTree: () => Promise<void>;
+    /** Refresh only the top-level root lane from the server. */
+    refreshRootTree: () => Promise<void>;
+    /** True if the destroyed-db error should be swallowed rather than surfaced. */
+    isIgnorableError: (error: unknown) => boolean;
+    /** Host diagnostics sink; bare runtimes do not structure errors. */
+    logError?: ((message: string, error: unknown) => void) | undefined;
+}
+export interface ReconciliationService {
+    start: () => void;
+    setActiveContainer: (containerId: string | null) => void;
+    enqueueContainer: (containerId: string, priority: ReconcilePriority, force?: boolean) => void;
+    /** Queue known containers at idle priority. */
+    enqueueIdleBackfill: () => void;
+    /**
+     * Forget which containers were reconciled this session so the next enqueue of
+     * each re-validates against the server exactly once. Call on the
+     * cannot-reconcile → can-reconcile edge (relogin/reconnect): the discovered
+     * set is a per-session suppression cache, a previously-visited container may
+     * have changed remotely, and initial-probe listings that exhausted their
+     * retries need a fresh opportunity once the server is reachable again.
+     */
+    resetDiscovered: () => void;
+    reconcileRootContainersNow: () => Promise<void>;
+    reconcileNow: () => Promise<void>;
+    stop: () => void;
+}

package/sync/reconciliation/serviceTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=serviceTypes.js.map

package/sync/reconciliation/serviceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTypes.js","sourceRoot":"","sources":["serviceTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport type { DomainScope } from \"../../data/domainScope\";\nimport type { LocalProjectionReconciledDelta } from \"../../stores/local-projection\";\nimport type { InitialDocumentProbeHost } from \"./initialDocumentProbe\";\nimport type { ReconcilePriority } from \"./queue\";\n\nexport interface ReconciliationRuntimeStatus {\n  dbStatus: string;\n  isAuthenticated: boolean;\n  online: boolean;\n}\n\n/**\n * Host contract injected by the device-first facade. Keeps the reconciler\n * React-free and decoupled from runtime/persistence construction — it only\n * orchestrates *when* these run and routes their results into Layer A.\n */\nexport interface ReconciliationHost extends InitialDocumentProbeHost {\n  domainScope: DomainScope;\n  getRuntimeStatus: () => ReconciliationRuntimeStatus;\n  /** True when this container has enough remote state to list documents. */\n  canDiscoverContainerDocuments: (containerId: string) => boolean;\n  /** Known container ids eligible for idle document reconciliation. */\n  listKnownContainerIds: () => ReadonlyArray<string>;\n  /** Known ids eligible after an automatic root-lane discovery hint. */\n  listAutomaticRootCatchupContainerIds: () => ReadonlyArray<string>;\n  /** Discover + persist documents; `null` means the lane was not fully listed. */\n  discoverContainerDocuments: (\n    containerId: string,\n    onFullListing?: ((documentIds: ReadonlyArray<string>) => void) | undefined,\n    onPendingDiscovery?: ((delayMs: number) => void) | undefined,\n  ) => Promise<ReadonlyArray<DocumentSummary> | null>;\n  /** Read a container's freshly-persisted summaries+links from SQLite. */\n  loadContainerDelta: (\n    containerId: string,\n  ) => Promise<LocalProjectionReconciledDelta>;\n  /** Push a reconciled delta into the local projection store. */\n  applyReconciled: (delta: LocalProjectionReconciledDelta) => void;\n  /**\n   * Sync document bodies for a reconciled container. `force` (an explicit\n   * refresh) revalidates registered ordinary documents and retries system\n   * documents; otherwise only unopened system documents are synced, so a\n   * background pass can materialize projection-owned content without eagerly\n   * opening every ordinary document.\n   */\n  requestDocumentContentPull: (\n    containerId: string,\n    documents: ReadonlyArray<DocumentSummary>,\n    force: boolean,\n  ) => void;\n  /** Refresh the container tree from the server (explicit refresh). */\n  refreshTree: () => Promise<void>;\n  /** Refresh only the top-level root lane from the server. */\n  refreshRootTree: () => Promise<void>;\n  /** True if the destroyed-db error should be swallowed rather than surfaced. */\n  isIgnorableError: (error: unknown) => boolean;\n  /** Host diagnostics sink; bare runtimes do not structure errors. */\n  logError?: ((message: string, error: unknown) => void) | undefined;\n}\n\nexport interface ReconciliationService {\n  start: () => void;\n  setActiveContainer: (containerId: string | null) => void;\n  enqueueContainer: (\n    containerId: string,\n    priority: ReconcilePriority,\n    force?: boolean,\n  ) => void;\n  /** Queue known containers at idle priority. */\n  enqueueIdleBackfill: () => void;\n  /**\n   * Forget which containers were reconciled this session so the next enqueue of\n   * each re-validates against the server exactly once. Call on the\n   * cannot-reconcile → can-reconcile edge (relogin/reconnect): the discovered\n   * set is a per-session suppression cache, a previously-visited container may\n   * have changed remotely, and initial-probe listings that exhausted their\n   * retries need a fresh opportunity once the server is reachable again.\n   */\n  resetDiscovered: () => void;\n  reconcileRootContainersNow: () => Promise<void>;\n  reconcileNow: () => Promise<void>;\n  stop: () => void;\n}\n"]}

package/sync/reconciliation/triggers.d.ts

@@ -0,0 +1,28 @@
+import type { DomainScope } from "../../data/domainScope.js";
+import type { LocalProjectionStore } from "../../stores/local-projection/index.js";
+import type { ReconciliationService } from "./serviceTypes.js";
+/**
+ * Wire the local projection store's reconcile signals into the background
+ * reconciler. Returns an unsubscribe handle. This is the only place Layer A and
+ * Layer B are connected: signals in, scheduling out — no React involved.
+ */
+export declare function connectReconciliationTriggers(input: {
+    store: LocalProjectionStore;
+    service: ReconciliationService;
+}): () => void;
+/**
+ * Translate a batch of server events into reconciler work. Containers named by
+ * document content or structural mutation events are reconciled at active
+ * priority. Document updates must carry the current container-scoped hint shape.
+ *
+ * `domainScope`, when provided, suppresses self-echoes: a `document_update_created`
+ * whose documentId this client just originated (created/uploaded) is dropped
+ * once, since reconciling it would only re-fetch a delta the client already has.
+ * See {@link consumeOriginatedDocument}.
+ */
+export declare function enqueueReconciliationForEvents(input: {
+    domainScope?: DomainScope;
+    events: ReadonlyArray<unknown>;
+    knownContainerIds: ReadonlyArray<string>;
+    service: ReconciliationService;
+}): void;

package/sync/reconciliation/triggers.js

@@ -0,0 +1,93 @@
+import { isDocumentMutationCreatedEvent, isDocumentUpdateCreatedEvent, } from "../../data/documents/documentSync.js";
+import { consumeOriginatedDocument } from "./originatedDocuments.js";
+function enqueueKnownEventContainers(input) {
+    for (const containerId of input.containerIds) {
+        if (input.knownContainerIds.has(containerId)) {
+            input.service.enqueueContainer(containerId, "active", true);
+        }
+    }
+}
+/**
+ * Wire the local projection store's reconcile signals into the background
+ * reconciler. Returns an unsubscribe handle. This is the only place Layer A and
+ * Layer B are connected: signals in, scheduling out — no React involved.
+ */
+export function connectReconciliationTriggers(input) {
+    const { service, store } = input;
+    return store.onReconcileSignal((signal) => {
+        switch (signal.reason) {
+            case "active-changed":
+                service.setActiveContainer(signal.activeContainerId);
+                break;
+            case "hydrated":
+                if (signal.activeContainerId) {
+                    service.enqueueContainer(signal.activeContainerId, "active");
+                }
+                break;
+            case "remote-containers-added":
+                // A cold-cache tree crawl can finish after the auth-edge backfill was
+                // queued. Pick up the newly materialized ids without resetting the
+                // discovered suppression set for containers already reconciled.
+                service.enqueueIdleBackfill();
+                break;
+            case "prerequisites-regained":
+                // Auth/connectivity was just regained (relogin or reconnect). Forget the
+                // per-session discovered set first: containers visited before the gap
+                // may have changed remotely while this client was offline, and the
+                // enqueue calls below are otherwise suppressed for already-discovered
+                // containers. Resetting makes the active container and every backfill
+                // target re-validate against the server exactly once.
+                service.resetDiscovered();
+                if (signal.activeContainerId) {
+                    service.enqueueContainer(signal.activeContainerId, "active");
+                }
+                service.enqueueIdleBackfill();
+                break;
+        }
+    });
+}
+/**
+ * Translate a batch of server events into reconciler work. Containers named by
+ * document content or structural mutation events are reconciled at active
+ * priority. Document updates must carry the current container-scoped hint shape.
+ *
+ * `domainScope`, when provided, suppresses self-echoes: a `document_update_created`
+ * whose documentId this client just originated (created/uploaded) is dropped
+ * once, since reconciling it would only re-fetch a delta the client already has.
+ * See {@link consumeOriginatedDocument}.
+ */
+export function enqueueReconciliationForEvents(input) {
+    const { domainScope, events, knownContainerIds, service } = input;
+    const knownContainerIdSet = new Set(knownContainerIds);
+    for (const event of events) {
+        if (isDocumentMutationCreatedEvent(event)) {
+            // A link-set mutation changes membership even when the document is
+            // already present locally. Never apply content-origination self-echo
+            // suppression here: the server excludes only the exact authoring session,
+            // while another session for the same identity must reconcile both sides.
+            enqueueKnownEventContainers({
+                containerIds: event.containerIds,
+                knownContainerIds: knownContainerIdSet,
+                service,
+            });
+            continue;
+        }
+        if (!isDocumentUpdateCreatedEvent(event)) {
+            continue;
+        }
+        // Self-echo of this client's own create/upload: consume the origination and
+        // skip. Single-use, so a genuine later remote change still reconciles.
+        if (domainScope !== undefined &&
+            consumeOriginatedDocument(domainScope, event.documentId)) {
+            continue;
+        }
+        // Events signal fresh remote data, so force re-discovery even if this
+        // container was already reconciled this session.
+        enqueueKnownEventContainers({
+            containerIds: event.containerIds,
+            knownContainerIds: knownContainerIdSet,
+            service,
+        });
+    }
+}
+//# sourceMappingURL=triggers.js.map

package/sync/reconciliation/triggers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triggers.js","sourceRoot":"","sources":["triggers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,SAAS,2BAA2B,CAAC,KAIpC;IACC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAEjC,OAAO,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,gBAAgB;gBACnB,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACrD,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAC7B,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM;YACR,KAAK,yBAAyB;gBAC5B,sEAAsE;gBACtE,mEAAmE;gBACnE,gEAAgE;gBAChE,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAC9B,MAAM;YACR,KAAK,wBAAwB;gBAC3B,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,sEAAsE;gBACtE,sEAAsE;gBACtE,sDAAsD;gBACtD,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAC7B,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAC9B,MAAM;QACV,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,mEAAmE;YACnE,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,2BAA2B,CAAC;gBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,iBAAiB,EAAE,mBAAmB;gBACtC,OAAO;aACR,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,IACE,WAAW,KAAK,SAAS;YACzB,yBAAyB,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,EACxD,CAAC;YACD,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,iDAAiD;QACjD,2BAA2B,CAAC;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,iBAAiB,EAAE,mBAAmB;YACtC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  isDocumentMutationCreatedEvent,\n  isDocumentUpdateCreatedEvent,\n} from \"../../data/documents/documentSync\";\nimport type { DomainScope } from \"../../data/domainScope\";\nimport type { LocalProjectionStore } from \"../../stores/local-projection\";\nimport { consumeOriginatedDocument } from \"./originatedDocuments\";\nimport type { ReconciliationService } from \"./serviceTypes\";\n\nfunction enqueueKnownEventContainers(input: {\n  readonly containerIds: ReadonlyArray<string>;\n  readonly knownContainerIds: ReadonlySet<string>;\n  readonly service: ReconciliationService;\n}): void {\n  for (const containerId of input.containerIds) {\n    if (input.knownContainerIds.has(containerId)) {\n      input.service.enqueueContainer(containerId, \"active\", true);\n    }\n  }\n}\n\n/**\n * Wire the local projection store's reconcile signals into the background\n * reconciler. Returns an unsubscribe handle. This is the only place Layer A and\n * Layer B are connected: signals in, scheduling out — no React involved.\n */\nexport function connectReconciliationTriggers(input: {\n  store: LocalProjectionStore;\n  service: ReconciliationService;\n}): () => void {\n  const { service, store } = input;\n\n  return store.onReconcileSignal((signal) => {\n    switch (signal.reason) {\n      case \"active-changed\":\n        service.setActiveContainer(signal.activeContainerId);\n        break;\n      case \"hydrated\":\n        if (signal.activeContainerId) {\n          service.enqueueContainer(signal.activeContainerId, \"active\");\n        }\n        break;\n      case \"remote-containers-added\":\n        // A cold-cache tree crawl can finish after the auth-edge backfill was\n        // queued. Pick up the newly materialized ids without resetting the\n        // discovered suppression set for containers already reconciled.\n        service.enqueueIdleBackfill();\n        break;\n      case \"prerequisites-regained\":\n        // Auth/connectivity was just regained (relogin or reconnect). Forget the\n        // per-session discovered set first: containers visited before the gap\n        // may have changed remotely while this client was offline, and the\n        // enqueue calls below are otherwise suppressed for already-discovered\n        // containers. Resetting makes the active container and every backfill\n        // target re-validate against the server exactly once.\n        service.resetDiscovered();\n        if (signal.activeContainerId) {\n          service.enqueueContainer(signal.activeContainerId, \"active\");\n        }\n        service.enqueueIdleBackfill();\n        break;\n    }\n  });\n}\n\n/**\n * Translate a batch of server events into reconciler work. Containers named by\n * document content or structural mutation events are reconciled at active\n * priority. Document updates must carry the current container-scoped hint shape.\n *\n * `domainScope`, when provided, suppresses self-echoes: a `document_update_created`\n * whose documentId this client just originated (created/uploaded) is dropped\n * once, since reconciling it would only re-fetch a delta the client already has.\n * See {@link consumeOriginatedDocument}.\n */\nexport function enqueueReconciliationForEvents(input: {\n  domainScope?: DomainScope;\n  events: ReadonlyArray<unknown>;\n  knownContainerIds: ReadonlyArray<string>;\n  service: ReconciliationService;\n}): void {\n  const { domainScope, events, knownContainerIds, service } = input;\n  const knownContainerIdSet = new Set(knownContainerIds);\n\n  for (const event of events) {\n    if (isDocumentMutationCreatedEvent(event)) {\n      // A link-set mutation changes membership even when the document is\n      // already present locally. Never apply content-origination self-echo\n      // suppression here: the server excludes only the exact authoring session,\n      // while another session for the same identity must reconcile both sides.\n      enqueueKnownEventContainers({\n        containerIds: event.containerIds,\n        knownContainerIds: knownContainerIdSet,\n        service,\n      });\n      continue;\n    }\n    if (!isDocumentUpdateCreatedEvent(event)) {\n      continue;\n    }\n    // Self-echo of this client's own create/upload: consume the origination and\n    // skip. Single-use, so a genuine later remote change still reconciles.\n    if (\n      domainScope !== undefined &&\n      consumeOriginatedDocument(domainScope, event.documentId)\n    ) {\n      continue;\n    }\n    // Events signal fresh remote data, so force re-discovery even if this\n    // container was already reconciled this session.\n    enqueueKnownEventContainers({\n      containerIds: event.containerIds,\n      knownContainerIds: knownContainerIdSet,\n      service,\n    });\n  }\n}\n"]}

package/workflows/blobs/attachmentBindingVerification.js

@@ -0,0 +1,49 @@
+import { KeyingVerificationError, verifyAttachmentBindingEvent, } from "../../internal/crypto/index.js";
+import { readCanonicalJson, readCanonicalRecord, } from "../../data/keyingCanonicalJson.js";
+import { readAccessEvent, readRecordString, readRequiredRecordValue, resolveEventContainerPaths, } from "../../data/keyingProjectionVerification.js";
+export async function assertAttachmentBindingVerified(input) {
+    if (!input.authorization) {
+        throw new Error("Attachment binding lacks verified document authority");
+    }
+    if (!input.binding.bindingEvent ||
+        !input.binding.documentManifestHash ||
+        input.binding.previousBindingId === undefined) {
+        throw new Error("Attachment binding lacks signed verification material");
+    }
+    const eventBundle = readCanonicalRecord(input.binding.bindingEvent, "Attachment binding event bundle");
+    const event = readAccessEvent(readRequiredRecordValue(eventBundle, "event", "Attachment binding event bundle"), "Attachment binding event");
+    const signer = await input.resolveProjectionUserKey(event.signerUserId);
+    if (!signer) {
+        throw new Error("Attachment binding signer identity is unavailable");
+    }
+    const documentManifest = input.authorization.documentManifestByHash.get(input.binding.documentManifestHash);
+    if (!documentManifest) {
+        throw new Error("Attachment binding document manifest is unverified");
+    }
+    const { dependencyContainerPaths } = resolveEventContainerPaths({
+        containerPathByManifestHash: input.authorization.containerPathByManifestHash,
+        dependencyManifestHashes: event.dependencyManifestHashes.filter((hash) => hash !== input.binding.documentManifestHash),
+    });
+    const verified = await verifyAttachmentBindingEvent({
+        authorizationMembership: "referenced",
+        authorizingContainerPaths: dependencyContainerPaths,
+        body: readCanonicalJson(readRequiredRecordValue(eventBundle, "body", "Attachment binding event bundle"), "Attachment binding event body"),
+        documentManifest,
+        event,
+        expectedBindingId: input.binding.bindingId,
+        expectedBlobId: input.binding.blobId,
+        expectedDocumentId: input.expectedDocumentId,
+        expectedDocumentManifestHash: input.binding.documentManifestHash,
+        expectedPreviousBindingId: input.binding.previousBindingId,
+        principalPolicies: input.authorization.principalPolicies,
+        signerPublicKey: signer.signingPublicKey,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    if (verified.value.slotId !== input.expectedSlotId ||
+        readRecordString(eventBundle, "eventHash", "Attachment binding event bundle") !== verified.value.event.eventHash) {
+        throw new KeyingVerificationError("object_mismatch", "Attachment binding slot or event hash is inconsistent");
+    }
+}
+//# sourceMappingURL=attachmentBindingVerification.js.map

package/workflows/blobs/attachmentBindingVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentBindingVerification.js","sourceRoot":"","sources":["attachmentBindingVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,yCAAyC,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAarD;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB;QACnC,KAAK,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,KAAK,CAAC,OAAO,CAAC,YAAY,EAC1B,iCAAiC,CAClC,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAC3B,uBAAuB,CACrB,WAAW,EACX,OAAO,EACP,iCAAiC,CAClC,EACD,0BAA0B,CAC3B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACrE,KAAK,CAAC,OAAO,CAAC,oBAAoB,CACnC,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,wBAAwB,EAAE,GAAG,0BAA0B,CAAC;QAC9D,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;QACjD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,oBAAoB,CACtD;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,uBAAuB,EAAE,YAAY;QACrC,yBAAyB,EAAE,wBAAwB;QACnD,IAAI,EAAE,iBAAiB,CACrB,uBAAuB,CACrB,WAAW,EACX,MAAM,EACN,iCAAiC,CAClC,EACD,+BAA+B,CAChC;QACD,gBAAgB;QAChB,KAAK;QACL,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAC1C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB;QAChE,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAC1D,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;QACxD,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QAC9C,gBAAgB,CACd,WAAW,EACX,WAAW,EACX,iCAAiC,CAClC,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EACpC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  verifyAttachmentBindingEvent,\n} from \"@tearleads/crypto\";\nimport type { DecryptDocumentAttachmentBlobInput } from \"../../data/documents/blob/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../data/keyingCanonicalJson\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  type ProjectionUserKeyResolver,\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n  resolveEventContainerPaths,\n} from \"../../data/keyingProjectionVerification\";\n\nexport async function assertAttachmentBindingVerified(input: {\n  readonly authorization: DocumentWriterProjectionAuthorization | undefined;\n  readonly binding: Pick<\n    DecryptDocumentAttachmentBlobInput[\"binding\"],\n    | \"bindingEvent\"\n    | \"documentManifestHash\"\n    | \"previousBindingId\"\n    | \"bindingId\"\n    | \"blobId\"\n  >;\n  readonly expectedDocumentId: string;\n  readonly expectedSlotId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n}): Promise<void> {\n  if (!input.authorization) {\n    throw new Error(\"Attachment binding lacks verified document authority\");\n  }\n  if (\n    !input.binding.bindingEvent ||\n    !input.binding.documentManifestHash ||\n    input.binding.previousBindingId === undefined\n  ) {\n    throw new Error(\"Attachment binding lacks signed verification material\");\n  }\n  const eventBundle = readCanonicalRecord(\n    input.binding.bindingEvent,\n    \"Attachment binding event bundle\",\n  );\n  const event = readAccessEvent(\n    readRequiredRecordValue(\n      eventBundle,\n      \"event\",\n      \"Attachment binding event bundle\",\n    ),\n    \"Attachment binding event\",\n  );\n  const signer = await input.resolveProjectionUserKey(event.signerUserId);\n  if (!signer) {\n    throw new Error(\"Attachment binding signer identity is unavailable\");\n  }\n  const documentManifest = input.authorization.documentManifestByHash.get(\n    input.binding.documentManifestHash,\n  );\n  if (!documentManifest) {\n    throw new Error(\"Attachment binding document manifest is unverified\");\n  }\n  const { dependencyContainerPaths } = resolveEventContainerPaths({\n    containerPathByManifestHash:\n      input.authorization.containerPathByManifestHash,\n    dependencyManifestHashes: event.dependencyManifestHashes.filter(\n      (hash) => hash !== input.binding.documentManifestHash,\n    ),\n  });\n  const verified = await verifyAttachmentBindingEvent({\n    authorizationMembership: \"referenced\",\n    authorizingContainerPaths: dependencyContainerPaths,\n    body: readCanonicalJson(\n      readRequiredRecordValue(\n        eventBundle,\n        \"body\",\n        \"Attachment binding event bundle\",\n      ),\n      \"Attachment binding event body\",\n    ),\n    documentManifest,\n    event,\n    expectedBindingId: input.binding.bindingId,\n    expectedBlobId: input.binding.blobId,\n    expectedDocumentId: input.expectedDocumentId,\n    expectedDocumentManifestHash: input.binding.documentManifestHash,\n    expectedPreviousBindingId: input.binding.previousBindingId,\n    principalPolicies: input.authorization.principalPolicies,\n    signerPublicKey: signer.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (\n    verified.value.slotId !== input.expectedSlotId ||\n    readRecordString(\n      eventBundle,\n      \"eventHash\",\n      \"Attachment binding event bundle\",\n    ) !== verified.value.event.eventHash\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Attachment binding slot or event hash is inconsistent\",\n    );\n  }\n}\n"]}