@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/container-contents/documentSubtreeQueries.js

@@ -0,0 +1,169 @@
+import { sqlDocumentContainerProjectionPersistence } from "../../data/persistence/containers/documentContainerProjectionPersistence.js";
+import { containerDocumentPlacementKey, listContainerDocumentTombstoneHoldsForDocuments, } from "../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence.js";
+import { sqlDocumentsPersistence } from "../../data/persistence/documents/documentsPersistence.js";
+import { compareContainerContentsDocumentSummaries } from "./documentQueries/rows.js";
+import { listContainerContentsSqlIdBatches } from "./documentQueries/sql.js";
+function addContainerContentsDocumentSummaries(documentSummariesById, documentSummaries) {
+    for (const documentSummary of documentSummaries) {
+        documentSummariesById.set(documentSummary.id, documentSummary);
+    }
+}
+async function listContainerContentsDocumentIdsByContainerIds(execSql, containerIds) {
+    const documentIds = new Set();
+    for (const containerIdBatch of listContainerContentsSqlIdBatches(containerIds)) {
+        const batchDocumentIds = await sqlDocumentContainerProjectionPersistence.listDocumentIdsByContainerIds(execSql, containerIdBatch);
+        for (const documentId of batchDocumentIds) {
+            documentIds.add(documentId);
+        }
+    }
+    return Array.from(documentIds).sort();
+}
+async function listContainerContentsDocumentSummariesByContainerIdsOrDocumentIds(execSql, input) {
+    const documentSummariesById = new Map();
+    for (const containerIdBatch of listContainerContentsSqlIdBatches(input.containerIds)) {
+        addContainerContentsDocumentSummaries(documentSummariesById, await sqlDocumentsPersistence.listDocumentsByContainerIdsOrDocumentIds(execSql, {
+            containerIds: containerIdBatch,
+            documentIds: [],
+        }));
+    }
+    for (const documentIdBatch of listContainerContentsSqlIdBatches(input.documentIds)) {
+        addContainerContentsDocumentSummaries(documentSummariesById, await sqlDocumentsPersistence.listDocumentsByContainerIdsOrDocumentIds(execSql, {
+            containerIds: [],
+            documentIds: documentIdBatch,
+        }));
+    }
+    const documentSummaries = Array.from(documentSummariesById.values());
+    return input.sortDocumentSummaries
+        ? documentSummaries.sort(compareContainerContentsDocumentSummaries)
+        : documentSummaries;
+}
+function heldPlacementKey(documentId, containerId) {
+    return containerDocumentPlacementKey({
+        containerId,
+        documentId: documentId ?? "",
+    });
+}
+function withoutHeldPlacements(linkedContainerIdsByDocumentId, holds) {
+    const held = new Set(holds.map((hold) => heldPlacementKey(hold.documentId, hold.containerId)));
+    if (held.size === 0) {
+        return { held, links: linkedContainerIdsByDocumentId };
+    }
+    return {
+        held,
+        links: new Map(Array.from(linkedContainerIdsByDocumentId, ([documentId, ids]) => [
+            documentId,
+            ids.filter((id) => !held.has(heldPlacementKey(documentId, id))),
+        ])),
+    };
+}
+/**
+ * Shared batched read pipeline for a flat set of container ids: linked
+ * document ids → document summaries → linked container ids per document.
+ * Sorting is optional so device-first projection reads can skip it.
+ */
+export async function listContainerContentsDocumentsForContainers(execSql, containerIds, options) {
+    await sqlDocumentsPersistence.ensureSchema(execSql);
+    const linkedDocumentIds = await listContainerContentsDocumentIdsByContainerIds(execSql, containerIds);
+    const documentSummaries = await listContainerContentsDocumentSummariesByContainerIdsOrDocumentIds(execSql, {
+        containerIds,
+        documentIds: linkedDocumentIds,
+        sortDocumentSummaries: options.sortDocumentSummaries,
+    });
+    const documentIds = Array.from(new Set(documentSummaries.flatMap((documentSummary) => documentSummary.documentId ? [documentSummary.documentId] : [])));
+    const linkedContainerIdsByDocumentId = withoutHeldPlacements(await sqlDocumentContainerProjectionPersistence.listLinkedContainerIdsByDocumentIds(execSql, documentIds), await listContainerDocumentTombstoneHoldsForDocuments(execSql, documentIds));
+    // An earlier link-id read can race a move. Recheck membership against the
+    // summaries and final link read so a fresh trash summary cannot ride stale
+    // root ids into the root view. Notification fences reject older summaries.
+    // A held placement (a listing tombstone awaiting signed evidence) is not a
+    // membership here either, matching the container item and sidebar views.
+    const requestedIds = new Set(containerIds);
+    return {
+        documentSummaries: documentSummaries.filter((summary) => (summary.containerId !== null &&
+            requestedIds.has(summary.containerId) &&
+            !linkedContainerIdsByDocumentId.held.has(heldPlacementKey(summary.documentId, summary.containerId))) ||
+            (summary.documentId !== null &&
+                linkedContainerIdsByDocumentId.links
+                    .get(summary.documentId)
+                    ?.some((id) => requestedIds.has(id)))),
+        linkedContainerIdsByDocumentId: linkedContainerIdsByDocumentId.links,
+    };
+}
+function listContainerContentsContainerSubtreeIds(containersById, rootContainerId) {
+    const childrenByParentId = new Map();
+    for (const containerState of containersById.values()) {
+        const parentId = containerState.container.parentId;
+        if (parentId === null) {
+            continue;
+        }
+        const children = childrenByParentId.get(parentId);
+        if (children) {
+            children.push(containerState.container.id);
+        }
+        else {
+            childrenByParentId.set(parentId, [containerState.container.id]);
+        }
+    }
+    const subtreeIds = [];
+    const stack = [rootContainerId];
+    const visited = new Set();
+    while (stack.length > 0) {
+        const containerId = stack.pop();
+        if (containerId === undefined || visited.has(containerId)) {
+            continue;
+        }
+        visited.add(containerId);
+        if (containersById.has(containerId)) {
+            subtreeIds.push(containerId);
+        }
+        const children = childrenByParentId.get(containerId);
+        if (children) {
+            stack.push(...children);
+        }
+    }
+    return subtreeIds;
+}
+function resolveContainerContentsDocumentRuntimeContainerId(params) {
+    const { documentSummary, linkedContainerIdsByDocumentId, sharedContainerIds, } = params;
+    if (documentSummary.containerId &&
+        sharedContainerIds.has(documentSummary.containerId)) {
+        return documentSummary.containerId;
+    }
+    if (!documentSummary.documentId) {
+        return null;
+    }
+    return (linkedContainerIdsByDocumentId
+        .get(documentSummary.documentId)
+        ?.find((containerId) => sharedContainerIds.has(containerId)) ?? null);
+}
+async function listDocumentRuntimeTargetsForContainerSubtree(input) {
+    const { containersById, execSql, rootContainerId } = input;
+    const sharedContainerIds = new Set(listContainerContentsContainerSubtreeIds(containersById, rootContainerId));
+    if (sharedContainerIds.size === 0) {
+        return [];
+    }
+    const { documentSummaries, linkedContainerIdsByDocumentId } = await listContainerContentsDocumentsForContainers(execSql, Array.from(sharedContainerIds), { sortDocumentSummaries: true });
+    return documentSummaries.flatMap((documentSummary) => {
+        const runtimeContainerId = resolveContainerContentsDocumentRuntimeContainerId({
+            documentSummary,
+            linkedContainerIdsByDocumentId,
+            sharedContainerIds,
+        });
+        if (!runtimeContainerId) {
+            return [];
+        }
+        return [
+            {
+                documentId: documentSummary.documentId,
+                localId: documentSummary.id,
+                runtimeContainerId,
+            },
+        ];
+    });
+}
+export function listDocumentRuntimeTargetsForContainerSubtreeFromRuntime({ runtime, ...input }) {
+    return listDocumentRuntimeTargetsForContainerSubtree({
+        ...input,
+        execSql: runtime.infra.execSql,
+    });
+}
+//# sourceMappingURL=documentSubtreeQueries.js.map

package/workflows/container-contents/documentSubtreeQueries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSubtreeQueries.js","sourceRoot":"","sources":["documentSubtreeQueries.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yCAAyC,EAAE,MAAM,0EAA0E,CAAC;AACrI,OAAO,EACL,6BAA6B,EAC7B,+CAA+C,GAChD,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG,OAAO,EAAE,yCAAyC,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAQ1E,SAAS,qCAAqC,CAC5C,qBAAmD,EACnD,iBAAiD;IAEjD,KAAK,MAAM,eAAe,IAAI,iBAAiB,EAAE,CAAC;QAChD,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8CAA8C,CAC3D,OAAgB,EAChB,YAAmC;IAEnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,gBAAgB,IAAI,iCAAiC,CAC9D,YAAY,CACb,EAAE,CAAC;QACF,MAAM,gBAAgB,GACpB,MAAM,yCAAyC,CAAC,6BAA6B,CAC3E,OAAO,EACP,gBAAgB,CACjB,CAAC;QACJ,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;YAC1C,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,iEAAiE,CAC9E,OAAgB,EAChB,KAIC;IAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjE,KAAK,MAAM,gBAAgB,IAAI,iCAAiC,CAC9D,KAAK,CAAC,YAAY,CACnB,EAAE,CAAC;QACF,qCAAqC,CACnC,qBAAqB,EACrB,MAAM,uBAAuB,CAAC,wCAAwC,CACpE,OAAO,EACP;YACE,YAAY,EAAE,gBAAgB;YAC9B,WAAW,EAAE,EAAE;SAChB,CACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,eAAe,IAAI,iCAAiC,CAC7D,KAAK,CAAC,WAAW,CAClB,EAAE,CAAC;QACF,qCAAqC,CACnC,qBAAqB,EACrB,MAAM,uBAAuB,CAAC,wCAAwC,CACpE,OAAO,EACP;YACE,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,eAAe;SAC7B,CACF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,qBAAqB;QAChC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,yCAAyC,CAAC;QACnE,CAAC,CAAC,iBAAiB,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyB,EACzB,WAAmB;IAEnB,OAAO,6BAA6B,CAAC;QACnC,WAAW;QACX,UAAU,EAAE,UAAU,IAAI,EAAE;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,8BAA0E,EAC1E,KAAiE;IAKjE,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,IAAI,GAAG,CACZ,KAAK,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YAChE,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;SAChE,CAAC,CACH;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,OAAgB,EAChB,YAAmC,EACnC,OAA2C;IAE3C,MAAM,uBAAuB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,iBAAiB,GACrB,MAAM,8CAA8C,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9E,MAAM,iBAAiB,GACrB,MAAM,iEAAiE,CACrE,OAAO,EACP;QACE,YAAY;QACZ,WAAW,EAAE,iBAAiB;QAC9B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CACF,CAAC;IACJ,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CACL,iBAAiB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE,CAC5C,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CACF,CACF,CAAC;IACF,MAAM,8BAA8B,GAAG,qBAAqB,CAC1D,MAAM,yCAAyC,CAAC,mCAAmC,CACjF,OAAO,EACP,WAAW,CACZ,EACD,MAAM,+CAA+C,CAAC,OAAO,EAAE,WAAW,CAAC,CAC5E,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CACzC,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI;YAC3B,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;YACrC,CAAC,8BAA8B,CAAC,IAAI,CAAC,GAAG,CACtC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAC1D,CAAC;YACJ,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI;gBAC1B,8BAA8B,CAAC,KAAK;qBACjC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;oBACxB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAC5C;QACD,8BAA8B,EAAE,8BAA8B,CAAC,KAAK;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,wCAAwC,CAC/C,cAA2E,EAC3E,eAAuB;IAEvB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACvD,KAAK,MAAM,cAAc,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEzB,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kDAAkD,CAAC,MAI3D;IACC,MAAM,EACJ,eAAe,EACf,8BAA8B,EAC9B,kBAAkB,GACnB,GAAG,MAAM,CAAC;IACX,IACE,eAAe,CAAC,WAAW;QAC3B,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,EACnD,CAAC;QACD,OAAO,eAAe,CAAC,WAAW,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,8BAA8B;SAC3B,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC;QAChC,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6CAA6C,CAAC,KAI5D;IACC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC3D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,wCAAwC,CAAC,cAAc,EAAE,eAAe,CAAC,CAC1E,CAAC;IACF,IAAI,kBAAkB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,GACzD,MAAM,2CAA2C,CAC/C,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC9B,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC,CAAC;IAEJ,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;QACnD,MAAM,kBAAkB,GACtB,kDAAkD,CAAC;YACjD,eAAe;YACf,8BAA8B;YAC9B,kBAAkB;SACnB,CAAC,CAAC;QACL,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,UAAU,EAAE,eAAe,CAAC,UAAU;gBACtC,OAAO,EAAE,eAAe,CAAC,EAAE;gBAC3B,kBAAkB;aACnB;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wDAAwD,CAAC,EACvE,OAAO,EACP,GAAG,KAAK,EAMT;IACC,OAAO,6CAA6C,CAAC;QACnD,GAAG,KAAK;QACR,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;KAC/B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { sqlDocumentContainerProjectionPersistence } from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport {\n  containerDocumentPlacementKey,\n  listContainerDocumentTombstoneHoldsForDocuments,\n} from \"../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence\";\nimport { sqlDocumentsPersistence } from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { compareContainerContentsDocumentSummaries } from \"./documentQueries/rows\";\nimport { listContainerContentsSqlIdBatches } from \"./documentQueries/sql\";\nimport type {\n  ContainerContentsContainerSubtreeState,\n  ContainerContentsDocumentRuntimeTarget,\n  ContainerContentsSharedDocumentSummaries,\n  ContainerDocumentQueriesRuntime,\n} from \"./documentQueries/types\";\n\nfunction addContainerContentsDocumentSummaries(\n  documentSummariesById: Map<string, DocumentSummary>,\n  documentSummaries: ReadonlyArray<DocumentSummary>,\n): void {\n  for (const documentSummary of documentSummaries) {\n    documentSummariesById.set(documentSummary.id, documentSummary);\n  }\n}\n\nasync function listContainerContentsDocumentIdsByContainerIds(\n  execSql: ExecSql,\n  containerIds: ReadonlyArray<string>,\n): Promise<string[]> {\n  const documentIds = new Set<string>();\n\n  for (const containerIdBatch of listContainerContentsSqlIdBatches(\n    containerIds,\n  )) {\n    const batchDocumentIds =\n      await sqlDocumentContainerProjectionPersistence.listDocumentIdsByContainerIds(\n        execSql,\n        containerIdBatch,\n      );\n    for (const documentId of batchDocumentIds) {\n      documentIds.add(documentId);\n    }\n  }\n\n  return Array.from(documentIds).sort();\n}\n\nasync function listContainerContentsDocumentSummariesByContainerIdsOrDocumentIds(\n  execSql: ExecSql,\n  input: {\n    containerIds: ReadonlyArray<string>;\n    documentIds: ReadonlyArray<string>;\n    sortDocumentSummaries: boolean;\n  },\n): Promise<DocumentSummary[]> {\n  const documentSummariesById = new Map<string, DocumentSummary>();\n\n  for (const containerIdBatch of listContainerContentsSqlIdBatches(\n    input.containerIds,\n  )) {\n    addContainerContentsDocumentSummaries(\n      documentSummariesById,\n      await sqlDocumentsPersistence.listDocumentsByContainerIdsOrDocumentIds(\n        execSql,\n        {\n          containerIds: containerIdBatch,\n          documentIds: [],\n        },\n      ),\n    );\n  }\n\n  for (const documentIdBatch of listContainerContentsSqlIdBatches(\n    input.documentIds,\n  )) {\n    addContainerContentsDocumentSummaries(\n      documentSummariesById,\n      await sqlDocumentsPersistence.listDocumentsByContainerIdsOrDocumentIds(\n        execSql,\n        {\n          containerIds: [],\n          documentIds: documentIdBatch,\n        },\n      ),\n    );\n  }\n\n  const documentSummaries = Array.from(documentSummariesById.values());\n  return input.sortDocumentSummaries\n    ? documentSummaries.sort(compareContainerContentsDocumentSummaries)\n    : documentSummaries;\n}\n\nfunction heldPlacementKey(\n  documentId: string | null,\n  containerId: string,\n): string {\n  return containerDocumentPlacementKey({\n    containerId,\n    documentId: documentId ?? \"\",\n  });\n}\n\nfunction withoutHeldPlacements(\n  linkedContainerIdsByDocumentId: ReadonlyMap<string, ReadonlyArray<string>>,\n  holds: ReadonlyArray<{ containerId: string; documentId: string }>,\n): {\n  held: ReadonlySet<string>;\n  links: ReadonlyMap<string, ReadonlyArray<string>>;\n} {\n  const held = new Set(\n    holds.map((hold) => heldPlacementKey(hold.documentId, hold.containerId)),\n  );\n  if (held.size === 0) {\n    return { held, links: linkedContainerIdsByDocumentId };\n  }\n  return {\n    held,\n    links: new Map(\n      Array.from(linkedContainerIdsByDocumentId, ([documentId, ids]) => [\n        documentId,\n        ids.filter((id) => !held.has(heldPlacementKey(documentId, id))),\n      ]),\n    ),\n  };\n}\n\n/**\n * Shared batched read pipeline for a flat set of container ids: linked\n * document ids → document summaries → linked container ids per document.\n * Sorting is optional so device-first projection reads can skip it.\n */\nexport async function listContainerContentsDocumentsForContainers(\n  execSql: ExecSql,\n  containerIds: ReadonlyArray<string>,\n  options: { sortDocumentSummaries: boolean },\n): Promise<ContainerContentsSharedDocumentSummaries> {\n  await sqlDocumentsPersistence.ensureSchema(execSql);\n  const linkedDocumentIds =\n    await listContainerContentsDocumentIdsByContainerIds(execSql, containerIds);\n  const documentSummaries =\n    await listContainerContentsDocumentSummariesByContainerIdsOrDocumentIds(\n      execSql,\n      {\n        containerIds,\n        documentIds: linkedDocumentIds,\n        sortDocumentSummaries: options.sortDocumentSummaries,\n      },\n    );\n  const documentIds = Array.from(\n    new Set(\n      documentSummaries.flatMap((documentSummary) =>\n        documentSummary.documentId ? [documentSummary.documentId] : [],\n      ),\n    ),\n  );\n  const linkedContainerIdsByDocumentId = withoutHeldPlacements(\n    await sqlDocumentContainerProjectionPersistence.listLinkedContainerIdsByDocumentIds(\n      execSql,\n      documentIds,\n    ),\n    await listContainerDocumentTombstoneHoldsForDocuments(execSql, documentIds),\n  );\n\n  // An earlier link-id read can race a move. Recheck membership against the\n  // summaries and final link read so a fresh trash summary cannot ride stale\n  // root ids into the root view. Notification fences reject older summaries.\n  // A held placement (a listing tombstone awaiting signed evidence) is not a\n  // membership here either, matching the container item and sidebar views.\n  const requestedIds = new Set(containerIds);\n  return {\n    documentSummaries: documentSummaries.filter(\n      (summary) =>\n        (summary.containerId !== null &&\n          requestedIds.has(summary.containerId) &&\n          !linkedContainerIdsByDocumentId.held.has(\n            heldPlacementKey(summary.documentId, summary.containerId),\n          )) ||\n        (summary.documentId !== null &&\n          linkedContainerIdsByDocumentId.links\n            .get(summary.documentId)\n            ?.some((id) => requestedIds.has(id))),\n    ),\n    linkedContainerIdsByDocumentId: linkedContainerIdsByDocumentId.links,\n  };\n}\n\nfunction listContainerContentsContainerSubtreeIds(\n  containersById: ReadonlyMap<string, ContainerContentsContainerSubtreeState>,\n  rootContainerId: string,\n): string[] {\n  const childrenByParentId = new Map<string, string[]>();\n  for (const containerState of containersById.values()) {\n    const parentId = containerState.container.parentId;\n    if (parentId === null) {\n      continue;\n    }\n\n    const children = childrenByParentId.get(parentId);\n    if (children) {\n      children.push(containerState.container.id);\n    } else {\n      childrenByParentId.set(parentId, [containerState.container.id]);\n    }\n  }\n\n  const subtreeIds: string[] = [];\n  const stack = [rootContainerId];\n  const visited = new Set<string>();\n  while (stack.length > 0) {\n    const containerId = stack.pop();\n    if (containerId === undefined || visited.has(containerId)) {\n      continue;\n    }\n    visited.add(containerId);\n\n    if (containersById.has(containerId)) {\n      subtreeIds.push(containerId);\n    }\n\n    const children = childrenByParentId.get(containerId);\n    if (children) {\n      stack.push(...children);\n    }\n  }\n\n  return subtreeIds;\n}\n\nfunction resolveContainerContentsDocumentRuntimeContainerId(params: {\n  documentSummary: Pick<DocumentSummary, \"containerId\" | \"documentId\">;\n  linkedContainerIdsByDocumentId: ReadonlyMap<string, ReadonlyArray<string>>;\n  sharedContainerIds: ReadonlySet<string>;\n}): string | null {\n  const {\n    documentSummary,\n    linkedContainerIdsByDocumentId,\n    sharedContainerIds,\n  } = params;\n  if (\n    documentSummary.containerId &&\n    sharedContainerIds.has(documentSummary.containerId)\n  ) {\n    return documentSummary.containerId;\n  }\n\n  if (!documentSummary.documentId) {\n    return null;\n  }\n\n  return (\n    linkedContainerIdsByDocumentId\n      .get(documentSummary.documentId)\n      ?.find((containerId) => sharedContainerIds.has(containerId)) ?? null\n  );\n}\n\nasync function listDocumentRuntimeTargetsForContainerSubtree(input: {\n  containersById: ReadonlyMap<string, ContainerContentsContainerSubtreeState>;\n  execSql: ExecSql;\n  rootContainerId: string;\n}): Promise<ContainerContentsDocumentRuntimeTarget[]> {\n  const { containersById, execSql, rootContainerId } = input;\n  const sharedContainerIds = new Set(\n    listContainerContentsContainerSubtreeIds(containersById, rootContainerId),\n  );\n  if (sharedContainerIds.size === 0) {\n    return [];\n  }\n\n  const { documentSummaries, linkedContainerIdsByDocumentId } =\n    await listContainerContentsDocumentsForContainers(\n      execSql,\n      Array.from(sharedContainerIds),\n      { sortDocumentSummaries: true },\n    );\n\n  return documentSummaries.flatMap((documentSummary) => {\n    const runtimeContainerId =\n      resolveContainerContentsDocumentRuntimeContainerId({\n        documentSummary,\n        linkedContainerIdsByDocumentId,\n        sharedContainerIds,\n      });\n    if (!runtimeContainerId) {\n      return [];\n    }\n\n    return [\n      {\n        documentId: documentSummary.documentId,\n        localId: documentSummary.id,\n        runtimeContainerId,\n      },\n    ];\n  });\n}\n\nexport function listDocumentRuntimeTargetsForContainerSubtreeFromRuntime({\n  runtime,\n  ...input\n}: Omit<\n  Parameters<typeof listDocumentRuntimeTargetsForContainerSubtree>[0],\n  \"execSql\"\n> & {\n  runtime: ContainerDocumentQueriesRuntime;\n}): ReturnType<typeof listDocumentRuntimeTargetsForContainerSubtree> {\n  return listDocumentRuntimeTargetsForContainerSubtree({\n    ...input,\n    execSql: runtime.infra.execSql,\n  });\n}\n"]}

package/workflows/container-contents/documentTombstoneEvidence.js

@@ -0,0 +1,162 @@
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../internal/validators/response/index.js";
+import { assertDocumentWriterProjectionConsistent } from "../../data/documents/shared/projection.js";
+import { uniqueSortedStrings } from "../../data/documents/shared/readers.js";
+import { reportKeyingVerificationErrorInCauseChain } from "../../data/keyingProjectionVerification/error.js";
+import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
+import { loadDocumentPurgeCheckpoint } from "../../data/persistence/documentPurgeCheckpointPersistence.js";
+import { createRuntimePrincipalPolicyWarmer } from "../principals/runtimePolicyWarmer.js";
+import { documentHeadMatchesOrganization } from "./documentHeadScope.js";
+export const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;
+/**
+ * Head loads per settle. Tombstones beyond it stay unverified and are held
+ * for a later, backed-off retry, so a bulk move out of a folder does not cost
+ * every device an unbounded burst of fetches before the watermark advances.
+ */
+export const HEAD_LINK_SET_LOADS_PER_RUN = 32;
+async function verifiedHeadLinkSet(runtime, deps, documentId, projection) {
+    const verified = {};
+    await deps.assertDocumentWriterProjectionConsistent(projection, {
+        // Only the link set is read; a bundle wrapped to superseded KEK targets
+        // still carries the signed head.
+        allowStaleContentKeyBundle: true,
+        execSql: runtime.infra.execSql,
+        onVerifiedAuthorization: (authorization) => {
+            const head = authorization.documentManifestByHash.get(projection.documentManifest.manifestHash);
+            if (head && head.state.documentId === documentId) {
+                verified.value = {
+                    organizationId: head.state.organizationId,
+                    accessEpoch: head.state.epoch,
+                    accessStateHash: head.manifestHash,
+                    linkedContainerIds: uniqueSortedStrings(head.state.linkedContainerIds),
+                };
+            }
+        },
+        resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
+    });
+    if (!verified.value) {
+        throw new Error("Tombstone evidence lacks a verified document head");
+    }
+    return verified.value;
+}
+export function createDocumentHeadLinkSetLoader(runtime, deps = {
+    assertDocumentWriterProjectionConsistent,
+    loadDocumentPurgeCheckpoint,
+}) {
+    return async (documentId, expectedManifestHash) => {
+        try {
+            // A verified purge proof is terminal signed evidence that the document
+            // links nothing any more.
+            if (await deps.loadDocumentPurgeCheckpoint(runtime.infra.execSql, documentId)) {
+                return {
+                    organizationId: null,
+                    accessEpoch: Number.MAX_SAFE_INTEGER,
+                    linkedContainerIds: [],
+                };
+            }
+            // Tombstones require a fresh head. Listings can reuse a matching cached
+            // projection, whose signature and local checkpoint are still verified.
+            if (!expectedManifestHash)
+                runtime.apiClient.evictDocumentWriterProjection(documentId);
+            let result = await runtime.apiClient.getDocumentWriterProjectionResult(documentId, { reportErrors: false });
+            if (expectedManifestHash &&
+                result.ok &&
+                result.data.documentManifest.manifestHash !== expectedManifestHash) {
+                runtime.apiClient.evictDocumentWriterProjection(documentId);
+                result = await runtime.apiClient.getDocumentWriterProjectionResult(documentId, { reportErrors: false });
+            }
+            if (!result.ok) {
+                if (result.status === 404 &&
+                    result.code === DOCUMENT_NOT_FOUND_ERROR_CODE)
+                    return "not-found";
+                runtime.util.log(`Container contents: tombstone evidence for document ${documentId} is unavailable (${result.status ?? "offline"})`);
+                return null;
+            }
+            return await verifiedHeadLinkSet(runtime, deps, documentId, result.data);
+        }
+        catch (error) {
+            // Any failure leaves the tombstone unverified (held and retried); a
+            // thrown error here must not fail the whole discovery pass.
+            await reportKeyingVerificationErrorInCauseChain(error, runtime.util.reportSecurityIncident, {
+                objectId: documentId,
+                objectKind: "document",
+                operation: "document.tombstone-evidence",
+            });
+            try {
+                // A host logger that throws must not fail the discovery pass.
+                runtime.util.logError?.("Container contents: tombstone evidence is unavailable", error);
+            }
+            catch {
+                // Hosts may throw synchronously.
+            }
+            return null;
+        }
+    };
+}
+function judgeTombstones(tombstones, head) {
+    return tombstones.map((tombstone) => {
+        if (head === null) {
+            return { kind: "unverified", tombstone };
+        }
+        if (head.linkedContainerIds.includes(tombstone.containerId)) {
+            return {
+                kind: "refuted",
+                linkedContainerIds: head.linkedContainerIds,
+                tombstone,
+            };
+        }
+        return {
+            kind: "verified",
+            tombstone: {
+                ...tombstone,
+                accessEpoch: head.accessEpoch,
+                linkedContainerIds: head.linkedContainerIds,
+            },
+        };
+    });
+}
+/**
+ * Judge listing tombstones against each document's verified head link set,
+ * fetched once per document with bounded concurrency and a per-run cap. A
+ * head whose epoch is below local document state is no evidence: it may be a
+ * lagging replica or a replay, and applying it could delete rows a newer
+ * listing or settled move wrote.
+ */
+export function createContainerDocumentTombstoneVerifier(organizationId, loadDocumentHeadLinkSet, loadLocalDocumentAccessEpoch) {
+    return async (tombstones) => {
+        const byDocumentId = new Map();
+        for (const tombstone of tombstones) {
+            const group = byDocumentId.get(tombstone.documentId) ?? [];
+            group.push(tombstone);
+            byDocumentId.set(tombstone.documentId, group);
+        }
+        const groups = [...byDocumentId.entries()];
+        const verdicts = groups.map(([, group], index) => index < HEAD_LINK_SET_LOADS_PER_RUN
+            ? judgeTombstones(group, null)
+            : group.map((tombstone) => ({ kind: "deferred", tombstone })));
+        let next = 0;
+        const worker = async () => {
+            while (next < Math.min(groups.length, HEAD_LINK_SET_LOADS_PER_RUN)) {
+                const index = next++;
+                const entry = groups[index];
+                if (!entry)
+                    break;
+                const [documentId, group] = entry;
+                const head = await loadDocumentHeadLinkSet(documentId);
+                if (head === null || head === "not-found")
+                    continue;
+                if (!documentHeadMatchesOrganization(head, organizationId))
+                    continue;
+                // A local-state read that fails is treated like an unavailable head:
+                // the tombstones stay held rather than failing the discovery pass.
+                const localEpoch = await loadLocalDocumentAccessEpoch(documentId).catch(() => Number.MAX_SAFE_INTEGER);
+                if (head.accessEpoch < localEpoch)
+                    continue;
+                verdicts[index] = judgeTombstones(group, head);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(HEAD_LINK_SET_LOAD_CONCURRENCY, groups.length) }, worker));
+        return verdicts.flat();
+    };
+}
+//# sourceMappingURL=documentTombstoneEvidence.js.map

package/workflows/container-contents/documentTombstoneEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentTombstoneEvidence.js","sourceRoot":"","sources":["documentTombstoneEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,GAE9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,yCAAyC,EAAE,MAAM,+CAA+C,CAAC;AAC1G,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AACxG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AAMvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AA+BtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,KAAK,UAAU,mBAAmB,CAChC,OAAyC,EACzC,IAAmC,EACnC,UAAkB,EAClB,UAA4C;IAE5C,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,IAAI,CAAC,wCAAwC,CAAC,UAAU,EAAE;QAC9D,wEAAwE;QACxE,iCAAiC;QACjC,0BAA0B,EAAE,IAAI;QAChC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACnD,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzC,CAAC;YACF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACjD,QAAQ,CAAC,KAAK,GAAG;oBACf,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;oBACzC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;oBAC7B,eAAe,EAAE,IAAI,CAAC,YAAY;oBAClC,kBAAkB,EAAE,mBAAmB,CACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAyC,EACzC,OAAsC;IACpC,wCAAwC;IACxC,2BAA2B;CAC5B;IAED,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,uEAAuE;YACvE,0BAA0B;YAC1B,IACE,MAAM,IAAI,CAAC,2BAA2B,CACpC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,UAAU,CACX,EACD,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,MAAM,CAAC,gBAAgB;oBACpC,kBAAkB,EAAE,EAAE;iBACvB,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC,oBAAoB;gBACvB,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CACpE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACF,IACE,oBAAoB;gBACpB,MAAM,CAAC,EAAE;gBACT,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,KAAK,oBAAoB,EAClE,CAAC;gBACD,OAAO,CAAC,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;gBAC5D,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,iCAAiC,CAChE,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IACE,MAAM,CAAC,MAAM,KAAK,GAAG;oBACrB,MAAM,CAAC,IAAI,KAAK,6BAA6B;oBAE7C,OAAO,WAAW,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,uDAAuD,UAAU,oBAAoB,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,CACnH,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,yCAAyC,CAC7C,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,UAAU;gBACtB,SAAS,EAAE,6BAA6B;aACzC,CACF,CAAC;YACF,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CACrB,uDAAuD,EACvD,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,UAAqD,EACrD,IAAwC;IAExC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAqC,EAAE;QACrE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,SAAS;aACV,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE;gBACT,GAAG,SAAS;gBACZ,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAkC,EAClC,uBAAkD,EAClD,4BAA4D;IAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE;QAC1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAA0C,MAAM,CAAC,GAAG,CAChE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAuC,EAAE,CACxD,KAAK,GAAG,2BAA2B;YACjC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAClE,CAAC;QACF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK;oBAAE,MAAM;gBAClB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBACvD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW;oBAAE,SAAS;gBACpD,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,cAAc,CAAC;oBAAE,SAAS;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;gBACF,IAAI,IAAI,CAAC,WAAW,GAAG,UAAU;oBAAE,SAAS;gBAC5C,QAAQ,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EACnE,MAAM,CACP,CACF,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../data/documents/shared/readers\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../data/keyingProjectionVerification/error\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport { loadDocumentPurgeCheckpoint } from \"../../data/persistence/documentPurgeCheckpointPersistence\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../principals/runtimePolicyWarmer\";\nimport type {\n  ContainerDocumentTombstone,\n  ContainerDocumentTombstoneVerdict,\n  ContainerDocumentTombstoneVerifier,\n} from \"./documentDiscoveryTypes\";\nimport { documentHeadMatchesOrganization } from \"./documentHeadScope\";\nimport type { ContainerContentsWorkflowRuntime } from \"./runtime\";\n\nexport interface VerifiedDocumentHeadLinkSet {\n  readonly organizationId: string | null;\n  readonly accessEpoch: number;\n  /** Present for a signed head; a terminal purge has no live access state. */\n  readonly accessStateHash?: string;\n  readonly linkedContainerIds: ReadonlyArray<string>;\n}\n\n/**\n * The document's verified head link set, or `null` when no verified head is\n * available: the projection could not be fetched (the requester may no\n * longer read the document, or it was purged) or failed verification.\n */\nexport type DocumentHeadLinkSetLoader = (\n  documentId: string,\n  expectedManifestHash?: string,\n) => Promise<VerifiedDocumentHeadLinkSet | \"not-found\" | null>;\n\n/** The highest access epoch local state records for the document. */\nexport type LocalDocumentAccessEpochLoader = (\n  documentId: string,\n) => Promise<number>;\n\nexport interface DocumentHeadLinkSetLoaderDeps {\n  readonly assertDocumentWriterProjectionConsistent: typeof assertDocumentWriterProjectionConsistent;\n  readonly loadDocumentPurgeCheckpoint: typeof loadDocumentPurgeCheckpoint;\n}\n\nexport const HEAD_LINK_SET_LOAD_CONCURRENCY = 4;\n/**\n * Head loads per settle. Tombstones beyond it stay unverified and are held\n * for a later, backed-off retry, so a bulk move out of a folder does not cost\n * every device an unbounded burst of fetches before the watermark advances.\n */\nexport const HEAD_LINK_SET_LOADS_PER_RUN = 32;\n\nasync function verifiedHeadLinkSet(\n  runtime: ContainerContentsWorkflowRuntime,\n  deps: DocumentHeadLinkSetLoaderDeps,\n  documentId: string,\n  projection: DocumentWriterProjectionResponse,\n): Promise<VerifiedDocumentHeadLinkSet> {\n  const verified: { value?: VerifiedDocumentHeadLinkSet } = {};\n  await deps.assertDocumentWriterProjectionConsistent(projection, {\n    // Only the link set is read; a bundle wrapped to superseded KEK targets\n    // still carries the signed head.\n    allowStaleContentKeyBundle: true,\n    execSql: runtime.infra.execSql,\n    onVerifiedAuthorization: (authorization) => {\n      const head = authorization.documentManifestByHash.get(\n        projection.documentManifest.manifestHash,\n      );\n      if (head && head.state.documentId === documentId) {\n        verified.value = {\n          organizationId: head.state.organizationId,\n          accessEpoch: head.state.epoch,\n          accessStateHash: head.manifestHash,\n          linkedContainerIds: uniqueSortedStrings(\n            head.state.linkedContainerIds,\n          ),\n        };\n      }\n    },\n    resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  });\n  if (!verified.value) {\n    throw new Error(\"Tombstone evidence lacks a verified document head\");\n  }\n  return verified.value;\n}\n\nexport function createDocumentHeadLinkSetLoader(\n  runtime: ContainerContentsWorkflowRuntime,\n  deps: DocumentHeadLinkSetLoaderDeps = {\n    assertDocumentWriterProjectionConsistent,\n    loadDocumentPurgeCheckpoint,\n  },\n): DocumentHeadLinkSetLoader {\n  return async (documentId, expectedManifestHash) => {\n    try {\n      // A verified purge proof is terminal signed evidence that the document\n      // links nothing any more.\n      if (\n        await deps.loadDocumentPurgeCheckpoint(\n          runtime.infra.execSql,\n          documentId,\n        )\n      ) {\n        return {\n          organizationId: null,\n          accessEpoch: Number.MAX_SAFE_INTEGER,\n          linkedContainerIds: [],\n        };\n      }\n      // Tombstones require a fresh head. Listings can reuse a matching cached\n      // projection, whose signature and local checkpoint are still verified.\n      if (!expectedManifestHash)\n        runtime.apiClient.evictDocumentWriterProjection(documentId);\n      let result = await runtime.apiClient.getDocumentWriterProjectionResult(\n        documentId,\n        { reportErrors: false },\n      );\n      if (\n        expectedManifestHash &&\n        result.ok &&\n        result.data.documentManifest.manifestHash !== expectedManifestHash\n      ) {\n        runtime.apiClient.evictDocumentWriterProjection(documentId);\n        result = await runtime.apiClient.getDocumentWriterProjectionResult(\n          documentId,\n          { reportErrors: false },\n        );\n      }\n      if (!result.ok) {\n        if (\n          result.status === 404 &&\n          result.code === DOCUMENT_NOT_FOUND_ERROR_CODE\n        )\n          return \"not-found\";\n        runtime.util.log(\n          `Container contents: tombstone evidence for document ${documentId} is unavailable (${result.status ?? \"offline\"})`,\n        );\n        return null;\n      }\n      return await verifiedHeadLinkSet(runtime, deps, documentId, result.data);\n    } catch (error) {\n      // Any failure leaves the tombstone unverified (held and retried); a\n      // thrown error here must not fail the whole discovery pass.\n      await reportKeyingVerificationErrorInCauseChain(\n        error,\n        runtime.util.reportSecurityIncident,\n        {\n          objectId: documentId,\n          objectKind: \"document\",\n          operation: \"document.tombstone-evidence\",\n        },\n      );\n      try {\n        // A host logger that throws must not fail the discovery pass.\n        runtime.util.logError?.(\n          \"Container contents: tombstone evidence is unavailable\",\n          error,\n        );\n      } catch {\n        // Hosts may throw synchronously.\n      }\n      return null;\n    }\n  };\n}\n\nfunction judgeTombstones(\n  tombstones: ReadonlyArray<ContainerDocumentTombstone>,\n  head: VerifiedDocumentHeadLinkSet | null,\n): ContainerDocumentTombstoneVerdict[] {\n  return tombstones.map((tombstone): ContainerDocumentTombstoneVerdict => {\n    if (head === null) {\n      return { kind: \"unverified\", tombstone };\n    }\n    if (head.linkedContainerIds.includes(tombstone.containerId)) {\n      return {\n        kind: \"refuted\",\n        linkedContainerIds: head.linkedContainerIds,\n        tombstone,\n      };\n    }\n    return {\n      kind: \"verified\",\n      tombstone: {\n        ...tombstone,\n        accessEpoch: head.accessEpoch,\n        linkedContainerIds: head.linkedContainerIds,\n      },\n    };\n  });\n}\n\n/**\n * Judge listing tombstones against each document's verified head link set,\n * fetched once per document with bounded concurrency and a per-run cap. A\n * head whose epoch is below local document state is no evidence: it may be a\n * lagging replica or a replay, and applying it could delete rows a newer\n * listing or settled move wrote.\n */\nexport function createContainerDocumentTombstoneVerifier(\n  organizationId: string | undefined,\n  loadDocumentHeadLinkSet: DocumentHeadLinkSetLoader,\n  loadLocalDocumentAccessEpoch: LocalDocumentAccessEpochLoader,\n): ContainerDocumentTombstoneVerifier {\n  return async (tombstones) => {\n    const byDocumentId = new Map<string, ContainerDocumentTombstone[]>();\n    for (const tombstone of tombstones) {\n      const group = byDocumentId.get(tombstone.documentId) ?? [];\n      group.push(tombstone);\n      byDocumentId.set(tombstone.documentId, group);\n    }\n    const groups = [...byDocumentId.entries()];\n    const verdicts: ContainerDocumentTombstoneVerdict[][] = groups.map(\n      ([, group], index): ContainerDocumentTombstoneVerdict[] =>\n        index < HEAD_LINK_SET_LOADS_PER_RUN\n          ? judgeTombstones(group, null)\n          : group.map((tombstone) => ({ kind: \"deferred\", tombstone })),\n    );\n    let next = 0;\n    const worker = async () => {\n      while (next < Math.min(groups.length, HEAD_LINK_SET_LOADS_PER_RUN)) {\n        const index = next++;\n        const entry = groups[index];\n        if (!entry) break;\n        const [documentId, group] = entry;\n        const head = await loadDocumentHeadLinkSet(documentId);\n        if (head === null || head === \"not-found\") continue;\n        if (!documentHeadMatchesOrganization(head, organizationId)) continue;\n        // A local-state read that fails is treated like an unavailable head:\n        // the tombstones stay held rather than failing the discovery pass.\n        const localEpoch = await loadLocalDocumentAccessEpoch(documentId).catch(\n          () => Number.MAX_SAFE_INTEGER,\n        );\n        if (head.accessEpoch < localEpoch) continue;\n        verdicts[index] = judgeTombstones(group, head);\n      }\n    };\n    await Promise.all(\n      Array.from(\n        { length: Math.min(HEAD_LINK_SET_LOAD_CONCURRENCY, groups.length) },\n        worker,\n      ),\n    );\n    return verdicts.flat();\n  };\n}\n"]}

package/workflows/container-contents/documentTombstoneGate.js

@@ -0,0 +1,94 @@
+import { containerDocumentPlacementKey as placementKey } from "../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence.js";
+function dedupePlacements(placements) {
+    const seen = new Set();
+    return placements.filter((placement) => {
+        const key = placementKey(placement);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * One candidate per placement the device actually holds; the newest server
+ * timestamp wins. A tombstone for a placement this device never had has
+ * nothing to remove or hide, so its head is not fetched.
+ */
+async function mergeTombstoneCandidates(store, listed, held) {
+    const known = new Set((await store.listKnownContainerDocumentPlacements(listed)).map(placementKey));
+    const byPlacement = new Map();
+    for (const tombstone of [
+        ...held,
+        ...listed.filter((tombstone) => known.has(placementKey(tombstone))),
+    ]) {
+        const key = placementKey(tombstone);
+        const current = byPlacement.get(key);
+        if (!current ||
+            Date.parse(current.updatedAt) < Date.parse(tombstone.updatedAt)) {
+            byPlacement.set(key, tombstone);
+        }
+    }
+    return [...byPlacement.values()];
+}
+function assertVerdictsCoverCandidates(candidates, verdicts) {
+    const verdictKeys = new Set(verdicts.map((verdict) => placementKey(verdict.tombstone)));
+    if (verdictKeys.size !== verdicts.length ||
+        verdictKeys.size !== candidates.length ||
+        candidates.some((candidate) => !verdictKeys.has(placementKey(candidate)))) {
+        throw new Error("Container document tombstone verification must return one verdict per tombstone");
+    }
+}
+/**
+ * Apply a tombstone only when the signed head omits its container. Unavailable
+ * heads leave hidden placements. A head that still links a container keeps its
+ * placement visible, but retains a backed-off retry: even an uncached signed
+ * head can lag the listing, so its refutation must not discard an honest move.
+ * Listing items pass their own signed-head gate before reaching persistence.
+ */
+export async function settleContainerDocumentTombstones(input) {
+    const { store } = input;
+    const held = await store.listHeldContainerDocumentTombstones(input.containerIds);
+    const candidates = await mergeTombstoneCandidates(store, input.tombstones, held);
+    if (candidates.length === 0) {
+        return [];
+    }
+    const verdicts = await store.verifyContainerDocumentTombstones(candidates);
+    assertVerdictsCoverCandidates(candidates, verdicts);
+    const verified = verdicts.flatMap((verdict) => verdict.kind === "verified" ? [verdict.tombstone] : []);
+    const refuted = verdicts.flatMap((verdict) => verdict.kind === "refuted" ? [verdict.tombstone] : []);
+    const unverified = verdicts.flatMap((verdict) => verdict.kind === "unverified" ? [verdict.tombstone] : []);
+    const deferred = verdicts.flatMap((verdict) => verdict.kind === "deferred"
+        ? [{ ...verdict.tombstone, deferred: true }]
+        : []);
+    // A loaded head is evidence for every placement it links, including holds
+    // on this document that were not due this run: make them visible while
+    // retaining each retry, since the head may lag any of those tombstones.
+    const headLinkedPlacements = verdicts.flatMap((verdict) => {
+        if (verdict.kind !== "verified" && verdict.kind !== "refuted")
+            return [];
+        const linked = verdict.kind === "verified"
+            ? verdict.tombstone.linkedContainerIds
+            : verdict.linkedContainerIds;
+        return linked.map((containerId) => ({
+            containerId,
+            documentId: verdict.tombstone.documentId,
+        }));
+    });
+    const summaries = verified.length > 0
+        ? await store.applyContainerDocumentTombstones(verified)
+        : [];
+    const retryKeys = new Set(refuted.map(placementKey));
+    const visibleRetries = dedupePlacements(headLinkedPlacements).filter((placement) => !retryKeys.has(placementKey(placement)));
+    if (visibleRetries.length > 0) {
+        await store.refuteContainerDocumentTombstoneHolds(visibleRetries);
+    }
+    const retries = [
+        ...unverified,
+        ...deferred,
+        ...refuted.map((tombstone) => ({ ...tombstone, refuted: true })),
+    ];
+    if (retries.length > 0)
+        await store.holdContainerDocumentTombstones(retries);
+    return summaries;
+}
+//# sourceMappingURL=documentTombstoneGate.js.map

package/workflows/container-contents/documentTombstoneGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentTombstoneGate.js","sourceRoot":"","sources":["documentTombstoneGate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,IAAI,YAAY,EAAE,MAAM,6EAA6E,CAAC;AAkB5I,SAAS,gBAAgB,CACvB,UAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAAyB,EACzB,MAAiD,EACjD,IAA+C;IAE/C,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,KAAK,CAAC,oCAAoC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC5D,YAAY,CACb,CACF,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsC,CAAC;IAClE,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,IAAI;QACP,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;KACpE,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IACE,CAAC,OAAO;YACR,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAC/D,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAqD,EACrD,QAA0D;IAE1D,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC3D,CAAC;IACF,IACE,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QACpC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;QACtC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mCAAmC,CAC1D,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAC/C,KAAK,EACL,KAAK,CAAC,UAAU,EAChB,IAAI,CACL,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAC3E,6BAA6B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACvD,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3C,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC;IACF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,KAAK,UAAU;QACzB,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CACP,CAAC;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACzE,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,UAAU;YACzB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,kBAAkB;YACtC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAClC,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;SACzC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC,MAAM,KAAK,CAAC,gCAAgC,CAAC,QAAQ,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAClE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CACvD,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,qCAAqC,CAAC,cAAc,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,UAAU;QACb,GAAG,QAAQ;QACX,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;KACjE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { containerDocumentPlacementKey as placementKey } from \"../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence\";\nimport type {\n  ContainerDocumentPlacement,\n  ContainerDocumentTombstone,\n  ContainerDocumentTombstoneVerdict,\n  DiscoverContainerDocumentsOptions,\n} from \"./documentDiscoveryTypes\";\n\ntype TombstoneGateStore = Pick<\n  DiscoverContainerDocumentsOptions,\n  | \"applyContainerDocumentTombstones\"\n  | \"holdContainerDocumentTombstones\"\n  | \"listHeldContainerDocumentTombstones\"\n  | \"listKnownContainerDocumentPlacements\"\n  | \"refuteContainerDocumentTombstoneHolds\"\n  | \"verifyContainerDocumentTombstones\"\n>;\n\nfunction dedupePlacements<T extends ContainerDocumentPlacement>(\n  placements: ReadonlyArray<T>,\n): T[] {\n  const seen = new Set<string>();\n  return placements.filter((placement) => {\n    const key = placementKey(placement);\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n}\n\n/**\n * One candidate per placement the device actually holds; the newest server\n * timestamp wins. A tombstone for a placement this device never had has\n * nothing to remove or hide, so its head is not fetched.\n */\nasync function mergeTombstoneCandidates(\n  store: TombstoneGateStore,\n  listed: ReadonlyArray<ContainerDocumentTombstone>,\n  held: ReadonlyArray<ContainerDocumentTombstone>,\n): Promise<ContainerDocumentTombstone[]> {\n  const known = new Set(\n    (await store.listKnownContainerDocumentPlacements(listed)).map(\n      placementKey,\n    ),\n  );\n  const byPlacement = new Map<string, ContainerDocumentTombstone>();\n  for (const tombstone of [\n    ...held,\n    ...listed.filter((tombstone) => known.has(placementKey(tombstone))),\n  ]) {\n    const key = placementKey(tombstone);\n    const current = byPlacement.get(key);\n    if (\n      !current ||\n      Date.parse(current.updatedAt) < Date.parse(tombstone.updatedAt)\n    ) {\n      byPlacement.set(key, tombstone);\n    }\n  }\n  return [...byPlacement.values()];\n}\n\nfunction assertVerdictsCoverCandidates(\n  candidates: ReadonlyArray<ContainerDocumentTombstone>,\n  verdicts: ReadonlyArray<ContainerDocumentTombstoneVerdict>,\n): void {\n  const verdictKeys = new Set(\n    verdicts.map((verdict) => placementKey(verdict.tombstone)),\n  );\n  if (\n    verdictKeys.size !== verdicts.length ||\n    verdictKeys.size !== candidates.length ||\n    candidates.some((candidate) => !verdictKeys.has(placementKey(candidate)))\n  ) {\n    throw new Error(\n      \"Container document tombstone verification must return one verdict per tombstone\",\n    );\n  }\n}\n\n/**\n * Apply a tombstone only when the signed head omits its container. Unavailable\n * heads leave hidden placements. A head that still links a container keeps its\n * placement visible, but retains a backed-off retry: even an uncached signed\n * head can lag the listing, so its refutation must not discard an honest move.\n * Listing items pass their own signed-head gate before reaching persistence.\n */\nexport async function settleContainerDocumentTombstones(input: {\n  containerIds: ReadonlyArray<string>;\n  store: TombstoneGateStore;\n  tombstones: ReadonlyArray<ContainerDocumentTombstone>;\n}): Promise<ReadonlyArray<DocumentSummary>> {\n  const { store } = input;\n  const held = await store.listHeldContainerDocumentTombstones(\n    input.containerIds,\n  );\n  const candidates = await mergeTombstoneCandidates(\n    store,\n    input.tombstones,\n    held,\n  );\n  if (candidates.length === 0) {\n    return [];\n  }\n\n  const verdicts = await store.verifyContainerDocumentTombstones(candidates);\n  assertVerdictsCoverCandidates(candidates, verdicts);\n  const verified = verdicts.flatMap((verdict) =>\n    verdict.kind === \"verified\" ? [verdict.tombstone] : [],\n  );\n  const refuted = verdicts.flatMap((verdict) =>\n    verdict.kind === \"refuted\" ? [verdict.tombstone] : [],\n  );\n  const unverified = verdicts.flatMap((verdict) =>\n    verdict.kind === \"unverified\" ? [verdict.tombstone] : [],\n  );\n  const deferred = verdicts.flatMap((verdict) =>\n    verdict.kind === \"deferred\"\n      ? [{ ...verdict.tombstone, deferred: true }]\n      : [],\n  );\n  // A loaded head is evidence for every placement it links, including holds\n  // on this document that were not due this run: make them visible while\n  // retaining each retry, since the head may lag any of those tombstones.\n  const headLinkedPlacements = verdicts.flatMap((verdict) => {\n    if (verdict.kind !== \"verified\" && verdict.kind !== \"refuted\") return [];\n    const linked =\n      verdict.kind === \"verified\"\n        ? verdict.tombstone.linkedContainerIds\n        : verdict.linkedContainerIds;\n    return linked.map((containerId) => ({\n      containerId,\n      documentId: verdict.tombstone.documentId,\n    }));\n  });\n\n  const summaries =\n    verified.length > 0\n      ? await store.applyContainerDocumentTombstones(verified)\n      : [];\n  const retryKeys = new Set(refuted.map(placementKey));\n  const visibleRetries = dedupePlacements(headLinkedPlacements).filter(\n    (placement) => !retryKeys.has(placementKey(placement)),\n  );\n  if (visibleRetries.length > 0) {\n    await store.refuteContainerDocumentTombstoneHolds(visibleRetries);\n  }\n  const retries = [\n    ...unverified,\n    ...deferred,\n    ...refuted.map((tombstone) => ({ ...tombstone, refuted: true })),\n  ];\n  if (retries.length > 0) await store.holdContainerDocumentTombstones(retries);\n  return summaries;\n}\n"]}

package/workflows/container-contents/folderRecovery.d.ts

@@ -0,0 +1,19 @@
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+export interface RecoveryFolder {
+    containerId: string;
+    organizationId: string;
+    name: string;
+    icon: string | null;
+    pendingUpdateCount: number;
+    hasStructuralIntent: boolean;
+    revision: string;
+}
+export declare function createFolderRecoveryQueries(execSql: ExecSql): {
+    listRecoveryFolderMoveIds(input: {
+        currentOrganizationId: string | null;
+    }): Promise<string[]>;
+    listRecoveryFolders(input: {
+        currentOrganizationId: string | null;
+    }): Promise<RecoveryFolder[]>;
+    discardRecoveryFolder(input: Pick<RecoveryFolder, "containerId" | "organizationId" | "revision">): Promise<boolean>;
+};

package/workflows/container-contents/folderRecovery.js

@@ -0,0 +1,32 @@
+import { base64ToBytes } from "../../internal/encoding/index.js";
+import { importUpdates } from "../../internal/loro/index.js";
+import { createContainerMetadataDocument, readContainerMetadataValue, } from "../../data/containers/containerMetadataDocument.js";
+import { discardRetainedContainerMetadata, listRecoveryFolderMoveIds, listRetainedContainerMetadata, } from "../../data/persistence/container-contents/containerRecoveryPersistence.js";
+export function createFolderRecoveryQueries(execSql) {
+    return {
+        listRecoveryFolderMoveIds(input) {
+            return listRecoveryFolderMoveIds(execSql, input.currentOrganizationId);
+        },
+        async listRecoveryFolders(input) {
+            const records = await listRetainedContainerMetadata(execSql, input.currentOrganizationId);
+            return Promise.all(records.map(async ({ metadataUpdates, ...record }) => {
+                const doc = await createContainerMetadataDocument(record.containerId);
+                try {
+                    if (metadataUpdates)
+                        importUpdates(doc, [base64ToBytes(metadataUpdates)]);
+                    return {
+                        ...record,
+                        ...readContainerMetadataValue(doc, "Untitled folder"),
+                    };
+                }
+                finally {
+                    doc.free();
+                }
+            }));
+        },
+        discardRecoveryFolder(input) {
+            return discardRetainedContainerMetadata(execSql, input);
+        },
+    };
+}
+//# sourceMappingURL=folderRecovery.js.map

package/workflows/container-contents/folderRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folderRecovery.js","sourceRoot":"","sources":["folderRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,wEAAwE,CAAC;AAahF,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,OAAO;QACL,yBAAyB,CAAC,KAEzB;YACC,OAAO,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,KAEzB;YACC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,OAAO,EACP,KAAK,CAAC,qBAAqB,CAC5B,CAAC;YACF,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE;gBACnD,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,CAAC;oBACH,IAAI,eAAe;wBACjB,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACvD,OAAO;wBACL,GAAG,MAAM;wBACT,GAAG,0BAA0B,CAAC,GAAG,EAAE,iBAAiB,CAAC;qBACtD,CAAC;gBACJ,CAAC;wBAAS,CAAC;oBACT,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,qBAAqB,CACnB,KAGC;YAED,OAAO,gCAAgC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport { importUpdates } from \"@tearleads/loro\";\nimport {\n  createContainerMetadataDocument,\n  readContainerMetadataValue,\n} from \"../../data/containers/containerMetadataDocument\";\nimport {\n  discardRetainedContainerMetadata,\n  listRecoveryFolderMoveIds,\n  listRetainedContainerMetadata,\n} from \"../../data/persistence/container-contents/containerRecoveryPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport interface RecoveryFolder {\n  containerId: string;\n  organizationId: string;\n  name: string;\n  icon: string | null;\n  pendingUpdateCount: number;\n  hasStructuralIntent: boolean;\n  revision: string;\n}\n\nexport function createFolderRecoveryQueries(execSql: ExecSql) {\n  return {\n    listRecoveryFolderMoveIds(input: {\n      currentOrganizationId: string | null;\n    }): Promise<string[]> {\n      return listRecoveryFolderMoveIds(execSql, input.currentOrganizationId);\n    },\n    async listRecoveryFolders(input: {\n      currentOrganizationId: string | null;\n    }): Promise<RecoveryFolder[]> {\n      const records = await listRetainedContainerMetadata(\n        execSql,\n        input.currentOrganizationId,\n      );\n      return Promise.all(\n        records.map(async ({ metadataUpdates, ...record }) => {\n          const doc = await createContainerMetadataDocument(record.containerId);\n          try {\n            if (metadataUpdates)\n              importUpdates(doc, [base64ToBytes(metadataUpdates)]);\n            return {\n              ...record,\n              ...readContainerMetadataValue(doc, \"Untitled folder\"),\n            };\n          } finally {\n            doc.free();\n          }\n        }),\n      );\n    },\n    discardRecoveryFolder(\n      input: Pick<\n        RecoveryFolder,\n        \"containerId\" | \"organizationId\" | \"revision\"\n      >,\n    ): Promise<boolean> {\n      return discardRetainedContainerMetadata(execSql, input);\n    },\n  };\n}\n"]}

package/workflows/container-contents/index.d.ts

@@ -0,0 +1,20 @@
+export { type ContainerMetadataDocument, createInitializedContainerMetadataDocument, getDefaultContainerName, readContainerMetadataValue, writeContainerMetadataValue, } from "../../data/containers/containerMetadataDocument.js";
+export { didRegainSyncPrerequisites, isDatabaseUnavailableError, } from "../../data/sync/syncCoordinator.js";
+export { type BlobInfo, type BlobInfoAttachmentKind, type BlobInfoDocumentReference, type BlobInfoInput, type BlobInfoList, type BlobInfoSort, type BlobInfoSortDirection, type BlobInfoSortKey, listBlobInfo, } from "./blobInfo.js";
+export { type ContainerInfo, type ContainerInfoGrant, type ContainerInfoGrantRow, type ContainerInfoPathEntry, type ContainerInfoRemoteMode, type ContainerInfoSecurityDetails, type ContainerShareAccessLevel, loadContainerInfo, } from "./containerInfo.js";
+export { type ContainerSyncWatermarkLane, createContainerContentsSyncLane, createContainerParentSyncLane, defaultContainerContentsPersistence, loadContainerSyncWatermark, saveContainerSyncWatermark, } from "./containerPersistence.js";
+export { type DocumentAttributionRangesInput, type DocumentAttributionRangesPage, loadDocumentAttributionRanges, } from "./documentAttributionRanges.js";
+export { discoverContainerDocumentsFromApi, hasUndiscoveredDocumentUpdateEvent, type RefreshAllContainerDocumentsFromApiOptions, refreshAllContainerDocumentsFromApi, } from "./documentDiscovery.js";
+export { type DocumentInfo, type DocumentInfoAttachment, type DocumentInfoAuthorizingContainerPath, type DocumentInfoLocalDetails, type DocumentInfoRemoteAttachmentBinding, type DocumentInfoRemoteDetails, type DocumentInfoRemoteMode, loadDocumentInfo, } from "./documentInfo.js";
+export { initializeDocumentLinksSchema, listDocumentLinkedContainerIds, replaceDocumentLinks, } from "./documentLinks.js";
+export { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "./documentPurge.js";
+export { type ContainerDocumentLinkInput, type ContainerDocumentQueries, type ContainerDocumentSidebarRow, type ContainerDocumentTombstone, type ContainerItemRow, type ContainerItemSort, type ContainerItemSortDirection, type ContainerItemSortKey, createContainerDocumentQueriesFromRuntime, } from "./documentQueries.js";
+export { activateDocumentLink, addDocumentLink, canMutateDocumentLink, canMutateLocalDocumentLink, type DocumentStructuralMutationHost, type MergeDocumentSummary, moveDocumentLink, moveLocalDocumentLink, removeDocumentLink, type SetLinkedContainerIdsForDocument, } from "./documentStructure.js";
+export type { RecoveryFolder } from "./folderRecovery.js";
+export { type ContainerMetadataPatch, hasContainerMetadataDocumentUpdateEvent, persistContainerMetadataStateFromRuntime, renameContainerMetadataStateFromRuntime, syncContainerMetadataState, } from "./metadata.js";
+export { listPendingWrites, type PendingWriteQueueItem, type PendingWriteQueueItemStatus, type PendingWriteQueueObjectKind, type PendingWriteQueueOperation, type PendingWriteQueueOperationKind, type PendingWriteQueueOperationStatus, } from "./pendingWrites.js";
+export { type ContainerContentsProjectionUserKeyResolver, createContainerContentsDocumentProjectionUserKeyResolver, createContainerContentsProjectionUserKeyResolver, didContainerContentsProjectionKeyRuntimeChange, } from "./projectionKeys.js";
+export { type ContainerContentsRootAdopter, type ContainerContentsRootAdoptionInput, type ContainerContentsStoreWorkflowRuntime, type ContainerContentsWorkflowRuntime, type ContainerContentsWorkflowRuntimeAuth, type ContainerContentsWorkflowRuntimeCrypto, type ContainerContentsWorkflowRuntimeGroups, type ContainerContentsWorkflowRuntimeInfra, type ContainerContentsWorkflowRuntimeInput, type ContainerContentsWorkflowRuntimeInputGroups, type ContainerContentsWorkflowRuntimeState, type ContainerContentsWorkflowRuntimeUtil, createContainerContentsDocumentsRuntime, createContainerContentsStoreWorkflowRuntime, createContainerContentsWorkflowRuntime, } from "./runtime.js";
+export type { ContainerDocumentObjectSyncState, ContainerDocumentObjectSyncStatus, } from "./syncState.js";
+export { createContainerDocumentObjectSyncState, syncedContainerDocumentObjectSyncState, } from "./syncState.js";
+export { type ContainerSystemSlotDefinition, deriveContainerSystemSlot, } from "./systemSlot.js";

package/workflows/container-contents/index.js

@@ -0,0 +1,19 @@
+export { createInitializedContainerMetadataDocument, getDefaultContainerName, readContainerMetadataValue, writeContainerMetadataValue, } from "../../data/containers/containerMetadataDocument.js";
+export { didRegainSyncPrerequisites, isDatabaseUnavailableError, } from "../../data/sync/syncCoordinator.js";
+export { listBlobInfo, } from "./blobInfo.js";
+export { loadContainerInfo, } from "./containerInfo.js";
+export { createContainerContentsSyncLane, createContainerParentSyncLane, defaultContainerContentsPersistence, loadContainerSyncWatermark, saveContainerSyncWatermark, } from "./containerPersistence.js";
+export { loadDocumentAttributionRanges, } from "./documentAttributionRanges.js";
+export { discoverContainerDocumentsFromApi, hasUndiscoveredDocumentUpdateEvent, refreshAllContainerDocumentsFromApi, } from "./documentDiscovery.js";
+export { loadDocumentInfo, } from "./documentInfo.js";
+export { initializeDocumentLinksSchema, listDocumentLinkedContainerIds, replaceDocumentLinks, } from "./documentLinks.js";
+export { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "./documentPurge.js";
+export { createContainerDocumentQueriesFromRuntime, } from "./documentQueries.js";
+export { activateDocumentLink, addDocumentLink, canMutateDocumentLink, canMutateLocalDocumentLink, moveDocumentLink, moveLocalDocumentLink, removeDocumentLink, } from "./documentStructure.js";
+export { hasContainerMetadataDocumentUpdateEvent, persistContainerMetadataStateFromRuntime, renameContainerMetadataStateFromRuntime, syncContainerMetadataState, } from "./metadata.js";
+export { listPendingWrites, } from "./pendingWrites.js";
+export { createContainerContentsDocumentProjectionUserKeyResolver, createContainerContentsProjectionUserKeyResolver, didContainerContentsProjectionKeyRuntimeChange, } from "./projectionKeys.js";
+export { createContainerContentsDocumentsRuntime, createContainerContentsStoreWorkflowRuntime, createContainerContentsWorkflowRuntime, } from "./runtime.js";
+export { createContainerDocumentObjectSyncState, syncedContainerDocumentObjectSyncState, } from "./syncState.js";
+export { deriveContainerSystemSlot, } from "./systemSlot.js";
+//# sourceMappingURL=index.js.map