@tearleads/client-sdk 0.1.60 → 0.1.62

package/Tearleads.d.ts

@@ -1,64 +1,22 @@
 import { ApiRequestMetrics } from "./internal/api-client/index.js";
-import { type BlobStoreFactory, Blobs } from "./client/blobs/index.js";
+import { Blobs } from "./client/blobs/index.js";
 import { type ContainerContents } from "./client/containerContents/index.js";
 import { type DeviceFirst } from "./client/deviceFirst/index.js";
 import { type Documents } from "./client/documents/index.js";
-import { type Logger } from "./client/host/logger.js";
-import { type Identity, type IdentityOptions } from "./client/identity/index.js";
+import { type Identity } from "./client/identity/index.js";
 import { type UserIdentities } from "./client/identity/userIdentities.js";
 import { type Organizations } from "./client/organizations/index.js";
 import { type Root } from "./client/root/index.js";
 import { ApiVersion } from "./client/runtime/apiVersion.js";
-import { Database, type DatabaseOptions } from "./client/runtime/database.js";
+import { Database } from "./client/runtime/database.js";
 import { Events } from "./client/runtime/events.js";
 import { Network } from "./client/runtime/network.js";
-import type { PrincipalHistoryKeyProvider } from "./client/runtime/principalHistoryProtection.js";
 import { SyncBillingGate } from "./client/runtime/syncBillingGate.js";
 import { type Runtime } from "./client/runtime/workflowRuntime.js";
-import { type SecurityIncidentListener, type SecurityIncidents } from "./client/securityIncidents/index.js";
+import { type SecurityIncidents } from "./client/securityIncidents/index.js";
 import type { Session } from "./client/session/sessionTypes.js";
-import type { BlobStore } from "./data/blobs/blobContracts.js";
-import { type DocumentProjectorRegistryInput } from "./data/documents/documentKinds.js";
 import { type DomainScope } from "./data/shared/domainScope.js";
-import type { ProvisionedSystemContainerSpec } from "./workflows/registration/index.js";
-export type ClientDatabaseOptions = Omit<DatabaseOptions, "status">;
-export interface ClientOptions {
-    apiBaseUrl?: string | undefined;
-    /** Reuse a memory-only request counter across client lifetimes. */
-    apiRequestMetrics?: ApiRequestMetrics | undefined;
-    blobStore?: BlobStore | undefined;
-    blobStoreFactory?: BlobStoreFactory | undefined;
-    database?: ClientDatabaseOptions | undefined;
-    documentProjectors?: DocumentProjectorRegistryInput | undefined;
-    events?: ReadonlyArray<unknown> | undefined;
-    identity?: IdentityOptions | undefined;
-    /**
-     * Absolute, host-controlled API namespace for durable user-identity pins.
-     * Required only when apiBaseUrl is relative and no browser origin exists.
-     */
-    identityTrustDomain?: string | undefined;
-    identityProvisioning?: "auto" | "manual" | undefined;
-    logger?: Logger | undefined;
-    online?: boolean | undefined;
-    /** Called after a trust-boundary verification failure is durably recorded. */
-    onSecurityIncident?: SecurityIncidentListener | undefined;
-    /**
-     * Per-pane discriminator so documents in distinct panes derive distinct Loro
-     * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.
-     */
-    peerScope?: string | undefined;
-    /** Private host key for durable history progress; omitted uses disposable session keys. */
-    principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;
-    /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */
-    principalMutationTimeoutMs?: number | undefined;
-    /**
-     * App-owned system containers born with every new organization (both
-     * registration and additional-org creation provision them atomically in the
-     * same server call), e.g. a trash bin. The app owns these because their slot
-     * namespaces are app concepts the SDK stays agnostic to.
-     */
-    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
-}
+import type { TearleadsOptions } from "./TearleadsOptions.js";
 export declare class Tearleads {
     readonly apiVersion: ApiVersion;
     readonly apiRequests: ApiRequestMetrics;
@@ -91,7 +49,9 @@ export declare class Tearleads {
     private pinLocalUserIdentity;
     private primeProvisionedPrincipalHistory;
     private boundUserId;
-    constructor(options?: ClientOptions);
+    constructor(options?: TearleadsOptions);
+    /** Durable incident records in this database, reported to the host's listener. */
+    private createSecurityIncidents;
     /** Trust callbacks reach the workflow runtime, which is created later. */
     private createClientSession;
     private createApiClient;

package/Tearleads.js

@@ -4,7 +4,7 @@ import { createContainerContents, } from "./client/containerContents/index.js";
 import { createDeviceFirst } from "./client/deviceFirst/index.js";
 import { createDocuments } from "./client/documents/index.js";
 import { logErrorToConsole } from "./client/host/logger.js";
-import { createIdentity, } from "./client/identity/index.js";
+import { createIdentity } from "./client/identity/index.js";
 import { createUserIdentities, } from "./client/identity/userIdentities.js";
 import { createOrganizations, } from "./client/organizations/index.js";
 import { createRoot, rootRuntimeOf } from "./client/root/index.js";
@@ -21,21 +21,6 @@ import { createVerifiedManifestCitations } from "./data/persistence/verifiedMani
 import { createDomainScope } from "./data/shared/domainScope.js";
 import { disposeDomainSyncCoordinator } from "./data/sync/syncCoordinator.js";
 import { resolveIdentityTrustDomain } from "./data/trustedUserIdentity/index.js";
-function createClientSecurityIncidentService(input) {
-    const identityTrustDomain = resolveIdentityTrustDomain({
-        apiBaseUrl: input.apiBaseUrl,
-        identityTrustDomain: input.options.identityTrustDomain,
-    });
-    return {
-        identityTrustDomain,
-        service: createSecurityIncidentService({
-            database: input.database,
-            logError: input.logError,
-            onIncident: input.options.onSecurityIncident,
-            trustDomain: identityTrustDomain,
-        }),
-    };
-}
 export class Tearleads {
     apiVersion = new ApiVersion();
     apiRequests;
@@ -85,14 +70,13 @@ export class Tearleads {
         this.events = new Events(options.events, () => this.apiClient.clearWriterProjectionCaches());
         this.logHandler = options.logger?.log ?? (() => undefined);
         this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;
-        const security = createClientSecurityIncidentService({
+        const identityTrustDomain = resolveIdentityTrustDomain({
             apiBaseUrl,
-            database: this.database,
-            logError: this.logError,
-            options,
+            identityTrustDomain: options.identityTrustDomain,
         });
-        this.securityIncidents = security.service.incidents;
-        this.disposeSecurityIncidents = security.service.dispose;
+        const security = this.createSecurityIncidents(identityTrustDomain, options);
+        this.securityIncidents = security.incidents;
+        this.disposeSecurityIncidents = security.dispose;
         this.network = new Network(options.online);
         this.syncBillingGate = new SyncBillingGate();
         let session = null;
@@ -108,9 +92,9 @@ export class Tearleads {
             },
             getUserId: () => session?.userId ?? null,
         });
-        session = this.createClientSession(options, security.service.report);
+        session = this.createClientSession(options, security.report);
         this.session = session;
-        const runtime = this.createWorkflowRuntime(security.identityTrustDomain, options, security.service.report);
+        const runtime = this.createWorkflowRuntime(identityTrustDomain, options, security.report);
         this.bindTrustedIdentityRuntime(runtime);
         this.runtime = runtime.publicRuntime;
         this.documents = createDocuments({
@@ -123,7 +107,7 @@ export class Tearleads {
         this.root = createRoot(rootRuntimeOf(runtime, this.session));
         this.userIdentities = createUserIdentities({
             getOrganizationId: () => this.session.organizationId,
-            reportSecurityIncident: security.service.report,
+            reportSecurityIncident: security.report,
             identityLinks: runtime.identityLinks,
             log: this.log,
             resolveTrustedUserIdentity: (userId) => runtime.workflowInput().resolveTrustedUserIdentity(userId),
@@ -133,6 +117,15 @@ export class Tearleads {
             this.startAutomaticIdentityProvisioning();
         }
     }
+    /** Durable incident records in this database, reported to the host's listener. */
+    createSecurityIncidents(trustDomain, options) {
+        return createSecurityIncidentService({
+            database: this.database,
+            logError: this.logError,
+            onIncident: options.onSecurityIncident,
+            trustDomain,
+        });
+    }
     /** Trust callbacks reach the workflow runtime, which is created later. */
     createClientSession(options, reportSecurityIncident) {
         return createSession({

package/Tearleads.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAyB,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAe,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EACL,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAwB,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,aAAa,GAGd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,6BAA6B,GAG9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAGL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,SAAS,mCAAmC,CAAC,KAK5C;IACC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;KACvD,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,OAAO,EAAE,6BAA6B,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,mBAAmB;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AA4CD,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAAyB,EAAE;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;YACnD,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,QAAQ,CAAC,mBAAmB,EAC5B,OAAO,EACP,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport { type BlobStoreFactory, Blobs } from \"./client/blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./client/containerContents\";\nimport { createDeviceFirst, type DeviceFirst } from \"./client/deviceFirst\";\nimport { createDocuments, type Documents } from \"./client/documents\";\nimport { type Logger, logErrorToConsole } from \"./client/host/logger\";\nimport {\n  createIdentity,\n  type Identity,\n  type IdentityOptions,\n} from \"./client/identity\";\nimport {\n  createUserIdentities,\n  type UserIdentities,\n} from \"./client/identity/userIdentities\";\nimport {\n  createOrganizations,\n  type Organizations,\n} from \"./client/organizations\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./client/root\";\nimport { ApiVersion } from \"./client/runtime/apiVersion\";\nimport { Database, type DatabaseOptions } from \"./client/runtime/database\";\nimport { Events } from \"./client/runtime/events\";\nimport { Network } from \"./client/runtime/network\";\nimport type { PrincipalHistoryKeyProvider } from \"./client/runtime/principalHistoryProtection\";\nimport { SyncBillingGate } from \"./client/runtime/syncBillingGate\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./client/runtime/workflowRuntime\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidentListener,\n  type SecurityIncidents,\n} from \"./client/securityIncidents\";\nimport { createSession } from \"./client/session\";\nimport type { Session } from \"./client/session/sessionTypes\";\nimport type { BlobStore } from \"./data/blobs/blobContracts\";\nimport {\n  type DocumentProjectorRegistry,\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"./data/documents/documentKinds\";\nimport { createVerifiedManifestCitations } from \"./data/persistence/verifiedManifestBundlePersistence\";\nimport { createDomainScope, type DomainScope } from \"./data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"./data/shared/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"./data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"./data/trustedUserIdentity\";\nimport type { ProvisionedSystemContainerSpec } from \"./workflows/registration\";\n\nfunction createClientSecurityIncidentService(input: {\n  readonly apiBaseUrl: string;\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly options: ClientOptions;\n}) {\n  const identityTrustDomain = resolveIdentityTrustDomain({\n    apiBaseUrl: input.apiBaseUrl,\n    identityTrustDomain: input.options.identityTrustDomain,\n  });\n  return {\n    identityTrustDomain,\n    service: createSecurityIncidentService({\n      database: input.database,\n      logError: input.logError,\n      onIncident: input.options.onSecurityIncident,\n      trustDomain: identityTrustDomain,\n    }),\n  };\n}\n\nexport type ClientDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\nexport interface ClientOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: ClientDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: ClientOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const security = createClientSecurityIncidentService({\n      apiBaseUrl,\n      database: this.database,\n      logError: this.logError,\n      options,\n    });\n    this.securityIncidents = security.service.incidents;\n    this.disposeSecurityIncidents = security.service.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.service.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      security.identityTrustDomain,\n      options,\n      security.service.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.service.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}
+{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAiB,MAAM,mBAAmB,CAAC;AAClE,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,aAAa,GAGd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,6BAA6B,GAE9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAEL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAA4B,EAAE;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;YACrD,UAAU;YACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC5E,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC5C,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,mBAAmB,EACnB,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,MAAM;YACvC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,kFAAkF;IAC1E,uBAAuB,CAC7B,WAA0B,EAC1B,OAAyB;QAEzB,OAAO,6BAA6B,CAAC;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,OAAO,CAAC,kBAAkB;YACtC,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAyB,EACzB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAyB,EACzB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport { Blobs } from \"./client/blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./client/containerContents\";\nimport { createDeviceFirst, type DeviceFirst } from \"./client/deviceFirst\";\nimport { createDocuments, type Documents } from \"./client/documents\";\nimport { logErrorToConsole } from \"./client/host/logger\";\nimport { createIdentity, type Identity } from \"./client/identity\";\nimport {\n  createUserIdentities,\n  type UserIdentities,\n} from \"./client/identity/userIdentities\";\nimport {\n  createOrganizations,\n  type Organizations,\n} from \"./client/organizations\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./client/root\";\nimport { ApiVersion } from \"./client/runtime/apiVersion\";\nimport { Database } from \"./client/runtime/database\";\nimport { Events } from \"./client/runtime/events\";\nimport { Network } from \"./client/runtime/network\";\nimport { SyncBillingGate } from \"./client/runtime/syncBillingGate\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./client/runtime/workflowRuntime\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidents,\n} from \"./client/securityIncidents\";\nimport { createSession } from \"./client/session\";\nimport type { Session } from \"./client/session/sessionTypes\";\nimport {\n  type DocumentProjectorRegistry,\n  resolveDocumentProjectorRegistry,\n} from \"./data/documents/documentKinds\";\nimport { createVerifiedManifestCitations } from \"./data/persistence/verifiedManifestBundlePersistence\";\nimport { createDomainScope, type DomainScope } from \"./data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"./data/shared/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"./data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"./data/trustedUserIdentity\";\nimport type { TearleadsOptions } from \"./TearleadsOptions\";\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: TearleadsOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const identityTrustDomain = resolveIdentityTrustDomain({\n      apiBaseUrl,\n      identityTrustDomain: options.identityTrustDomain,\n    });\n    const security = this.createSecurityIncidents(identityTrustDomain, options);\n    this.securityIncidents = security.incidents;\n    this.disposeSecurityIncidents = security.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      identityTrustDomain,\n      options,\n      security.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Durable incident records in this database, reported to the host's listener. */\n  private createSecurityIncidents(\n    trustDomain: string | null,\n    options: TearleadsOptions,\n  ) {\n    return createSecurityIncidentService({\n      database: this.database,\n      logError: this.logError,\n      onIncident: options.onSecurityIncident,\n      trustDomain,\n    });\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: TearleadsOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: TearleadsOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}

package/TearleadsOptions.d.ts

@@ -0,0 +1,49 @@
+import type { ApiRequestMetrics } from "./internal/api-client/index.js";
+import type { BlobStoreFactory } from "./client/blobs/index.js";
+import type { Logger } from "./client/host/logger.js";
+import type { IdentityOptions } from "./client/identity/index.js";
+import type { DatabaseOptions } from "./client/runtime/database.js";
+import type { PrincipalHistoryKeyProvider } from "./client/runtime/principalHistoryProtection.js";
+import type { SecurityIncidentListener } from "./client/securityIncidents/index.js";
+import type { BlobStore } from "./data/blobs/blobContracts.js";
+import type { DocumentProjectorRegistryInput } from "./data/documents/documentKinds.js";
+import type { ProvisionedSystemContainerSpec } from "./workflows/registration/index.js";
+export type TearleadsDatabaseOptions = Omit<DatabaseOptions, "status">;
+/** What a host passes to `new Tearleads(options)`; every field is optional. */
+export interface TearleadsOptions {
+    apiBaseUrl?: string | undefined;
+    /** Reuse a memory-only request counter across client lifetimes. */
+    apiRequestMetrics?: ApiRequestMetrics | undefined;
+    blobStore?: BlobStore | undefined;
+    blobStoreFactory?: BlobStoreFactory | undefined;
+    database?: TearleadsDatabaseOptions | undefined;
+    documentProjectors?: DocumentProjectorRegistryInput | undefined;
+    events?: ReadonlyArray<unknown> | undefined;
+    identity?: IdentityOptions | undefined;
+    /**
+     * Absolute, host-controlled API namespace for durable user-identity pins.
+     * Required only when apiBaseUrl is relative and no browser origin exists.
+     */
+    identityTrustDomain?: string | undefined;
+    identityProvisioning?: "auto" | "manual" | undefined;
+    logger?: Logger | undefined;
+    online?: boolean | undefined;
+    /** Called after a trust-boundary verification failure is durably recorded. */
+    onSecurityIncident?: SecurityIncidentListener | undefined;
+    /**
+     * Per-pane discriminator so documents in distinct panes derive distinct Loro
+     * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.
+     */
+    peerScope?: string | undefined;
+    /** Private host key for durable history progress; omitted uses disposable session keys. */
+    principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;
+    /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */
+    principalMutationTimeoutMs?: number | undefined;
+    /**
+     * App-owned system containers born with every new organization (both
+     * registration and additional-org creation provision them atomically in the
+     * same server call), e.g. a trash bin. The app owns these because their slot
+     * namespaces are app concepts the SDK stays agnostic to.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+}

package/TearleadsOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=TearleadsOptions.js.map

package/TearleadsOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TearleadsOptions.js","sourceRoot":"","sources":["TearleadsOptions.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiRequestMetrics } from \"@tearleads/api-client\";\nimport type { BlobStoreFactory } from \"./client/blobs\";\nimport type { Logger } from \"./client/host/logger\";\nimport type { IdentityOptions } from \"./client/identity\";\nimport type { DatabaseOptions } from \"./client/runtime/database\";\nimport type { PrincipalHistoryKeyProvider } from \"./client/runtime/principalHistoryProtection\";\nimport type { SecurityIncidentListener } from \"./client/securityIncidents\";\nimport type { BlobStore } from \"./data/blobs/blobContracts\";\nimport type { DocumentProjectorRegistryInput } from \"./data/documents/documentKinds\";\nimport type { ProvisionedSystemContainerSpec } from \"./workflows/registration\";\n\nexport type TearleadsDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\n/** What a host passes to `new Tearleads(options)`; every field is optional. */\nexport interface TearleadsOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: TearleadsDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n"]}

package/client/containerContents/documentDiscovery.js

@@ -1,12 +1,12 @@
 import { sqlContainerContentsPersistence } from "../../data/persistence/container-contents/containerContentsPersistence.js";
 import { holdContainerDocumentTombstones, listKnownContainerDocumentPlacements, listRetryableHeldContainerDocumentTombstones, loadLocalDocumentAccessEpoch, refuteContainerDocumentTombstoneHolds, } from "../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence.js";
 import { createDocumentDiscoveryEvidenceStore } from "../../data/persistence/documents/documentDiscoveryEvidencePersistence.js";
-import { listContainerDocumentLanesFromApi } from "../../workflows/container-contents/containerDocumentListing.js";
-import { createDiscoveredDocumentVerifier } from "../../workflows/container-contents/documentDiscoveryEvidence.js";
-import { discoverContainerDocumentLanes, } from "../../workflows/container-contents/documentDiscoveryLanes.js";
-import { createContainerDocumentQueriesFromRuntime } from "../../workflows/container-contents/documentQueries.js";
-import { createContainerDocumentTombstoneVerifier, createDocumentHeadLinkSetLoader, } from "../../workflows/container-contents/documentTombstoneEvidence.js";
+import { listContainerDocumentLanesFromApi } from "../../workflows/container-contents/documentDiscovery/containerDocumentListing.js";
+import { createDiscoveredDocumentVerifier } from "../../workflows/container-contents/documentDiscovery/documentDiscoveryEvidence.js";
+import { discoverContainerDocumentLanes, } from "../../workflows/container-contents/documentDiscovery/documentDiscoveryLanes.js";
+import { createContainerDocumentQueriesFromRuntime } from "../../workflows/container-contents/documentQueries/index.js";
 import { createContainerContentsWorkflowRuntime, } from "../../workflows/container-contents/runtime.js";
+import { createContainerDocumentTombstoneVerifier, createDocumentHeadLinkSetLoader, } from "../../workflows/container-contents/tombstones/documentTombstoneEvidence.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
 function createDiscoveryLane(input) {
     const { containerOrganizationId, execSql, request, runtime } = input;

package/client/containerContents/documentDiscovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentDiscovery.js","sourceRoot":"","sources":["documentDiscovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wEAAwE,CAAC;AACzH,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,4CAA4C,EAC5C,4BAA4B,EAC5B,qCAAqC,GACtC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,uEAAuE,CAAC;AAC7H,OAAO,EAAE,iCAAiC,EAAE,MAAM,6DAA6D,CAAC;AAChH,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,EAIL,8BAA8B,GAC/B,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,yCAAyC,EAAE,MAAM,oDAAoD,CAAC;AAC/G,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAEL,sCAAsC,GACvC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAgBpG,SAAS,mBAAmB,CAAC,KAW5B;IACC,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACrE,MAAM,+BAA+B,GACnC,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAE,EAAE,CACvC,4BAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,KAAK,CAAC,OAAO;QAChB,gCAAgC,EAAE,CAAC,UAAU,EAAE,EAAE,CAC/C,uBAAuB;YACrB,CAAC,CAAC,+BAA+B,CAAC;gBAC9B,cAAc,EAAE,uBAAuB;gBACvC,UAAU;aACX,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,+BAA+B,EAAE,CAAC,UAAU,EAAE,EAAE,CAC9C,+BAA+B,CAAC,OAAO,EAAE,UAAU,CAAC;QACtD,mCAAmC,EAAE,CAAC,YAAY,EAAE,EAAE,CACpD,4CAA4C,CAAC,OAAO,EAAE,YAAY,CAAC;QACrE,oCAAoC,EAAE,CAAC,UAAU,EAAE,EAAE,CACnD,oCAAoC,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3D,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,qCAAqC,EAAE,CAAC,UAAU,EAAE,EAAE,CACpD,qCAAqC,CAAC,OAAO,EAAE,UAAU,CAAC;QAC5D,iCAAiC,EAAE,wCAAwC,CACzE,uBAAuB,EACvB,QAAQ,EACR,SAAS,CACV;QACD,yBAAyB,EAAE,gCAAgC,CACzD,uBAAuB,EACvB,QAAQ,EACR,SAAS,EACT,KAAK,CAAC,aAAa,EACnB,OAAO,CAAC,kBAAkB,CAC3B;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,EAC7D,SAAS,EACT,QAAQ,EACR,cAAc,GAKf;IACC,MAAM,QAAQ,GAAG,CACf,WAAmB,EACgB,EAAE,CAAC,CAAC;QACvC,WAAW;QACX,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,aAAa,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,yCAAyC,CAAC,OAAO,CAAC,CAAC;IACnE,sEAAsE;IACtE,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GACV,MAAM,+BAA+B,CAAC,0BAA0B,CAC9D,OAAO,EACP,OAAO,CAAC,WAAW,CACpB,CAAC;QACJ,IAAI,MAAM;YACR,KAAK,CAAC,IAAI,CACR,mBAAmB,CAAC;gBAClB,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;gBACxD,aAAa;gBACb,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,OAAO;aACR,CAAC,CACH,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;QACpD,UAAU;QACV,KAAK;QACL,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,iCAAiC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;QACtE,SAAS;KACV,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CACjB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAClB,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,EACzD,cAAc,EACd,GAAG,OAAO,EAGX;IACC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,wCAAwC,CAAC;QAC/D,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,cAAc;KACf,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC;IACzD,OAAO,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { sqlContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  holdContainerDocumentTombstones,\n  listKnownContainerDocumentPlacements,\n  listRetryableHeldContainerDocumentTombstones,\n  loadLocalDocumentAccessEpoch,\n  refuteContainerDocumentTombstoneHolds,\n} from \"../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence\";\nimport { createDocumentDiscoveryEvidenceStore } from \"../../data/persistence/documents/documentDiscoveryEvidencePersistence\";\nimport { listContainerDocumentLanesFromApi } from \"../../workflows/container-contents/containerDocumentListing\";\nimport { createDiscoveredDocumentVerifier } from \"../../workflows/container-contents/documentDiscoveryEvidence\";\nimport {\n  type ContainerDocumentDiscoveryLane,\n  type ContainerDocumentDiscoveryOutcome,\n  type ContainerDocumentDiscoveryOutcomeHandler,\n  discoverContainerDocumentLanes,\n} from \"../../workflows/container-contents/documentDiscoveryLanes\";\nimport { createContainerDocumentQueriesFromRuntime } from \"../../workflows/container-contents/documentQueries\";\nimport {\n  createContainerDocumentTombstoneVerifier,\n  createDocumentHeadLinkSetLoader,\n} from \"../../workflows/container-contents/documentTombstoneEvidence\";\nimport {\n  type ContainerContentsWorkflowRuntime,\n  createContainerContentsWorkflowRuntime,\n} from \"../../workflows/container-contents/runtime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\n\nexport type { ContainerDocumentDiscoveryOutcome } from \"../../workflows/container-contents/documentDiscoveryLanes\";\n\n/** One container to discover, with the reconciler's per-lane callbacks. */\nexport interface ContainerDocumentDiscoveryRequest {\n  readonly containerId: string;\n  readonly onFullListing?:\n    | ((documentIds: ReadonlyArray<string>) => void)\n    | undefined;\n  readonly onPendingDiscovery?: ((delayMs: number) => void) | undefined;\n}\n\ntype ExecSql = ReturnType<InternalRuntime[\"workflowInput\"]>[\"infra\"][\"execSql\"];\n\nfunction createDiscoveryLane(input: {\n  readonly containerOrganizationId: string | undefined;\n  readonly evidenceStore: ReturnType<\n    typeof createDocumentDiscoveryEvidenceStore\n  >;\n  readonly execSql: ExecSql;\n  readonly queries: ReturnType<\n    typeof createContainerDocumentQueriesFromRuntime\n  >;\n  readonly request: ContainerDocumentDiscoveryRequest;\n  readonly runtime: ContainerContentsWorkflowRuntime;\n}): ContainerDocumentDiscoveryLane {\n  const { containerOrganizationId, execSql, request, runtime } = input;\n  const warmReferencedPrincipalPolicies =\n    createRuntimePrincipalPolicyWarmer(runtime);\n  const loadHead = createDocumentHeadLinkSetLoader(runtime);\n  const loadEpoch = (documentId: string) =>\n    loadLocalDocumentAccessEpoch(execSql, documentId);\n  return {\n    ...input.queries,\n    cacheReferencedPrincipalPolicies: (references) =>\n      containerOrganizationId\n        ? warmReferencedPrincipalPolicies({\n            organizationId: containerOrganizationId,\n            references,\n          })\n        : Promise.resolve(),\n    containerId: request.containerId,\n    holdContainerDocumentTombstones: (tombstones) =>\n      holdContainerDocumentTombstones(execSql, tombstones),\n    listHeldContainerDocumentTombstones: (containerIds) =>\n      listRetryableHeldContainerDocumentTombstones(execSql, containerIds),\n    listKnownContainerDocumentPlacements: (placements) =>\n      listKnownContainerDocumentPlacements(execSql, placements),\n    onFullListing: request.onFullListing,\n    refuteContainerDocumentTombstoneHolds: (placements) =>\n      refuteContainerDocumentTombstoneHolds(execSql, placements),\n    verifyContainerDocumentTombstones: createContainerDocumentTombstoneVerifier(\n      containerOrganizationId,\n      loadHead,\n      loadEpoch,\n    ),\n    verifyDiscoveredDocuments: createDiscoveredDocumentVerifier(\n      containerOrganizationId,\n      loadHead,\n      loadEpoch,\n      input.evidenceStore,\n      request.onPendingDiscovery,\n    ),\n  };\n}\n\n/**\n * Internal adapter shared by explicit discovery and background reconciliation:\n * one batched listing for every requested container, then per-container\n * verification scoped to each container's durable organization.\n */\nexport async function discoverContainerDocumentLanesForRuntime({\n  onOutcome,\n  requests,\n  runtimeService,\n}: {\n  readonly onOutcome?: ContainerDocumentDiscoveryOutcomeHandler | undefined;\n  readonly requests: ReadonlyArray<ContainerDocumentDiscoveryRequest>;\n  readonly runtimeService: InternalRuntime;\n}): Promise<ReadonlyArray<ContainerDocumentDiscoveryOutcome>> {\n  const unlisted = (\n    containerId: string,\n  ): ContainerDocumentDiscoveryOutcome => ({\n    containerId,\n    status: \"fulfilled\",\n    value: null,\n  });\n  const input = runtimeService.workflowInput();\n  if (input.infra.dbStatus !== \"ready\") {\n    return requests.map(({ containerId }) => unlisted(containerId));\n  }\n  const runtime = createContainerContentsWorkflowRuntime(input);\n  const execSql = input.infra.execSql;\n  const evidenceStore = createDocumentDiscoveryEvidenceStore(execSql);\n  const queries = createContainerDocumentQueriesFromRuntime(runtime);\n  // Capture the reset fence before reading any lane's scope, so a reset\n  // between these reads and the listing cannot publish old-organization\n  // evidence into its replacement.\n  const generation = await evidenceStore.begin();\n  const lanes: ContainerDocumentDiscoveryLane[] = [];\n  for (const request of requests) {\n    const stored =\n      await sqlContainerContentsPersistence.loadContainerMetadataState(\n        execSql,\n        request.containerId,\n      );\n    if (stored)\n      lanes.push(\n        createDiscoveryLane({\n          containerOrganizationId: stored.container.organizationId,\n          evidenceStore,\n          execSql,\n          queries,\n          request,\n          runtime,\n        }),\n      );\n  }\n  const outcomes = await discoverContainerDocumentLanes({\n    generation,\n    lanes,\n    listContainerDocumentLanes: (listed) =>\n      listContainerDocumentLanesFromApi(runtime.apiClient, listed),\n    loadContainerDocumentWatermark: queries.loadContainerDocumentWatermark,\n    onOutcome,\n  });\n  const outcomeByContainerId = new Map(\n    outcomes.map((outcome) => [outcome.containerId, outcome]),\n  );\n  return requests.map(\n    ({ containerId }) =>\n      outcomeByContainerId.get(containerId) ?? unlisted(containerId),\n  );\n}\n\n/** Discovers one container; a rejected lane rethrows its failure. */\nexport async function discoverContainerDocumentsForRuntime({\n  runtimeService,\n  ...request\n}: ContainerDocumentDiscoveryRequest & {\n  readonly runtimeService: InternalRuntime;\n}): Promise<ReadonlyArray<DocumentSummary> | null> {\n  const [outcome] = await discoverContainerDocumentLanesForRuntime({\n    requests: [request],\n    runtimeService,\n  });\n  if (outcome?.status === \"rejected\") throw outcome.reason;\n  return outcome?.value ?? null;\n}\n"]}
+{"version":3,"file":"documentDiscovery.js","sourceRoot":"","sources":["documentDiscovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wEAAwE,CAAC;AACzH,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,4CAA4C,EAC5C,4BAA4B,EAC5B,qCAAqC,GACtC,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,uEAAuE,CAAC;AAC7H,OAAO,EAAE,iCAAiC,EAAE,MAAM,+EAA+E,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,gFAAgF,CAAC;AAClI,OAAO,EAIL,8BAA8B,GAC/B,MAAM,6EAA6E,CAAC;AACrF,OAAO,EAAE,yCAAyC,EAAE,MAAM,oDAAoD,CAAC;AAC/G,OAAO,EAEL,sCAAsC,GACvC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAgBpG,SAAS,mBAAmB,CAAC,KAW5B;IACC,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACrE,MAAM,+BAA+B,GACnC,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAE,EAAE,CACvC,4BAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,KAAK,CAAC,OAAO;QAChB,gCAAgC,EAAE,CAAC,UAAU,EAAE,EAAE,CAC/C,uBAAuB;YACrB,CAAC,CAAC,+BAA+B,CAAC;gBAC9B,cAAc,EAAE,uBAAuB;gBACvC,UAAU;aACX,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,+BAA+B,EAAE,CAAC,UAAU,EAAE,EAAE,CAC9C,+BAA+B,CAAC,OAAO,EAAE,UAAU,CAAC;QACtD,mCAAmC,EAAE,CAAC,YAAY,EAAE,EAAE,CACpD,4CAA4C,CAAC,OAAO,EAAE,YAAY,CAAC;QACrE,oCAAoC,EAAE,CAAC,UAAU,EAAE,EAAE,CACnD,oCAAoC,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3D,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,qCAAqC,EAAE,CAAC,UAAU,EAAE,EAAE,CACpD,qCAAqC,CAAC,OAAO,EAAE,UAAU,CAAC;QAC5D,iCAAiC,EAAE,wCAAwC,CACzE,uBAAuB,EACvB,QAAQ,EACR,SAAS,CACV;QACD,yBAAyB,EAAE,gCAAgC,CACzD,uBAAuB,EACvB,QAAQ,EACR,SAAS,EACT,KAAK,CAAC,aAAa,EACnB,OAAO,CAAC,kBAAkB,CAC3B;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,EAC7D,SAAS,EACT,QAAQ,EACR,cAAc,GAKf;IACC,MAAM,QAAQ,GAAG,CACf,WAAmB,EACgB,EAAE,CAAC,CAAC;QACvC,WAAW;QACX,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,aAAa,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,yCAAyC,CAAC,OAAO,CAAC,CAAC;IACnE,sEAAsE;IACtE,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GACV,MAAM,+BAA+B,CAAC,0BAA0B,CAC9D,OAAO,EACP,OAAO,CAAC,WAAW,CACpB,CAAC;QACJ,IAAI,MAAM;YACR,KAAK,CAAC,IAAI,CACR,mBAAmB,CAAC;gBAClB,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;gBACxD,aAAa;gBACb,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,OAAO;aACR,CAAC,CACH,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;QACpD,UAAU;QACV,KAAK;QACL,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,iCAAiC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;QACtE,SAAS;KACV,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CACjB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAClB,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,EACzD,cAAc,EACd,GAAG,OAAO,EAGX;IACC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,wCAAwC,CAAC;QAC/D,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,cAAc;KACf,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC;IACzD,OAAO,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { sqlContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  holdContainerDocumentTombstones,\n  listKnownContainerDocumentPlacements,\n  listRetryableHeldContainerDocumentTombstones,\n  loadLocalDocumentAccessEpoch,\n  refuteContainerDocumentTombstoneHolds,\n} from \"../../data/persistence/documents/containerDocumentTombstoneHoldsPersistence\";\nimport { createDocumentDiscoveryEvidenceStore } from \"../../data/persistence/documents/documentDiscoveryEvidencePersistence\";\nimport { listContainerDocumentLanesFromApi } from \"../../workflows/container-contents/documentDiscovery/containerDocumentListing\";\nimport { createDiscoveredDocumentVerifier } from \"../../workflows/container-contents/documentDiscovery/documentDiscoveryEvidence\";\nimport {\n  type ContainerDocumentDiscoveryLane,\n  type ContainerDocumentDiscoveryOutcome,\n  type ContainerDocumentDiscoveryOutcomeHandler,\n  discoverContainerDocumentLanes,\n} from \"../../workflows/container-contents/documentDiscovery/documentDiscoveryLanes\";\nimport { createContainerDocumentQueriesFromRuntime } from \"../../workflows/container-contents/documentQueries\";\nimport {\n  type ContainerContentsWorkflowRuntime,\n  createContainerContentsWorkflowRuntime,\n} from \"../../workflows/container-contents/runtime\";\nimport {\n  createContainerDocumentTombstoneVerifier,\n  createDocumentHeadLinkSetLoader,\n} from \"../../workflows/container-contents/tombstones/documentTombstoneEvidence\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\n\nexport type { ContainerDocumentDiscoveryOutcome } from \"../../workflows/container-contents/documentDiscovery/documentDiscoveryLanes\";\n\n/** One container to discover, with the reconciler's per-lane callbacks. */\nexport interface ContainerDocumentDiscoveryRequest {\n  readonly containerId: string;\n  readonly onFullListing?:\n    | ((documentIds: ReadonlyArray<string>) => void)\n    | undefined;\n  readonly onPendingDiscovery?: ((delayMs: number) => void) | undefined;\n}\n\ntype ExecSql = ReturnType<InternalRuntime[\"workflowInput\"]>[\"infra\"][\"execSql\"];\n\nfunction createDiscoveryLane(input: {\n  readonly containerOrganizationId: string | undefined;\n  readonly evidenceStore: ReturnType<\n    typeof createDocumentDiscoveryEvidenceStore\n  >;\n  readonly execSql: ExecSql;\n  readonly queries: ReturnType<\n    typeof createContainerDocumentQueriesFromRuntime\n  >;\n  readonly request: ContainerDocumentDiscoveryRequest;\n  readonly runtime: ContainerContentsWorkflowRuntime;\n}): ContainerDocumentDiscoveryLane {\n  const { containerOrganizationId, execSql, request, runtime } = input;\n  const warmReferencedPrincipalPolicies =\n    createRuntimePrincipalPolicyWarmer(runtime);\n  const loadHead = createDocumentHeadLinkSetLoader(runtime);\n  const loadEpoch = (documentId: string) =>\n    loadLocalDocumentAccessEpoch(execSql, documentId);\n  return {\n    ...input.queries,\n    cacheReferencedPrincipalPolicies: (references) =>\n      containerOrganizationId\n        ? warmReferencedPrincipalPolicies({\n            organizationId: containerOrganizationId,\n            references,\n          })\n        : Promise.resolve(),\n    containerId: request.containerId,\n    holdContainerDocumentTombstones: (tombstones) =>\n      holdContainerDocumentTombstones(execSql, tombstones),\n    listHeldContainerDocumentTombstones: (containerIds) =>\n      listRetryableHeldContainerDocumentTombstones(execSql, containerIds),\n    listKnownContainerDocumentPlacements: (placements) =>\n      listKnownContainerDocumentPlacements(execSql, placements),\n    onFullListing: request.onFullListing,\n    refuteContainerDocumentTombstoneHolds: (placements) =>\n      refuteContainerDocumentTombstoneHolds(execSql, placements),\n    verifyContainerDocumentTombstones: createContainerDocumentTombstoneVerifier(\n      containerOrganizationId,\n      loadHead,\n      loadEpoch,\n    ),\n    verifyDiscoveredDocuments: createDiscoveredDocumentVerifier(\n      containerOrganizationId,\n      loadHead,\n      loadEpoch,\n      input.evidenceStore,\n      request.onPendingDiscovery,\n    ),\n  };\n}\n\n/**\n * Internal adapter shared by explicit discovery and background reconciliation:\n * one batched listing for every requested container, then per-container\n * verification scoped to each container's durable organization.\n */\nexport async function discoverContainerDocumentLanesForRuntime({\n  onOutcome,\n  requests,\n  runtimeService,\n}: {\n  readonly onOutcome?: ContainerDocumentDiscoveryOutcomeHandler | undefined;\n  readonly requests: ReadonlyArray<ContainerDocumentDiscoveryRequest>;\n  readonly runtimeService: InternalRuntime;\n}): Promise<ReadonlyArray<ContainerDocumentDiscoveryOutcome>> {\n  const unlisted = (\n    containerId: string,\n  ): ContainerDocumentDiscoveryOutcome => ({\n    containerId,\n    status: \"fulfilled\",\n    value: null,\n  });\n  const input = runtimeService.workflowInput();\n  if (input.infra.dbStatus !== \"ready\") {\n    return requests.map(({ containerId }) => unlisted(containerId));\n  }\n  const runtime = createContainerContentsWorkflowRuntime(input);\n  const execSql = input.infra.execSql;\n  const evidenceStore = createDocumentDiscoveryEvidenceStore(execSql);\n  const queries = createContainerDocumentQueriesFromRuntime(runtime);\n  // Capture the reset fence before reading any lane's scope, so a reset\n  // between these reads and the listing cannot publish old-organization\n  // evidence into its replacement.\n  const generation = await evidenceStore.begin();\n  const lanes: ContainerDocumentDiscoveryLane[] = [];\n  for (const request of requests) {\n    const stored =\n      await sqlContainerContentsPersistence.loadContainerMetadataState(\n        execSql,\n        request.containerId,\n      );\n    if (stored)\n      lanes.push(\n        createDiscoveryLane({\n          containerOrganizationId: stored.container.organizationId,\n          evidenceStore,\n          execSql,\n          queries,\n          request,\n          runtime,\n        }),\n      );\n  }\n  const outcomes = await discoverContainerDocumentLanes({\n    generation,\n    lanes,\n    listContainerDocumentLanes: (listed) =>\n      listContainerDocumentLanesFromApi(runtime.apiClient, listed),\n    loadContainerDocumentWatermark: queries.loadContainerDocumentWatermark,\n    onOutcome,\n  });\n  const outcomeByContainerId = new Map(\n    outcomes.map((outcome) => [outcome.containerId, outcome]),\n  );\n  return requests.map(\n    ({ containerId }) =>\n      outcomeByContainerId.get(containerId) ?? unlisted(containerId),\n  );\n}\n\n/** Discovers one container; a rejected lane rethrows its failure. */\nexport async function discoverContainerDocumentsForRuntime({\n  runtimeService,\n  ...request\n}: ContainerDocumentDiscoveryRequest & {\n  readonly runtimeService: InternalRuntime;\n}): Promise<ReadonlyArray<DocumentSummary> | null> {\n  const [outcome] = await discoverContainerDocumentLanesForRuntime({\n    requests: [request],\n    runtimeService,\n  });\n  if (outcome?.status === \"rejected\") throw outcome.reason;\n  return outcome?.value ?? null;\n}\n"]}

package/client/containerContents/index.d.ts

@@ -2,13 +2,13 @@ import { createContainerDocumentObjectSyncState } from "../../workflows/containe
 import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 import type { ContainerContents } from "./types.js";
 export type { ContainerContentsContextValue, ContainerContentsStore, ContainerContentsStoreOptions, ContainerNode, } from "../../stores/container-contents/index.js";
-export type { BlobInfo, BlobInfoAttachmentKind, BlobInfoDocumentReference, BlobInfoInput, BlobInfoList, BlobInfoSort, BlobInfoSortDirection, BlobInfoSortKey, } from "../../workflows/container-contents/blobInfo.js";
-export type { ContainerInfo, ContainerShareAccessLevel, } from "../../workflows/container-contents/containerInfo.js";
-export type { DocumentAttributionRangesInput, DocumentAttributionRangesPage, } from "../../workflows/container-contents/documentAttributionRanges.js";
-export type { DocumentInfo } from "../../workflows/container-contents/documentInfo.js";
-export type { ContainerDocumentQueries, ContainerDocumentSidebarRow, ContainerItemRow, ContainerItemSort, ContainerItemSortDirection, ContainerItemSortKey, } from "../../workflows/container-contents/documentQueries.js";
-export type { SetLinkedContainerIdsForDocument } from "../../workflows/container-contents/documentStructure.js";
-export type { PendingWriteQueueItem, PendingWriteQueueItemStatus, PendingWriteQueueObjectKind, PendingWriteQueueOperation, PendingWriteQueueOperationKind, PendingWriteQueueOperationStatus, } from "../../workflows/container-contents/pendingWrites.js";
+export type { DocumentAttributionRangesInput, DocumentAttributionRangesPage, } from "../../workflows/container-contents/attribution/documentAttributionRanges.js";
+export type { ContainerDocumentQueries, ContainerDocumentSidebarRow, ContainerItemRow, ContainerItemSort, ContainerItemSortDirection, ContainerItemSortKey, } from "../../workflows/container-contents/documentQueries/index.js";
+export type { SetLinkedContainerIdsForDocument } from "../../workflows/container-contents/documentQueries/documentStructure.js";
+export type { BlobInfo, BlobInfoAttachmentKind, BlobInfoDocumentReference, BlobInfoInput, BlobInfoList, BlobInfoSort, BlobInfoSortDirection, BlobInfoSortKey, } from "../../workflows/container-contents/info/blobInfo.js";
+export type { ContainerInfo, ContainerShareAccessLevel, } from "../../workflows/container-contents/info/containerInfo.js";
+export type { DocumentInfo } from "../../workflows/container-contents/info/documentInfo.js";
+export type { PendingWriteQueueItem, PendingWriteQueueItemStatus, PendingWriteQueueObjectKind, PendingWriteQueueOperation, PendingWriteQueueOperationKind, PendingWriteQueueOperationStatus, } from "../../workflows/container-contents/pendingWrites/index.js";
 export type { ContainerDocumentObjectSyncState, ContainerDocumentObjectSyncStatus, } from "../../workflows/container-contents/syncState.js";
 export type { ContainerContents, ContainerDocumentLinkInput, ContainerDocumentLinks, ContainerInfoInput, DocumentInfoInput, LinkDocumentToContainerInput, MergeDocumentSummary, MoveDocumentToContainerInput, OpenContainerDocumentInput, PurgeDocumentInput, PurgeDocumentResult, SetActiveDocumentContainerInput, UnlinkDocumentFromContainerInput, } from "./types.js";
 export { createContainerDocumentObjectSyncState };

package/client/containerContents/index.js

@@ -3,16 +3,16 @@ import { inheritPrincipalHistoryProtection } from "../../data/principals/princip
 import { getOrCreateContainerContentsStore, } from "../../stores/container-contents/index.js";
 import { openDocumentStore } from "../../stores/documents/index.js";
 import { relinkDocumentStoreWithCommitSideEffect } from "../../stores/documents/documentStore/internalRelink.js";
-import { listBlobInfo, } from "../../workflows/container-contents/blobInfo.js";
-import { loadContainerInfo, } from "../../workflows/container-contents/containerInfo.js";
-import { loadDocumentAttributionRanges, } from "../../workflows/container-contents/documentAttributionRanges.js";
-import { loadDocumentInfo, } from "../../workflows/container-contents/documentInfo.js";
-import { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "../../workflows/container-contents/documentPurge.js";
-import { createContainerDocumentQueriesFromRuntime, } from "../../workflows/container-contents/documentQueries.js";
-import { activateDocumentLink, addDocumentLink, canMutateDocumentLink, canMutateLocalDocumentLink, moveDocumentLink, removeDocumentLink, } from "../../workflows/container-contents/documentStructure.js";
+import { loadDocumentAttributionRanges, } from "../../workflows/container-contents/attribution/documentAttributionRanges.js";
+import { createContainerDocumentQueriesFromRuntime, } from "../../workflows/container-contents/documentQueries/index.js";
+import { activateDocumentLink, addDocumentLink, canMutateDocumentLink, canMutateLocalDocumentLink, moveDocumentLink, removeDocumentLink, } from "../../workflows/container-contents/documentQueries/documentStructure.js";
+import { listBlobInfo, } from "../../workflows/container-contents/info/blobInfo.js";
+import { loadContainerInfo, } from "../../workflows/container-contents/info/containerInfo.js";
+import { loadDocumentInfo, } from "../../workflows/container-contents/info/documentInfo.js";
 import { createContainerContentsDocumentProjectionUserKeyResolver } from "../../workflows/container-contents/projectionKeys.js";
 import { createContainerContentsDocumentsRuntime, createContainerContentsStoreWorkflowRuntime, } from "../../workflows/container-contents/runtime.js";
 import { createContainerDocumentObjectSyncState } from "../../workflows/container-contents/syncState.js";
+import { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "../../workflows/container-contents/tombstones/documentPurge.js";
 import { createOrganizationReadModelCoordinator, } from "../organizations/organizationReadModels.js";
 import { discoverContainerDocumentsForRuntime } from "./documentDiscovery.js";
 export { createContainerDocumentObjectSyncState };

package/client/containerContents/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAGL,iCAAiC,GAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAGL,YAAY,GACb,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,iBAAiB,GAClB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAGL,6BAA6B,GAC9B,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAEL,gBAAgB,GACjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAEL,yCAAyC,GAC1C,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAE1B,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,wDAAwD,EAAE,MAAM,mDAAmD,CAAC;AAC7H,OAAO,EAEL,uCAAuC,EACvC,2CAA2C,GAC5C,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAEtG,OAAO,EACL,sCAAsC,GAEvC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qBAAqB,CAAC;AAyE3E,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAElD,MAAM,UAAU,uBAAuB,CACrC,OAAwB;IAExB,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA+B,EAC/B,oBAA0C;IAE1C,OAAO;QACL,uBAAuB,EAAE,OAAO,CAAC,eAAe;QAChD,oBAAoB;QACpB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;gBACjC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,KAAK;gBACR,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE,CAC/C,gBAAgB;oBACd,CAAC,CAAC,uCAAuC,CACrC,KAAK,EACL,WAAW,EACX,gBAAgB,CACjB;oBACH,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;aAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAuE;IAEvE,IACE,KAAK,CAAC,IAAI,CAAC,UAAU;QACrB,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAClD,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAQD,SAAS,YAAY,CACnB,OAAqC;IAErC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,SAAS,sCAAsC,CAC7C,OAAqC,EACrC,KAAqC;IAErC,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,eAAe;QAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACpC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,2BAA2B,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,qBAAqB;QACxD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,wBAAwB;IAGC;IAFZ,sBAAsB,CAAmC;IAE1E,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;QAC1D,IAAI,CAAC,sBAAsB;YACzB,sCAAsC,CAAC,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,QAAQ,CACN,OAAmD;QAEnD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iCAAiC,CAC7C,OAAO,CAAC,KAAK,CAAC,WAAW,EACzB,OAAO,EACP,OAAO,CACR,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe;QACb,OAAO,yCAAyC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,aAAa;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,wBAAwB,GAC5B,wDAAwD,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,eAAe,GAAG,CAAC,WAA0B,EAAE,EAAE,CACrD,uCAAuC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,qBAAqB,GAAG,CAAC,KAAiC,EAAE,EAAE,CAClE,iBAAiB,CACf,OAAO,CAAC,KAAK,CAAC,WAAW,EACzB,KAAK,CAAC,OAAO,EACb,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAClC,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,mBAAmB,EACzB,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CACjD,CAAC;QACJ,MAAM,aAAa,GAA2B;YAC5C,GAAG,OAAO;YACV,eAAe;YACf,YAAY,EAAE,qBAAqB;YACnC,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,oBAAoB,CAAC;gBACnB,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,aAAa;gBACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACJ,sBAAsB,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACtD,8BAA8B,EAAE,0BAA0B,CAAC,OAAO,CAAC;YACnE,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,eAAe,CAAC;gBACd,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,aAAa;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;gBACjD,gCAAgC,EAC9B,KAAK,CAAC,gCAAgC;gBACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACJ,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,gBAAgB,CAAC;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC;gBACjC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;gBACtD,OAAO,EAAE,aAAa;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;gBACjD,gCAAgC,EAC9B,KAAK,CAAC,gCAAgC;gBACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACJ,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC1B,sBAAsB,CAAC;gBACrB,QAAQ;gBACR,wBAAwB;gBACxB,OAAO,EAAE,aAAa;aACvB,CAAC;YACJ,wBAAwB;YACxB,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrC,kBAAkB,CAAC;gBACjB,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,OAAO,EAAE,aAAa;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;gBACjD,gCAAgC,EAC9B,KAAK,CAAC,gCAAgC;aACzC,CAAC;SACL,CAAC;QAEF,OAAO,iCAAiC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnE,CAAC;IAED,0BAA0B,CACxB,WAAmB;QAEnB,OAAO,oCAAoC,CAAC;YAC1C,WAAW;YACX,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,KAInB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,EACzB,KAAK,CAAC,OAAO,EACb,uCAAuC,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,EACnE,KAAK,CAAC,UAAU,IAAI,IAAI,CACzB,CAAC;QACF,KAAK,CAAC,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IAED,iBAAiB,CAAC,KAAyB;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,eAAe;YAC5B,OAAO,CAAC,IAAI,CAAC,cAAc;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM;YACjB,CAAC,CAAC;gBACE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBACtC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;aAC5B;YACH,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,yBAAyB,GAC7B,KAAK,CAAC,cAAc,KAAK,QAAQ;YAC/B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,OAAO,iBAAiB,CAAC;YACvB,GAAG,KAAK;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,yBAAyB;YAC9C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;YAC9B,sBAAsB,EAAE,KAAK,IAAI,EAAE;gBACjC,IACE,CAAC,iBAAiB;oBAClB,CAAC,sCAAsC,CACrC,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,EACnC,iBAAiB,CAClB,EACD,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,kEAAkE;gBAClE,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAC5D,iBAAiB,CAAC,cAAc,CACjC,CAAC;gBACF,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,EACnC,iBAAiB,CAClB;oBACC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;oBAC5B,CAAC,CAAC,EAAE,CAAC;YACT,CAAC;YACD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,KAAwB;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gBAAgB,CAAC;YACtB,GAAG,KAAK;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;YAC9B,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B,CACzB,UAAkB;QAElB,OAAO,IAAI,CAAC,cAAc;aACvB,aAAa,EAAE;aACf,SAAS,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,6BAA6B,CAC3B,KAAqC;QAErC,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,QAAuB,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,YAAY,CAAC;YAClB,GAAG,KAAK;YACR,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,EACnC,IAAI,CAAC,cAAc,CAAC,kBAAkB,CACvC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../data/documents/documentConstants\";\nimport type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport {\n  type ContainerContentsStore,\n  type ContainerContentsStoreOptions,\n  getOrCreateContainerContentsStore,\n} from \"../../stores/container-contents\";\nimport { openDocumentStore } from \"../../stores/documents\";\nimport { relinkDocumentStoreWithCommitSideEffect } from \"../../stores/documents/documentStore/internalRelink\";\nimport {\n  type BlobInfoInput,\n  type BlobInfoList,\n  listBlobInfo,\n} from \"../../workflows/container-contents/blobInfo\";\nimport {\n  type ContainerInfo,\n  loadContainerInfo,\n} from \"../../workflows/container-contents/containerInfo\";\nimport {\n  type DocumentAttributionRangesInput,\n  type DocumentAttributionRangesPage,\n  loadDocumentAttributionRanges,\n} from \"../../workflows/container-contents/documentAttributionRanges\";\nimport {\n  type DocumentInfo,\n  loadDocumentInfo,\n} from \"../../workflows/container-contents/documentInfo\";\nimport {\n  purgeLocalContainerDocument,\n  purgeRemoteContainerDocument,\n} from \"../../workflows/container-contents/documentPurge\";\nimport {\n  type ContainerDocumentQueries,\n  createContainerDocumentQueriesFromRuntime,\n} from \"../../workflows/container-contents/documentQueries\";\nimport {\n  activateDocumentLink,\n  addDocumentLink,\n  canMutateDocumentLink,\n  canMutateLocalDocumentLink,\n  type DocumentStructuralMutationHost,\n  moveDocumentLink,\n  removeDocumentLink,\n} from \"../../workflows/container-contents/documentStructure\";\nimport { createContainerContentsDocumentProjectionUserKeyResolver } from \"../../workflows/container-contents/projectionKeys\";\nimport {\n  type ContainerContentsStoreWorkflowRuntime,\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsStoreWorkflowRuntime,\n} from \"../../workflows/container-contents/runtime\";\nimport { createContainerDocumentObjectSyncState } from \"../../workflows/container-contents/syncState\";\nimport type { DocumentsWorkflowRuntime } from \"../../workflows/documents\";\nimport {\n  createOrganizationReadModelCoordinator,\n  type OrganizationReadModelCoordinator,\n} from \"../organizations/organizationReadModels\";\nimport type {\n  InternalRuntime,\n  InternalWorkflowRuntimeInput,\n} from \"../runtime/workflowRuntime\";\nimport { discoverContainerDocumentsForRuntime } from \"./documentDiscovery\";\nimport type {\n  ContainerContents,\n  ContainerDocumentLinks,\n  ContainerInfoInput,\n  DocumentInfoInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n} from \"./types\";\n\nexport type {\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerNode,\n} from \"../../stores/container-contents\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n} from \"../../workflows/container-contents/blobInfo\";\nexport type {\n  ContainerInfo,\n  ContainerShareAccessLevel,\n} from \"../../workflows/container-contents/containerInfo\";\nexport type {\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n} from \"../../workflows/container-contents/documentAttributionRanges\";\nexport type { DocumentInfo } from \"../../workflows/container-contents/documentInfo\";\nexport type {\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n} from \"../../workflows/container-contents/documentQueries\";\nexport type { SetLinkedContainerIdsForDocument } from \"../../workflows/container-contents/documentStructure\";\nexport type {\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n} from \"../../workflows/container-contents/pendingWrites\";\nexport type {\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n} from \"../../workflows/container-contents/syncState\";\nexport type {\n  ContainerContents,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerInfoInput,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  UnlinkDocumentFromContainerInput,\n} from \"./types\";\n\nexport { createContainerDocumentObjectSyncState };\n\nexport function createContainerContents(\n  runtime: InternalRuntime,\n): ContainerContents {\n  return new ContainerContentsService(runtime);\n}\n\nfunction createDocumentLinkHost(\n  runtime: ContainerDocumentLinks,\n  mergeDocumentSummary: MergeDocumentSummary,\n): DocumentStructuralMutationHost<DocumentsWorkflowRuntime> {\n  return {\n    documentWorkflowRuntime: runtime.documentRuntime,\n    mergeDocumentSummary,\n    openDocumentStore: (input) => {\n      const store = runtime.openDocument({\n        containerId: input.containerId,\n        documentId: input.documentId,\n        localId: input.localId,\n      });\n      return {\n        ...store,\n        relink: ({ commitSideEffect, ...relinkInput }) =>\n          commitSideEffect\n            ? relinkDocumentStoreWithCommitSideEffect(\n                store,\n                relinkInput,\n                commitSideEffect,\n              )\n            : store.relink(relinkInput),\n      };\n    },\n  };\n}\n\nfunction moveDocumentLinkNote(\n  input: Pick<MoveDocumentToContainerInput, \"note\" | \"sourceContainerId\">,\n): DocumentSummary {\n  if (\n    input.note.documentId &&\n    input.sourceContainerId &&\n    input.sourceContainerId !== input.note.containerId\n  ) {\n    return { ...input.note, containerId: input.sourceContainerId };\n  }\n\n  return input.note;\n}\n\ninterface ContainerInfoOrganizationScope {\n  readonly domainScope: InternalWorkflowRuntimeInput[\"state\"][\"domainScope\"];\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nfunction readyExecSql(\n  runtime: InternalWorkflowRuntimeInput,\n): InternalWorkflowRuntimeInput[\"infra\"][\"execSql\"] | null {\n  return runtime.infra.dbStatus === \"ready\" ? runtime.infra.execSql : null;\n}\n\nfunction isActiveContainerInfoOrganizationScope(\n  runtime: InternalWorkflowRuntimeInput,\n  scope: ContainerInfoOrganizationScope,\n): boolean {\n  return (\n    runtime.auth.isAuthenticated &&\n    runtime.auth.organizationId === scope.organizationId &&\n    runtime.auth.userId === scope.userId &&\n    runtime.state.domainScope === scope.domainScope\n  );\n}\n\nfunction purgeDocumentFromLinks(input: {\n  readonly document: Parameters<ContainerDocumentLinks[\"purgeDocument\"]>[0];\n  readonly resolveProjectionUserKey: ContainerDocumentLinks[\"resolveProjectionUserKey\"];\n  readonly runtime: ContainerDocumentLinks;\n}) {\n  const { note } = input.document;\n  if (!note.documentId) {\n    return purgeLocalContainerDocument({\n      noteId: note.id,\n      runtime: input.runtime,\n    });\n  }\n  return purgeRemoteContainerDocument({\n    documentId: note.documentId,\n    documentKind: note.documentKind ?? DEFAULT_DOCUMENT_KIND,\n    noteId: note.id,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n  });\n}\n\nclass ContainerContentsService implements ContainerContents {\n  private readonly organizationReadModels: OrganizationReadModelCoordinator;\n\n  constructor(private readonly runtimeService: InternalRuntime) {\n    this.organizationReadModels =\n      createOrganizationReadModelCoordinator(runtimeService);\n  }\n\n  openTree(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): ContainerContentsStore {\n    const runtime = this.workflowRuntime();\n    const store = getOrCreateContainerContentsStore(\n      runtime.state.domainScope,\n      runtime,\n      options,\n    );\n    return store;\n  }\n\n  documentQueries(): ContainerDocumentQueries {\n    return createContainerDocumentQueriesFromRuntime(this.workflowRuntime());\n  }\n\n  documentLinks(): ContainerDocumentLinks {\n    const runtime = this.workflowRuntime();\n    const resolveProjectionUserKey =\n      createContainerContentsDocumentProjectionUserKeyResolver(runtime);\n    const documentRuntime = (containerId: string | null) =>\n      createContainerContentsDocumentsRuntime(runtime, containerId);\n    const openContainerDocument = (input: OpenContainerDocumentInput) =>\n      openDocumentStore(\n        runtime.state.domainScope,\n        input.localId,\n        documentRuntime(input.containerId),\n        input.documentId ?? null,\n        input.initialText,\n        input.initialDocumentKind,\n        { deferInitialUpdate: input.deferInitialUpdate },\n      );\n    const documentLinks: ContainerDocumentLinks = {\n      ...runtime,\n      documentRuntime,\n      openDocument: openContainerDocument,\n      setActiveDocumentContainer: (input) =>\n        activateDocumentLink({\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: input.note,\n          runtime: documentLinks,\n          targetContainerId: input.targetContainerId,\n        }),\n      canMutateDocumentLinks: canMutateDocumentLink(runtime),\n      canMutateUnsyncedDocumentLinks: canMutateLocalDocumentLink(runtime),\n      linkDocumentToContainer: (input) =>\n        addDocumentLink({\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: input.note,\n          runtime: documentLinks,\n          scheduleSync: () => this.openTree().requestSync(),\n          setLinkedContainerIdsForDocument:\n            input.setLinkedContainerIdsForDocument,\n          targetContainerId: input.targetContainerId,\n        }),\n      moveDocumentToContainer: (input) =>\n        moveDocumentLink({\n          expandNode: input.expandNode,\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: moveDocumentLinkNote(input),\n          replaceLinkedContainers: input.replaceLinkedContainers,\n          runtime: documentLinks,\n          scheduleSync: () => this.openTree().requestSync(),\n          setLinkedContainerIdsForDocument:\n            input.setLinkedContainerIdsForDocument,\n          targetContainerId: input.targetContainerId,\n        }),\n      purgeDocument: (document) =>\n        purgeDocumentFromLinks({\n          document,\n          resolveProjectionUserKey,\n          runtime: documentLinks,\n        }),\n      resolveProjectionUserKey,\n      unlinkDocumentFromContainer: (input) =>\n        removeDocumentLink({\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: input.note,\n          removedContainerId: input.removedContainerId,\n          runtime: documentLinks,\n          scheduleSync: () => this.openTree().requestSync(),\n          setLinkedContainerIdsForDocument:\n            input.setLinkedContainerIdsForDocument,\n        }),\n    };\n\n    return inheritPrincipalHistoryProtection(runtime, documentLinks);\n  }\n\n  discoverContainerDocuments(\n    containerId: string,\n  ): Promise<ReadonlyArray<DocumentSummary> | null> {\n    return discoverContainerDocumentsForRuntime({\n      containerId,\n      runtimeService: this.runtimeService,\n    });\n  }\n\n  pullDocumentContent(input: {\n    containerId: string;\n    localId: string;\n    documentId?: string | null | undefined;\n  }): void {\n    const runtime = this.workflowRuntime();\n    const store = openDocumentStore(\n      runtime.state.domainScope,\n      input.localId,\n      createContainerContentsDocumentsRuntime(runtime, input.containerId),\n      input.documentId ?? null,\n    );\n    store.requestRemoteSync();\n  }\n\n  loadContainerInfo(input: ContainerInfoInput): Promise<ContainerInfo> {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationScope =\n      runtime.auth.isAuthenticated &&\n      runtime.auth.organizationId &&\n      runtime.auth.userId\n        ? {\n            domainScope: runtime.state.domainScope,\n            organizationId: runtime.auth.organizationId,\n            userId: runtime.auth.userId,\n          }\n        : null;\n    const cachedContainerProjection =\n      input.remoteInfoMode === \"always\"\n        ? null\n        : this.openTree().getCachedContainerWriterProjection(input.containerId);\n    return loadContainerInfo({\n      ...input,\n      apiClient: runtime.apiClient,\n      containerProjection: cachedContainerProjection,\n      execSql: readyExecSql(runtime),\n      loadOrganizationGroups: async () => {\n        if (\n          !organizationScope ||\n          !isActiveContainerInfoOrganizationScope(\n            this.runtimeService.workflowInput(),\n            organizationScope,\n          )\n        ) {\n          return [];\n        }\n        // Organization groups are disposable presentation data. Container\n        // writer projections remain the authority for grants and access.\n        const projection = await this.organizationReadModels.loadLocal(\n          organizationScope.organizationId,\n        );\n        return isActiveContainerInfoOrganizationScope(\n          this.runtimeService.workflowInput(),\n          organizationScope,\n        )\n          ? (projection?.groups ?? [])\n          : [];\n      },\n      parentId: input.parentId ?? null,\n    });\n  }\n\n  loadDocumentInfo(input: DocumentInfoInput): Promise<DocumentInfo> {\n    const runtime = this.runtimeService.workflowInput();\n    return loadDocumentInfo({\n      ...input,\n      apiClient: runtime.apiClient,\n      execSql: readyExecSql(runtime),\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n    });\n  }\n\n  loadDocumentEditAttribution(\n    documentId: string,\n  ): ReturnType<ContainerContents[\"loadDocumentEditAttribution\"]> {\n    return this.runtimeService\n      .workflowInput()\n      .apiClient.getDocumentEditAttribution(documentId);\n  }\n\n  loadDocumentAttributionRanges(\n    input: DocumentAttributionRangesInput,\n  ): Promise<DocumentAttributionRangesPage> {\n    return loadDocumentAttributionRanges({\n      apiClient: this.runtimeService.workflowInput().apiClient,\n      query: input,\n    });\n  }\n\n  listBlobInfo(input: BlobInfoInput = {}): Promise<BlobInfoList> {\n    const runtime = this.runtimeService.workflowInput();\n    return listBlobInfo({\n      ...input,\n      execSql: readyExecSql(runtime),\n    });\n  }\n\n  workflowRuntime(): ContainerContentsStoreWorkflowRuntime {\n    return createContainerContentsStoreWorkflowRuntime(\n      this.runtimeService.workflowInput(),\n      this.runtimeService.adoptRootContainer,\n    );\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAGL,iCAAiC,GAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAGL,6BAA6B,GAC9B,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAEL,yCAAyC,GAC1C,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAE1B,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAGL,YAAY,GACb,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAEL,iBAAiB,GAClB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,gBAAgB,GACjB,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,wDAAwD,EAAE,MAAM,mDAAmD,CAAC;AAC7H,OAAO,EAEL,uCAAuC,EACvC,2CAA2C,GAC5C,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EACL,sCAAsC,GAEvC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qBAAqB,CAAC;AAyE3E,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAElD,MAAM,UAAU,uBAAuB,CACrC,OAAwB;IAExB,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA+B,EAC/B,oBAA0C;IAE1C,OAAO;QACL,uBAAuB,EAAE,OAAO,CAAC,eAAe;QAChD,oBAAoB;QACpB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;gBACjC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,KAAK;gBACR,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE,CAC/C,gBAAgB;oBACd,CAAC,CAAC,uCAAuC,CACrC,KAAK,EACL,WAAW,EACX,gBAAgB,CACjB;oBACH,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;aAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAuE;IAEvE,IACE,KAAK,CAAC,IAAI,CAAC,UAAU;QACrB,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAClD,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAQD,SAAS,YAAY,CACnB,OAAqC;IAErC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,SAAS,sCAAsC,CAC7C,OAAqC,EACrC,KAAqC;IAErC,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,eAAe;QAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACpC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,2BAA2B,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,qBAAqB;QACxD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,wBAAwB;IAGC;IAFZ,sBAAsB,CAAmC;IAE1E,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;QAC1D,IAAI,CAAC,sBAAsB;YACzB,sCAAsC,CAAC,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,QAAQ,CACN,OAAmD;QAEnD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iCAAiC,CAC7C,OAAO,CAAC,KAAK,CAAC,WAAW,EACzB,OAAO,EACP,OAAO,CACR,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe;QACb,OAAO,yCAAyC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,aAAa;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,wBAAwB,GAC5B,wDAAwD,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,eAAe,GAAG,CAAC,WAA0B,EAAE,EAAE,CACrD,uCAAuC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,qBAAqB,GAAG,CAAC,KAAiC,EAAE,EAAE,CAClE,iBAAiB,CACf,OAAO,CAAC,KAAK,CAAC,WAAW,EACzB,KAAK,CAAC,OAAO,EACb,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAClC,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,mBAAmB,EACzB,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CACjD,CAAC;QACJ,MAAM,aAAa,GAA2B;YAC5C,GAAG,OAAO;YACV,eAAe;YACf,YAAY,EAAE,qBAAqB;YACnC,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,oBAAoB,CAAC;gBACnB,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,aAAa;gBACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACJ,sBAAsB,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACtD,8BAA8B,EAAE,0BAA0B,CAAC,OAAO,CAAC;YACnE,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,eAAe,CAAC;gBACd,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,aAAa;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;gBACjD,gCAAgC,EAC9B,KAAK,CAAC,gCAAgC;gBACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACJ,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,gBAAgB,CAAC;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC;gBACjC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;gBACtD,OAAO,EAAE,aAAa;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;gBACjD,gCAAgC,EAC9B,KAAK,CAAC,gCAAgC;gBACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACJ,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC1B,sBAAsB,CAAC;gBACrB,QAAQ;gBACR,wBAAwB;gBACxB,OAAO,EAAE,aAAa;aACvB,CAAC;YACJ,wBAAwB;YACxB,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrC,kBAAkB,CAAC;gBACjB,IAAI,EAAE,sBAAsB,CAC1B,aAAa,EACb,KAAK,CAAC,oBAAoB,CAC3B;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,OAAO,EAAE,aAAa;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;gBACjD,gCAAgC,EAC9B,KAAK,CAAC,gCAAgC;aACzC,CAAC;SACL,CAAC;QAEF,OAAO,iCAAiC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnE,CAAC;IAED,0BAA0B,CACxB,WAAmB;QAEnB,OAAO,oCAAoC,CAAC;YAC1C,WAAW;YACX,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,KAInB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,EACzB,KAAK,CAAC,OAAO,EACb,uCAAuC,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,EACnE,KAAK,CAAC,UAAU,IAAI,IAAI,CACzB,CAAC;QACF,KAAK,CAAC,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IAED,iBAAiB,CAAC,KAAyB;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,eAAe;YAC5B,OAAO,CAAC,IAAI,CAAC,cAAc;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM;YACjB,CAAC,CAAC;gBACE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBACtC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;aAC5B;YACH,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,yBAAyB,GAC7B,KAAK,CAAC,cAAc,KAAK,QAAQ;YAC/B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,OAAO,iBAAiB,CAAC;YACvB,GAAG,KAAK;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,yBAAyB;YAC9C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;YAC9B,sBAAsB,EAAE,KAAK,IAAI,EAAE;gBACjC,IACE,CAAC,iBAAiB;oBAClB,CAAC,sCAAsC,CACrC,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,EACnC,iBAAiB,CAClB,EACD,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,kEAAkE;gBAClE,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAC5D,iBAAiB,CAAC,cAAc,CACjC,CAAC;gBACF,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,EACnC,iBAAiB,CAClB;oBACC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;oBAC5B,CAAC,CAAC,EAAE,CAAC;YACT,CAAC;YACD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,KAAwB;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gBAAgB,CAAC;YACtB,GAAG,KAAK;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;YAC9B,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B,CACzB,UAAkB;QAElB,OAAO,IAAI,CAAC,cAAc;aACvB,aAAa,EAAE;aACf,SAAS,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,6BAA6B,CAC3B,KAAqC;QAErC,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,QAAuB,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,YAAY,CAAC;YAClB,GAAG,KAAK;YACR,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,EACnC,IAAI,CAAC,cAAc,CAAC,kBAAkB,CACvC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../data/documents/documentConstants\";\nimport type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport {\n  type ContainerContentsStore,\n  type ContainerContentsStoreOptions,\n  getOrCreateContainerContentsStore,\n} from \"../../stores/container-contents\";\nimport { openDocumentStore } from \"../../stores/documents\";\nimport { relinkDocumentStoreWithCommitSideEffect } from \"../../stores/documents/documentStore/internalRelink\";\nimport {\n  type DocumentAttributionRangesInput,\n  type DocumentAttributionRangesPage,\n  loadDocumentAttributionRanges,\n} from \"../../workflows/container-contents/attribution/documentAttributionRanges\";\nimport {\n  type ContainerDocumentQueries,\n  createContainerDocumentQueriesFromRuntime,\n} from \"../../workflows/container-contents/documentQueries\";\nimport {\n  activateDocumentLink,\n  addDocumentLink,\n  canMutateDocumentLink,\n  canMutateLocalDocumentLink,\n  type DocumentStructuralMutationHost,\n  moveDocumentLink,\n  removeDocumentLink,\n} from \"../../workflows/container-contents/documentQueries/documentStructure\";\nimport {\n  type BlobInfoInput,\n  type BlobInfoList,\n  listBlobInfo,\n} from \"../../workflows/container-contents/info/blobInfo\";\nimport {\n  type ContainerInfo,\n  loadContainerInfo,\n} from \"../../workflows/container-contents/info/containerInfo\";\nimport {\n  type DocumentInfo,\n  loadDocumentInfo,\n} from \"../../workflows/container-contents/info/documentInfo\";\nimport { createContainerContentsDocumentProjectionUserKeyResolver } from \"../../workflows/container-contents/projectionKeys\";\nimport {\n  type ContainerContentsStoreWorkflowRuntime,\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsStoreWorkflowRuntime,\n} from \"../../workflows/container-contents/runtime\";\nimport { createContainerDocumentObjectSyncState } from \"../../workflows/container-contents/syncState\";\nimport {\n  purgeLocalContainerDocument,\n  purgeRemoteContainerDocument,\n} from \"../../workflows/container-contents/tombstones/documentPurge\";\nimport type { DocumentsWorkflowRuntime } from \"../../workflows/documents\";\nimport {\n  createOrganizationReadModelCoordinator,\n  type OrganizationReadModelCoordinator,\n} from \"../organizations/organizationReadModels\";\nimport type {\n  InternalRuntime,\n  InternalWorkflowRuntimeInput,\n} from \"../runtime/workflowRuntime\";\nimport { discoverContainerDocumentsForRuntime } from \"./documentDiscovery\";\nimport type {\n  ContainerContents,\n  ContainerDocumentLinks,\n  ContainerInfoInput,\n  DocumentInfoInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n} from \"./types\";\n\nexport type {\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerNode,\n} from \"../../stores/container-contents\";\nexport type {\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n} from \"../../workflows/container-contents/attribution/documentAttributionRanges\";\nexport type {\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n} from \"../../workflows/container-contents/documentQueries\";\nexport type { SetLinkedContainerIdsForDocument } from \"../../workflows/container-contents/documentQueries/documentStructure\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n} from \"../../workflows/container-contents/info/blobInfo\";\nexport type {\n  ContainerInfo,\n  ContainerShareAccessLevel,\n} from \"../../workflows/container-contents/info/containerInfo\";\nexport type { DocumentInfo } from \"../../workflows/container-contents/info/documentInfo\";\nexport type {\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n} from \"../../workflows/container-contents/pendingWrites\";\nexport type {\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n} from \"../../workflows/container-contents/syncState\";\nexport type {\n  ContainerContents,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerInfoInput,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  UnlinkDocumentFromContainerInput,\n} from \"./types\";\n\nexport { createContainerDocumentObjectSyncState };\n\nexport function createContainerContents(\n  runtime: InternalRuntime,\n): ContainerContents {\n  return new ContainerContentsService(runtime);\n}\n\nfunction createDocumentLinkHost(\n  runtime: ContainerDocumentLinks,\n  mergeDocumentSummary: MergeDocumentSummary,\n): DocumentStructuralMutationHost<DocumentsWorkflowRuntime> {\n  return {\n    documentWorkflowRuntime: runtime.documentRuntime,\n    mergeDocumentSummary,\n    openDocumentStore: (input) => {\n      const store = runtime.openDocument({\n        containerId: input.containerId,\n        documentId: input.documentId,\n        localId: input.localId,\n      });\n      return {\n        ...store,\n        relink: ({ commitSideEffect, ...relinkInput }) =>\n          commitSideEffect\n            ? relinkDocumentStoreWithCommitSideEffect(\n                store,\n                relinkInput,\n                commitSideEffect,\n              )\n            : store.relink(relinkInput),\n      };\n    },\n  };\n}\n\nfunction moveDocumentLinkNote(\n  input: Pick<MoveDocumentToContainerInput, \"note\" | \"sourceContainerId\">,\n): DocumentSummary {\n  if (\n    input.note.documentId &&\n    input.sourceContainerId &&\n    input.sourceContainerId !== input.note.containerId\n  ) {\n    return { ...input.note, containerId: input.sourceContainerId };\n  }\n\n  return input.note;\n}\n\ninterface ContainerInfoOrganizationScope {\n  readonly domainScope: InternalWorkflowRuntimeInput[\"state\"][\"domainScope\"];\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nfunction readyExecSql(\n  runtime: InternalWorkflowRuntimeInput,\n): InternalWorkflowRuntimeInput[\"infra\"][\"execSql\"] | null {\n  return runtime.infra.dbStatus === \"ready\" ? runtime.infra.execSql : null;\n}\n\nfunction isActiveContainerInfoOrganizationScope(\n  runtime: InternalWorkflowRuntimeInput,\n  scope: ContainerInfoOrganizationScope,\n): boolean {\n  return (\n    runtime.auth.isAuthenticated &&\n    runtime.auth.organizationId === scope.organizationId &&\n    runtime.auth.userId === scope.userId &&\n    runtime.state.domainScope === scope.domainScope\n  );\n}\n\nfunction purgeDocumentFromLinks(input: {\n  readonly document: Parameters<ContainerDocumentLinks[\"purgeDocument\"]>[0];\n  readonly resolveProjectionUserKey: ContainerDocumentLinks[\"resolveProjectionUserKey\"];\n  readonly runtime: ContainerDocumentLinks;\n}) {\n  const { note } = input.document;\n  if (!note.documentId) {\n    return purgeLocalContainerDocument({\n      noteId: note.id,\n      runtime: input.runtime,\n    });\n  }\n  return purgeRemoteContainerDocument({\n    documentId: note.documentId,\n    documentKind: note.documentKind ?? DEFAULT_DOCUMENT_KIND,\n    noteId: note.id,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n  });\n}\n\nclass ContainerContentsService implements ContainerContents {\n  private readonly organizationReadModels: OrganizationReadModelCoordinator;\n\n  constructor(private readonly runtimeService: InternalRuntime) {\n    this.organizationReadModels =\n      createOrganizationReadModelCoordinator(runtimeService);\n  }\n\n  openTree(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): ContainerContentsStore {\n    const runtime = this.workflowRuntime();\n    const store = getOrCreateContainerContentsStore(\n      runtime.state.domainScope,\n      runtime,\n      options,\n    );\n    return store;\n  }\n\n  documentQueries(): ContainerDocumentQueries {\n    return createContainerDocumentQueriesFromRuntime(this.workflowRuntime());\n  }\n\n  documentLinks(): ContainerDocumentLinks {\n    const runtime = this.workflowRuntime();\n    const resolveProjectionUserKey =\n      createContainerContentsDocumentProjectionUserKeyResolver(runtime);\n    const documentRuntime = (containerId: string | null) =>\n      createContainerContentsDocumentsRuntime(runtime, containerId);\n    const openContainerDocument = (input: OpenContainerDocumentInput) =>\n      openDocumentStore(\n        runtime.state.domainScope,\n        input.localId,\n        documentRuntime(input.containerId),\n        input.documentId ?? null,\n        input.initialText,\n        input.initialDocumentKind,\n        { deferInitialUpdate: input.deferInitialUpdate },\n      );\n    const documentLinks: ContainerDocumentLinks = {\n      ...runtime,\n      documentRuntime,\n      openDocument: openContainerDocument,\n      setActiveDocumentContainer: (input) =>\n        activateDocumentLink({\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: input.note,\n          runtime: documentLinks,\n          targetContainerId: input.targetContainerId,\n        }),\n      canMutateDocumentLinks: canMutateDocumentLink(runtime),\n      canMutateUnsyncedDocumentLinks: canMutateLocalDocumentLink(runtime),\n      linkDocumentToContainer: (input) =>\n        addDocumentLink({\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: input.note,\n          runtime: documentLinks,\n          scheduleSync: () => this.openTree().requestSync(),\n          setLinkedContainerIdsForDocument:\n            input.setLinkedContainerIdsForDocument,\n          targetContainerId: input.targetContainerId,\n        }),\n      moveDocumentToContainer: (input) =>\n        moveDocumentLink({\n          expandNode: input.expandNode,\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: moveDocumentLinkNote(input),\n          replaceLinkedContainers: input.replaceLinkedContainers,\n          runtime: documentLinks,\n          scheduleSync: () => this.openTree().requestSync(),\n          setLinkedContainerIdsForDocument:\n            input.setLinkedContainerIdsForDocument,\n          targetContainerId: input.targetContainerId,\n        }),\n      purgeDocument: (document) =>\n        purgeDocumentFromLinks({\n          document,\n          resolveProjectionUserKey,\n          runtime: documentLinks,\n        }),\n      resolveProjectionUserKey,\n      unlinkDocumentFromContainer: (input) =>\n        removeDocumentLink({\n          host: createDocumentLinkHost(\n            documentLinks,\n            input.mergeDocumentSummary,\n          ),\n          note: input.note,\n          removedContainerId: input.removedContainerId,\n          runtime: documentLinks,\n          scheduleSync: () => this.openTree().requestSync(),\n          setLinkedContainerIdsForDocument:\n            input.setLinkedContainerIdsForDocument,\n        }),\n    };\n\n    return inheritPrincipalHistoryProtection(runtime, documentLinks);\n  }\n\n  discoverContainerDocuments(\n    containerId: string,\n  ): Promise<ReadonlyArray<DocumentSummary> | null> {\n    return discoverContainerDocumentsForRuntime({\n      containerId,\n      runtimeService: this.runtimeService,\n    });\n  }\n\n  pullDocumentContent(input: {\n    containerId: string;\n    localId: string;\n    documentId?: string | null | undefined;\n  }): void {\n    const runtime = this.workflowRuntime();\n    const store = openDocumentStore(\n      runtime.state.domainScope,\n      input.localId,\n      createContainerContentsDocumentsRuntime(runtime, input.containerId),\n      input.documentId ?? null,\n    );\n    store.requestRemoteSync();\n  }\n\n  loadContainerInfo(input: ContainerInfoInput): Promise<ContainerInfo> {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationScope =\n      runtime.auth.isAuthenticated &&\n      runtime.auth.organizationId &&\n      runtime.auth.userId\n        ? {\n            domainScope: runtime.state.domainScope,\n            organizationId: runtime.auth.organizationId,\n            userId: runtime.auth.userId,\n          }\n        : null;\n    const cachedContainerProjection =\n      input.remoteInfoMode === \"always\"\n        ? null\n        : this.openTree().getCachedContainerWriterProjection(input.containerId);\n    return loadContainerInfo({\n      ...input,\n      apiClient: runtime.apiClient,\n      containerProjection: cachedContainerProjection,\n      execSql: readyExecSql(runtime),\n      loadOrganizationGroups: async () => {\n        if (\n          !organizationScope ||\n          !isActiveContainerInfoOrganizationScope(\n            this.runtimeService.workflowInput(),\n            organizationScope,\n          )\n        ) {\n          return [];\n        }\n        // Organization groups are disposable presentation data. Container\n        // writer projections remain the authority for grants and access.\n        const projection = await this.organizationReadModels.loadLocal(\n          organizationScope.organizationId,\n        );\n        return isActiveContainerInfoOrganizationScope(\n          this.runtimeService.workflowInput(),\n          organizationScope,\n        )\n          ? (projection?.groups ?? [])\n          : [];\n      },\n      parentId: input.parentId ?? null,\n    });\n  }\n\n  loadDocumentInfo(input: DocumentInfoInput): Promise<DocumentInfo> {\n    const runtime = this.runtimeService.workflowInput();\n    return loadDocumentInfo({\n      ...input,\n      apiClient: runtime.apiClient,\n      execSql: readyExecSql(runtime),\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n    });\n  }\n\n  loadDocumentEditAttribution(\n    documentId: string,\n  ): ReturnType<ContainerContents[\"loadDocumentEditAttribution\"]> {\n    return this.runtimeService\n      .workflowInput()\n      .apiClient.getDocumentEditAttribution(documentId);\n  }\n\n  loadDocumentAttributionRanges(\n    input: DocumentAttributionRangesInput,\n  ): Promise<DocumentAttributionRangesPage> {\n    return loadDocumentAttributionRanges({\n      apiClient: this.runtimeService.workflowInput().apiClient,\n      query: input,\n    });\n  }\n\n  listBlobInfo(input: BlobInfoInput = {}): Promise<BlobInfoList> {\n    const runtime = this.runtimeService.workflowInput();\n    return listBlobInfo({\n      ...input,\n      execSql: readyExecSql(runtime),\n    });\n  }\n\n  workflowRuntime(): ContainerContentsStoreWorkflowRuntime {\n    return createContainerContentsStoreWorkflowRuntime(\n      this.runtimeService.workflowInput(),\n      this.runtimeService.adoptRootContainer,\n    );\n  }\n}\n"]}