@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/container-contents/pendingWrites/deferredTails.js.map

@@ -1 +1 @@
-{"version":3,"file":"deferredTails.js","sourceRoot":"","sources":["deferredTails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;;;;MAmB9B,sCAAsC,CAAC;IACvC,cAAc,EAAE,oBAAoB;IACpC,eAAe,EAAE,qBAAqB;CACvC,CAAC;;;;;MAKA,0BAA0B,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BrD,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAIzB;IACC,MAAM,gBAAgB,GAAG;QACvB,KAAK,CAAC,uBAAuB;QAC7B,KAAK,CAAC,kBAAkB;KACzB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACrD,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QAClE,OAAO,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IAC/C,IAAI,OAAO,KAAK,oBAAoB;QAAE,OAAO,WAAW,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA4B;IAE5B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,gBAAgB,CAAC;QAChB,cAAc;QACd,uBAAuB,EAAE,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC;QACtE,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC;KAC5D,CAAC,EACF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,OAAO;QACL,UAAU,EAAE,CAAC;QACb,WAAW,EACT,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,uBAAuB,CAAC;YAC1C,CAAC,CAAC,UAAU,KAAK,UAAU;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,uBAAuB,CAAC;gBAC1C,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,iBAAiB;QACvB,wEAAwE;QACxE,sEAAsE;QACtE,oBAAoB;QACpB,eAAe,EAAE,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC;QACxD,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC;QAC7C,OAAO;QACP,IAAI,EACF,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC;YACnC,CAAC,CAAC,UAAU,KAAK,UAAU;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC;gBAClC,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACpD,UAAU;QACV,cAAc,EACZ,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,UAAU,KAAK,UAAU;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC;gBAC7C,CAAC,CAAC,IAAI;QACZ,QAAQ,EACN,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC;QACzC,MAAM,EAAE,SAAS;QACjB,iBAAiB,EAAE,IAAI;QACvB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsB/B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,KAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,uBAAuB,EAAE;QAClD,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC;QACtB,cAAc;QACd,uBAAuB,EAAE,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC;QACtE,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { mergeVersionVectors, satisfiesVersionVector } from \"@tearleads/loro\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  getContainerDisplayNameSql,\n  getContainerOrganizationAttributionSql,\n} from \"../documentQueries/sql\";\nimport type { PendingWriteQueueObjectKind } from \"../pendingWritesTypes\";\nimport type { PendingWriteCandidate } from \"./aggregation\";\nimport { readString } from \"./rowReaders\";\n\n// Deliberately never loads document content: the diagnostic listing runs\n// repeatedly while sync drains, and materializing every content blob would\n// make the scan O(total document content). `snapshot_end_version` is the\n// write-time-derived end version vector of the persisted content.\nconst DEFERRED_TAIL_CANDIDATE_SQL = `\n  SELECT\n    stored.app_kind AS app_kind,\n    stored.local_id AS local_id,\n    stored.document_id AS stored_remote_id,\n    stored.snapshot_end_version AS snapshot_end_version,\n    stored.pending_base_version AS pending_base_version,\n    stored.updated_at AS updated_at,\n    (\n      SELECT pending.partial_end_version_vector\n      FROM document_history_updates pending\n      WHERE pending.app_kind = stored.app_kind\n        AND pending.local_id = stored.local_id\n        AND pending.update_id IS NOT NULL\n      ORDER BY pending.created_at DESC, pending.rowid DESC\n      LIMIT 1\n    ) AS latest_pending_end_version,\n    document_projection.title AS document_name,\n    document_projection.container_id AS document_container_id,\n    ${getContainerOrganizationAttributionSql({\n      containerAlias: \"document_container\",\n      projectionAlias: \"document_projection\",\n    })} AS document_organization_id,\n    CASE\n      WHEN metadata_container.server_created_at IS NULL THEN NULL\n      ELSE metadata_container.id\n    END AS container_remote_id,\n    ${getContainerDisplayNameSql(\"metadata_container\")} AS container_name,\n    metadata_container.id AS metadata_container_id,\n    NULLIF(metadata_container.organization_id, '') AS metadata_organization_id,\n    stored.sync_failure_message AS failure_message,\n    stored.sync_failure_attempted_at AS failure_attempted_at\n  FROM documents stored\n  LEFT JOIN document_projection\n    ON stored.app_kind = 'documents'\n    AND document_projection.local_id = stored.local_id\n  LEFT JOIN containers document_container\n    ON document_container.id = document_projection.container_id\n  LEFT JOIN containers metadata_container\n    ON stored.app_kind = 'container-metadata'\n    AND metadata_container.id = stored.local_id\n  WHERE stored.snapshot_end_version <> ''\n    -- Dormant retained metadata (row 4, access_revoked) has no containers\n    -- row; keep it out of deferred-tail candidates until re-attach, matching\n    -- the pending-write sources guard.\n    AND (stored.app_kind <> 'container-metadata'\n      OR metadata_container.id IS NOT NULL)\n    AND (\n      stored.pending_base_version IS NOT NULL\n      OR EXISTS (\n        SELECT 1\n        FROM document_history_updates pending\n        WHERE pending.app_kind = stored.app_kind\n          AND pending.local_id = stored.local_id\n          AND pending.update_id IS NOT NULL\n      )\n    )\n`;\n\nfunction hasUncoveredTail(input: {\n  currentVersion: string;\n  latestPendingEndVersion: string | null;\n  pendingBaseVersion: string | null;\n}): boolean {\n  const coverageVersions = [\n    input.latestPendingEndVersion,\n    input.pendingBaseVersion,\n  ].filter((value): value is string => value !== null);\n  const validCoverageVersions: string[] = [];\n  for (const coverageVersion of coverageVersions) {\n    try {\n      validCoverageVersions.push(mergeVersionVectors([coverageVersion]));\n    } catch {\n      // Corrupt coverage must not make the diagnostic claim an uncovered write.\n      return false;\n    }\n  }\n  if (validCoverageVersions.length === 0) {\n    return false;\n  }\n\n  try {\n    const mergedCoverage = mergeVersionVectors(validCoverageVersions);\n    return !satisfiesVersionVector(mergedCoverage, input.currentVersion);\n  } catch {\n    // Corrupt coverage must not make the diagnostic claim an uncovered write.\n    return false;\n  }\n}\n\nfunction getObjectKind(appKind: string): PendingWriteQueueObjectKind {\n  if (appKind === \"documents\") return \"document\";\n  if (appKind === \"container-metadata\") return \"container\";\n  return \"unknown\";\n}\n\nfunction mapDeferredTailCandidate(\n  row: Record<string, unknown>,\n): PendingWriteCandidate | null {\n  const appKind = readString(row, \"app_kind\");\n  const localId = readString(row, \"local_id\");\n  const currentVersion = readString(row, \"snapshot_end_version\");\n  if (!appKind || !localId || !currentVersion) {\n    return null;\n  }\n  if (\n    !hasUncoveredTail({\n      currentVersion,\n      latestPendingEndVersion: readString(row, \"latest_pending_end_version\"),\n      pendingBaseVersion: readString(row, \"pending_base_version\"),\n    })\n  ) {\n    return null;\n  }\n\n  const objectKind = getObjectKind(appKind);\n  const updatedAt = readString(row, \"updated_at\");\n  return {\n    byteLength: 0,\n    containerId:\n      objectKind === \"container\"\n        ? readString(row, \"metadata_container_id\")\n        : objectKind === \"document\"\n          ? readString(row, \"document_container_id\")\n          : null,\n    count: 1,\n    createdAt: updatedAt,\n    inclusion: \"always\",\n    kind: \"deferred-update\",\n    // Carry the scope's recorded sync failure so a covering deferred-update\n    // candidate never hides the diagnostic a suppressed failure-only item\n    // would have shown.\n    lastAttemptedAt: readString(row, \"failure_attempted_at\"),\n    lastError: readString(row, \"failure_message\"),\n    localId,\n    name:\n      objectKind === \"container\"\n        ? readString(row, \"container_name\")\n        : objectKind === \"document\"\n          ? readString(row, \"document_name\")\n          : null,\n    namespace: objectKind === \"unknown\" ? appKind : null,\n    objectKind,\n    organizationId:\n      objectKind === \"container\"\n        ? readString(row, \"metadata_organization_id\")\n        : objectKind === \"document\"\n          ? readString(row, \"document_organization_id\")\n          : null,\n    remoteId:\n      objectKind === \"container\"\n        ? readString(row, \"container_remote_id\")\n        : readString(row, \"stored_remote_id\"),\n    status: \"pending\",\n    targetContainerId: null,\n    updatedAt,\n  };\n}\n\nexport async function listDeferredPendingWriteCandidates(\n  execSql: ExecSql,\n): Promise<PendingWriteCandidate[]> {\n  const rows = await execSql(DEFERRED_TAIL_CANDIDATE_SQL);\n  return rows.flatMap((row) => {\n    const candidate = mapDeferredTailCandidate(row);\n    return candidate ? [candidate] : [];\n  });\n}\n\nconst DEFERRED_TAIL_SCOPE_SQL = `\n  SELECT\n    stored.snapshot_end_version AS snapshot_end_version,\n    stored.pending_base_version AS pending_base_version,\n    (\n      SELECT pending.partial_end_version_vector\n      FROM document_history_updates pending\n      WHERE pending.app_kind = stored.app_kind\n        AND pending.local_id = stored.local_id\n        AND pending.update_id IS NOT NULL\n      ORDER BY pending.created_at DESC, pending.rowid DESC\n      LIMIT 1\n    ) AS latest_pending_end_version\n  FROM documents stored\n  WHERE stored.app_kind = ? AND stored.local_id = ?\n    AND stored.snapshot_end_version <> ''\n    -- Dormant retained metadata (row 4, access_revoked) has no containers\n    -- row; it is not queued work until re-attach, matching the candidate\n    -- scan's guard.\n    AND (stored.app_kind <> 'container-metadata'\n      OR EXISTS (SELECT 1 FROM containers WHERE containers.id = stored.local_id))\n  LIMIT 1\n`;\n\n/**\n * Whether this one scope has a deferred write: durable-tail content ahead of\n * its covered frontier, possibly with no queued update rows at all. The same\n * coverage check as the candidate scan, narrowed to a single scope, so\n * \"queued work\" classifications agree with the item the panel rendered.\n */\nexport async function hasDeferredTailScopeWork(\n  execSql: ExecSql,\n  scope: { appKind: string; localId: string },\n): Promise<boolean> {\n  const rows = await execSql(DEFERRED_TAIL_SCOPE_SQL, [\n    scope.appKind,\n    scope.localId,\n  ]);\n  const row = rows[0];\n  if (!row) {\n    return false;\n  }\n  const currentVersion = readString(row, \"snapshot_end_version\");\n  if (!currentVersion) {\n    return false;\n  }\n  return hasUncoveredTail({\n    currentVersion,\n    latestPendingEndVersion: readString(row, \"latest_pending_end_version\"),\n    pendingBaseVersion: readString(row, \"pending_base_version\"),\n  });\n}\n"]}
+{"version":3,"file":"deferredTails.js","sourceRoot":"","sources":["deferredTails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;;;;MAmB9B,sCAAsC,CAAC;IACvC,cAAc,EAAE,oBAAoB;IACpC,eAAe,EAAE,qBAAqB;CACvC,CAAC;;;;;MAKA,0BAA0B,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BrD,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAIzB;IACC,MAAM,gBAAgB,GAAG;QACvB,KAAK,CAAC,uBAAuB;QAC7B,KAAK,CAAC,kBAAkB;KACzB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACrD,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QAClE,OAAO,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IAC/C,IAAI,OAAO,KAAK,oBAAoB;QAAE,OAAO,WAAW,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA4B;IAE5B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,gBAAgB,CAAC;QAChB,cAAc;QACd,uBAAuB,EAAE,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC;QACtE,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC;KAC5D,CAAC,EACF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,OAAO;QACL,UAAU,EAAE,CAAC;QACb,WAAW,EACT,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,uBAAuB,CAAC;YAC1C,CAAC,CAAC,UAAU,KAAK,UAAU;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,uBAAuB,CAAC;gBAC1C,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,iBAAiB;QACvB,wEAAwE;QACxE,sEAAsE;QACtE,oBAAoB;QACpB,eAAe,EAAE,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC;QACxD,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC;QAC7C,OAAO;QACP,IAAI,EACF,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC;YACnC,CAAC,CAAC,UAAU,KAAK,UAAU;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC;gBAClC,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACpD,UAAU;QACV,cAAc,EACZ,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,UAAU,KAAK,UAAU;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC;gBAC7C,CAAC,CAAC,IAAI;QACZ,QAAQ,EACN,UAAU,KAAK,WAAW;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC;QACzC,MAAM,EAAE,SAAS;QACjB,iBAAiB,EAAE,IAAI;QACvB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsB/B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,KAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,uBAAuB,EAAE;QAClD,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC;QACtB,cAAc;QACd,uBAAuB,EAAE,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC;QACtE,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { mergeVersionVectors, satisfiesVersionVector } from \"@tearleads/loro\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  getContainerDisplayNameSql,\n  getContainerOrganizationAttributionSql,\n} from \"../documentQueries/sql\";\nimport type { PendingWriteCandidate } from \"./aggregation\";\nimport type { PendingWriteQueueObjectKind } from \"./pendingWritesTypes\";\nimport { readString } from \"./rowReaders\";\n\n// Deliberately never loads document content: the diagnostic listing runs\n// repeatedly while sync drains, and materializing every content blob would\n// make the scan O(total document content). `snapshot_end_version` is the\n// write-time-derived end version vector of the persisted content.\nconst DEFERRED_TAIL_CANDIDATE_SQL = `\n  SELECT\n    stored.app_kind AS app_kind,\n    stored.local_id AS local_id,\n    stored.document_id AS stored_remote_id,\n    stored.snapshot_end_version AS snapshot_end_version,\n    stored.pending_base_version AS pending_base_version,\n    stored.updated_at AS updated_at,\n    (\n      SELECT pending.partial_end_version_vector\n      FROM document_history_updates pending\n      WHERE pending.app_kind = stored.app_kind\n        AND pending.local_id = stored.local_id\n        AND pending.update_id IS NOT NULL\n      ORDER BY pending.created_at DESC, pending.rowid DESC\n      LIMIT 1\n    ) AS latest_pending_end_version,\n    document_projection.title AS document_name,\n    document_projection.container_id AS document_container_id,\n    ${getContainerOrganizationAttributionSql({\n      containerAlias: \"document_container\",\n      projectionAlias: \"document_projection\",\n    })} AS document_organization_id,\n    CASE\n      WHEN metadata_container.server_created_at IS NULL THEN NULL\n      ELSE metadata_container.id\n    END AS container_remote_id,\n    ${getContainerDisplayNameSql(\"metadata_container\")} AS container_name,\n    metadata_container.id AS metadata_container_id,\n    NULLIF(metadata_container.organization_id, '') AS metadata_organization_id,\n    stored.sync_failure_message AS failure_message,\n    stored.sync_failure_attempted_at AS failure_attempted_at\n  FROM documents stored\n  LEFT JOIN document_projection\n    ON stored.app_kind = 'documents'\n    AND document_projection.local_id = stored.local_id\n  LEFT JOIN containers document_container\n    ON document_container.id = document_projection.container_id\n  LEFT JOIN containers metadata_container\n    ON stored.app_kind = 'container-metadata'\n    AND metadata_container.id = stored.local_id\n  WHERE stored.snapshot_end_version <> ''\n    -- Dormant retained metadata (row 4, access_revoked) has no containers\n    -- row; keep it out of deferred-tail candidates until re-attach, matching\n    -- the pending-write sources guard.\n    AND (stored.app_kind <> 'container-metadata'\n      OR metadata_container.id IS NOT NULL)\n    AND (\n      stored.pending_base_version IS NOT NULL\n      OR EXISTS (\n        SELECT 1\n        FROM document_history_updates pending\n        WHERE pending.app_kind = stored.app_kind\n          AND pending.local_id = stored.local_id\n          AND pending.update_id IS NOT NULL\n      )\n    )\n`;\n\nfunction hasUncoveredTail(input: {\n  currentVersion: string;\n  latestPendingEndVersion: string | null;\n  pendingBaseVersion: string | null;\n}): boolean {\n  const coverageVersions = [\n    input.latestPendingEndVersion,\n    input.pendingBaseVersion,\n  ].filter((value): value is string => value !== null);\n  const validCoverageVersions: string[] = [];\n  for (const coverageVersion of coverageVersions) {\n    try {\n      validCoverageVersions.push(mergeVersionVectors([coverageVersion]));\n    } catch {\n      // Corrupt coverage must not make the diagnostic claim an uncovered write.\n      return false;\n    }\n  }\n  if (validCoverageVersions.length === 0) {\n    return false;\n  }\n\n  try {\n    const mergedCoverage = mergeVersionVectors(validCoverageVersions);\n    return !satisfiesVersionVector(mergedCoverage, input.currentVersion);\n  } catch {\n    // Corrupt coverage must not make the diagnostic claim an uncovered write.\n    return false;\n  }\n}\n\nfunction getObjectKind(appKind: string): PendingWriteQueueObjectKind {\n  if (appKind === \"documents\") return \"document\";\n  if (appKind === \"container-metadata\") return \"container\";\n  return \"unknown\";\n}\n\nfunction mapDeferredTailCandidate(\n  row: Record<string, unknown>,\n): PendingWriteCandidate | null {\n  const appKind = readString(row, \"app_kind\");\n  const localId = readString(row, \"local_id\");\n  const currentVersion = readString(row, \"snapshot_end_version\");\n  if (!appKind || !localId || !currentVersion) {\n    return null;\n  }\n  if (\n    !hasUncoveredTail({\n      currentVersion,\n      latestPendingEndVersion: readString(row, \"latest_pending_end_version\"),\n      pendingBaseVersion: readString(row, \"pending_base_version\"),\n    })\n  ) {\n    return null;\n  }\n\n  const objectKind = getObjectKind(appKind);\n  const updatedAt = readString(row, \"updated_at\");\n  return {\n    byteLength: 0,\n    containerId:\n      objectKind === \"container\"\n        ? readString(row, \"metadata_container_id\")\n        : objectKind === \"document\"\n          ? readString(row, \"document_container_id\")\n          : null,\n    count: 1,\n    createdAt: updatedAt,\n    inclusion: \"always\",\n    kind: \"deferred-update\",\n    // Carry the scope's recorded sync failure so a covering deferred-update\n    // candidate never hides the diagnostic a suppressed failure-only item\n    // would have shown.\n    lastAttemptedAt: readString(row, \"failure_attempted_at\"),\n    lastError: readString(row, \"failure_message\"),\n    localId,\n    name:\n      objectKind === \"container\"\n        ? readString(row, \"container_name\")\n        : objectKind === \"document\"\n          ? readString(row, \"document_name\")\n          : null,\n    namespace: objectKind === \"unknown\" ? appKind : null,\n    objectKind,\n    organizationId:\n      objectKind === \"container\"\n        ? readString(row, \"metadata_organization_id\")\n        : objectKind === \"document\"\n          ? readString(row, \"document_organization_id\")\n          : null,\n    remoteId:\n      objectKind === \"container\"\n        ? readString(row, \"container_remote_id\")\n        : readString(row, \"stored_remote_id\"),\n    status: \"pending\",\n    targetContainerId: null,\n    updatedAt,\n  };\n}\n\nexport async function listDeferredPendingWriteCandidates(\n  execSql: ExecSql,\n): Promise<PendingWriteCandidate[]> {\n  const rows = await execSql(DEFERRED_TAIL_CANDIDATE_SQL);\n  return rows.flatMap((row) => {\n    const candidate = mapDeferredTailCandidate(row);\n    return candidate ? [candidate] : [];\n  });\n}\n\nconst DEFERRED_TAIL_SCOPE_SQL = `\n  SELECT\n    stored.snapshot_end_version AS snapshot_end_version,\n    stored.pending_base_version AS pending_base_version,\n    (\n      SELECT pending.partial_end_version_vector\n      FROM document_history_updates pending\n      WHERE pending.app_kind = stored.app_kind\n        AND pending.local_id = stored.local_id\n        AND pending.update_id IS NOT NULL\n      ORDER BY pending.created_at DESC, pending.rowid DESC\n      LIMIT 1\n    ) AS latest_pending_end_version\n  FROM documents stored\n  WHERE stored.app_kind = ? AND stored.local_id = ?\n    AND stored.snapshot_end_version <> ''\n    -- Dormant retained metadata (row 4, access_revoked) has no containers\n    -- row; it is not queued work until re-attach, matching the candidate\n    -- scan's guard.\n    AND (stored.app_kind <> 'container-metadata'\n      OR EXISTS (SELECT 1 FROM containers WHERE containers.id = stored.local_id))\n  LIMIT 1\n`;\n\n/**\n * Whether this one scope has a deferred write: durable-tail content ahead of\n * its covered frontier, possibly with no queued update rows at all. The same\n * coverage check as the candidate scan, narrowed to a single scope, so\n * \"queued work\" classifications agree with the item the panel rendered.\n */\nexport async function hasDeferredTailScopeWork(\n  execSql: ExecSql,\n  scope: { appKind: string; localId: string },\n): Promise<boolean> {\n  const rows = await execSql(DEFERRED_TAIL_SCOPE_SQL, [\n    scope.appKind,\n    scope.localId,\n  ]);\n  const row = rows[0];\n  if (!row) {\n    return false;\n  }\n  const currentVersion = readString(row, \"snapshot_end_version\");\n  if (!currentVersion) {\n    return false;\n  }\n  return hasUncoveredTail({\n    currentVersion,\n    latestPendingEndVersion: readString(row, \"latest_pending_end_version\"),\n    pendingBaseVersion: readString(row, \"pending_base_version\"),\n  });\n}\n"]}

package/workflows/container-contents/pendingWrites/index.d.ts

@@ -0,0 +1,26 @@
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { PendingWriteQueueItem } from "./pendingWritesTypes.js";
+export type { PendingWriteQueueItem, PendingWriteQueueItemStatus, PendingWriteQueueObjectKind, PendingWriteQueueOperation, PendingWriteQueueOperationKind, PendingWriteQueueOperationStatus, } from "./pendingWritesTypes.js";
+/**
+ * List identity-wide local state that still requires a remote write. The
+ * returned diagnostic contains only navigation/display metadata and aggregate
+ * counts; serialized updates, local storage keys, and upload crypto stay below
+ * the workflow boundary.
+ */
+export declare function listPendingWrites(execSql: ExecSql): Promise<ReadonlyArray<PendingWriteQueueItem>>;
+/**
+ * Explicit manual retry for one write-queue item: reset the durable re-key
+ * budget for the item's ACTUAL pending-update scope (container metadata and
+ * unknown document namespaces re-key through the same recovery path as
+ * ordinary documents) and clear the recorded terminal failure — the next
+ * pass re-records both if they still hold. The cap protects against a
+ * server driving a network-speed re-key loop; a deliberate user retry is
+ * the rate-limited signal that conditions have changed (e.g. an outage that
+ * burned the budget has healed). The caller re-arms the sync lanes.
+ */
+export declare function resetPendingWriteRetryState(execSql: ExecSql, input: {
+    localId: string;
+    /** The item's `namespace` — the unrecognized documents.app_kind, if any. */
+    namespace: string | null;
+    objectKind: PendingWriteQueueItem["objectKind"];
+}): Promise<void>;

package/workflows/container-contents/pendingWrites/index.js

@@ -0,0 +1,116 @@
+import { CONTAINER_METADATA_APP_KIND } from "../../../data/persistence/container-contents/containerContentsPersistence.js";
+import { sqlDocumentMoveIntentPersistence } from "../../../data/persistence/container-contents/documentMoveIntentPersistence.js";
+import { sqlDocumentsPersistence } from "../../../data/persistence/documents/documentsPersistence.js";
+import { DOCUMENTS_APP_KIND } from "../../../data/persistence/documents/internal/constants.js";
+import { clearDocumentSyncFailure, resetDocumentPendingUpdateRekeyBudget, } from "../../../data/sqlite/documentPersistence.js";
+import { documentPlacementIntentTables, documentTables, LOCAL_INTENT_LANES, } from "../../../data/sqlite/schema.js";
+import { ensureSqlTables } from "../../../data/sqlite/sqlSchema.js";
+import { defaultContainerContentsPersistence } from "../containerPersistence.js";
+import { groupPendingWriteCandidates } from "./aggregation.js";
+import { hasDeferredTailScopeWork, listDeferredPendingWriteCandidates, } from "./deferredTails.js";
+import { listPersistedPendingWriteCandidates } from "./sources.js";
+/**
+ * List identity-wide local state that still requires a remote write. The
+ * returned diagnostic contains only navigation/display metadata and aggregate
+ * counts; serialized updates, local storage keys, and upload crypto stay below
+ * the workflow boundary.
+ */
+export async function listPendingWrites(execSql) {
+    await defaultContainerContentsPersistence.ensureSchema(execSql);
+    await sqlDocumentsPersistence.ensureSchema(execSql);
+    await sqlDocumentMoveIntentPersistence.ensureSchema(execSql);
+    const [persisted, deferred] = await Promise.all([
+        listPersistedPendingWriteCandidates(execSql),
+        listDeferredPendingWriteCandidates(execSql),
+    ]);
+    return groupPendingWriteCandidates([...persisted, ...deferred]);
+}
+/**
+ * Explicit manual retry for one write-queue item: reset the durable re-key
+ * budget for the item's ACTUAL pending-update scope (container metadata and
+ * unknown document namespaces re-key through the same recovery path as
+ * ordinary documents) and clear the recorded terminal failure — the next
+ * pass re-records both if they still hold. The cap protects against a
+ * server driving a network-speed re-key loop; a deliberate user retry is
+ * the rate-limited signal that conditions have changed (e.g. an outage that
+ * burned the budget has healed). The caller re-arms the sync lanes.
+ */
+export async function resetPendingWriteRetryState(execSql, input) {
+    const appKind = input.objectKind === "container"
+        ? CONTAINER_METADATA_APP_KIND
+        : (input.namespace ??
+            (input.objectKind === "document" ? DOCUMENTS_APP_KIND : null));
+    if (appKind === null) {
+        // An unknown object kind with no namespace: there is no scope to reset,
+        // and guessing one could clear an unrelated scope sharing the localId.
+        return;
+    }
+    const scope = { appKind, localId: input.localId };
+    await resetDocumentPendingUpdateRekeyBudget(execSql, scope);
+    if (appKind === DOCUMENTS_APP_KIND) {
+        // A deliberate retry is the rate-limited signal that conditions changed:
+        // a parked permission-denied move (row 7) replays once, like row 11's
+        // re-key budget reset.
+        await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql, {
+            localId: input.localId,
+        });
+    }
+    // Clearing the failure row is part of the re-key budget reset (edge-case
+    // row 11) and only makes sense alongside queued work. A failure-only item
+    // (a refused revalidation, row 13) has no queued work: its row is the
+    // priming ticket that re-drives the store, so it must survive the retry
+    // and clear on the next clean pass instead of vanishing with no request.
+    if (await hasQueuedScopeWork(execSql, scope)) {
+        await clearDocumentSyncFailure(execSql, scope);
+    }
+}
+/**
+ * Whether ANY durable outbound work exists for the scope — CRDT updates,
+ * staged attachment uploads, move intents, a never-created local document, or
+ * a deferred write whose only durable content is the history tail ahead of
+ * its covered frontier. Mirrors the queue's own document candidate sources,
+ * so "failure-only" here agrees with the item the panel rendered.
+ */
+async function hasQueuedScopeWork(execSql, scope) {
+    await ensureSqlTables(execSql, [
+        ...documentTables,
+        ...documentPlacementIntentTables,
+    ]);
+    const rows = await execSql(`SELECT 1 AS present
+     WHERE EXISTS (
+         SELECT 1 FROM document_history_updates pending
+         WHERE pending.app_kind = ? AND pending.local_id = ?
+           AND pending.update_id IS NOT NULL
+       )
+       OR EXISTS (
+         SELECT 1 FROM document_pending_attachments attachment
+         WHERE attachment.local_id = ?
+       )
+       OR EXISTS (
+         SELECT 1 FROM local_intents intent
+         WHERE intent.lane = '${LOCAL_INTENT_LANES.documentPlacement}'
+           AND intent.local_id = ?
+           AND intent.intent_type IN ('document.move', 'document.link')
+       )
+       OR EXISTS (
+         SELECT 1 FROM documents stored
+         WHERE stored.app_kind = ? AND stored.local_id = ?
+           AND stored.document_id IS NULL
+       )
+     LIMIT 1`, [
+        scope.appKind,
+        scope.localId,
+        scope.localId,
+        scope.localId,
+        scope.appKind,
+        scope.localId,
+    ]);
+    if (rows.length > 0) {
+        return true;
+    }
+    // The queue's deferred-update source has no queued rows to probe: the
+    // write lives in the durable history tail, detectable only by the
+    // version-vector coverage check.
+    return hasDeferredTailScopeWork(execSql, scope);
+}
+//# sourceMappingURL=index.js.map

package/workflows/container-contents/pendingWrites/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2EAA2E,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,4EAA4E,CAAC;AAC9H,OAAO,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EACL,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,mCAAmC,EAAE,MAAM,WAAW,CAAC;AAWhE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB;IAEhB,MAAM,mCAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,uBAAuB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,gCAAgC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAE7D,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,mCAAmC,CAAC,OAAO,CAAC;QAC5C,kCAAkC,CAAC,OAAO,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,2BAA2B,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,KAKC;IAED,MAAM,OAAO,GACX,KAAK,CAAC,UAAU,KAAK,WAAW;QAC9B,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YAChB,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,wEAAwE;QACxE,uEAAuE;QACvE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,qCAAqC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACnC,yEAAyE;QACzE,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,gCAAgC,CAAC,sBAAsB,CAAC,OAAO,EAAE;YACrE,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,KAA2C;IAE3C,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,cAAc;QACjB,GAAG,6BAA6B;KACjC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB;;;;;;;;;;;;gCAY4B,kBAAkB,CAAC,iBAAiB;;;;;;;;;aASvD,EACT;QACE,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,OAAO;KACd,CACF,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC","sourcesContent":["import { CONTAINER_METADATA_APP_KIND } from \"../../../data/persistence/container-contents/containerContentsPersistence\";\nimport { sqlDocumentMoveIntentPersistence } from \"../../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { sqlDocumentsPersistence } from \"../../../data/persistence/documents/documentsPersistence\";\nimport { DOCUMENTS_APP_KIND } from \"../../../data/persistence/documents/internal/constants\";\nimport {\n  clearDocumentSyncFailure,\n  resetDocumentPendingUpdateRekeyBudget,\n} from \"../../../data/sqlite/documentPersistence\";\nimport {\n  documentPlacementIntentTables,\n  documentTables,\n  LOCAL_INTENT_LANES,\n} from \"../../../data/sqlite/schema\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../../data/sqlite/sqlSchema\";\nimport { defaultContainerContentsPersistence } from \"../containerPersistence\";\nimport { groupPendingWriteCandidates } from \"./aggregation\";\nimport {\n  hasDeferredTailScopeWork,\n  listDeferredPendingWriteCandidates,\n} from \"./deferredTails\";\nimport type { PendingWriteQueueItem } from \"./pendingWritesTypes\";\nimport { listPersistedPendingWriteCandidates } from \"./sources\";\n\nexport type {\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n} from \"./pendingWritesTypes\";\n\n/**\n * List identity-wide local state that still requires a remote write. The\n * returned diagnostic contains only navigation/display metadata and aggregate\n * counts; serialized updates, local storage keys, and upload crypto stay below\n * the workflow boundary.\n */\nexport async function listPendingWrites(\n  execSql: ExecSql,\n): Promise<ReadonlyArray<PendingWriteQueueItem>> {\n  await defaultContainerContentsPersistence.ensureSchema(execSql);\n  await sqlDocumentsPersistence.ensureSchema(execSql);\n  await sqlDocumentMoveIntentPersistence.ensureSchema(execSql);\n\n  const [persisted, deferred] = await Promise.all([\n    listPersistedPendingWriteCandidates(execSql),\n    listDeferredPendingWriteCandidates(execSql),\n  ]);\n  return groupPendingWriteCandidates([...persisted, ...deferred]);\n}\n\n/**\n * Explicit manual retry for one write-queue item: reset the durable re-key\n * budget for the item's ACTUAL pending-update scope (container metadata and\n * unknown document namespaces re-key through the same recovery path as\n * ordinary documents) and clear the recorded terminal failure — the next\n * pass re-records both if they still hold. The cap protects against a\n * server driving a network-speed re-key loop; a deliberate user retry is\n * the rate-limited signal that conditions have changed (e.g. an outage that\n * burned the budget has healed). The caller re-arms the sync lanes.\n */\nexport async function resetPendingWriteRetryState(\n  execSql: ExecSql,\n  input: {\n    localId: string;\n    /** The item's `namespace` — the unrecognized documents.app_kind, if any. */\n    namespace: string | null;\n    objectKind: PendingWriteQueueItem[\"objectKind\"];\n  },\n): Promise<void> {\n  const appKind =\n    input.objectKind === \"container\"\n      ? CONTAINER_METADATA_APP_KIND\n      : (input.namespace ??\n        (input.objectKind === \"document\" ? DOCUMENTS_APP_KIND : null));\n  if (appKind === null) {\n    // An unknown object kind with no namespace: there is no scope to reset,\n    // and guessing one could clear an unrelated scope sharing the localId.\n    return;\n  }\n  const scope = { appKind, localId: input.localId };\n  await resetDocumentPendingUpdateRekeyBudget(execSql, scope);\n  if (appKind === DOCUMENTS_APP_KIND) {\n    // A deliberate retry is the rate-limited signal that conditions changed:\n    // a parked permission-denied move (row 7) replays once, like row 11's\n    // re-key budget reset.\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql, {\n      localId: input.localId,\n    });\n  }\n  // Clearing the failure row is part of the re-key budget reset (edge-case\n  // row 11) and only makes sense alongside queued work. A failure-only item\n  // (a refused revalidation, row 13) has no queued work: its row is the\n  // priming ticket that re-drives the store, so it must survive the retry\n  // and clear on the next clean pass instead of vanishing with no request.\n  if (await hasQueuedScopeWork(execSql, scope)) {\n    await clearDocumentSyncFailure(execSql, scope);\n  }\n}\n\n/**\n * Whether ANY durable outbound work exists for the scope — CRDT updates,\n * staged attachment uploads, move intents, a never-created local document, or\n * a deferred write whose only durable content is the history tail ahead of\n * its covered frontier. Mirrors the queue's own document candidate sources,\n * so \"failure-only\" here agrees with the item the panel rendered.\n */\nasync function hasQueuedScopeWork(\n  execSql: ExecSql,\n  scope: { appKind: string; localId: string },\n): Promise<boolean> {\n  await ensureSqlTables(execSql, [\n    ...documentTables,\n    ...documentPlacementIntentTables,\n  ]);\n  const rows = await execSql(\n    `SELECT 1 AS present\n     WHERE EXISTS (\n         SELECT 1 FROM document_history_updates pending\n         WHERE pending.app_kind = ? AND pending.local_id = ?\n           AND pending.update_id IS NOT NULL\n       )\n       OR EXISTS (\n         SELECT 1 FROM document_pending_attachments attachment\n         WHERE attachment.local_id = ?\n       )\n       OR EXISTS (\n         SELECT 1 FROM local_intents intent\n         WHERE intent.lane = '${LOCAL_INTENT_LANES.documentPlacement}'\n           AND intent.local_id = ?\n           AND intent.intent_type IN ('document.move', 'document.link')\n       )\n       OR EXISTS (\n         SELECT 1 FROM documents stored\n         WHERE stored.app_kind = ? AND stored.local_id = ?\n           AND stored.document_id IS NULL\n       )\n     LIMIT 1`,\n    [\n      scope.appKind,\n      scope.localId,\n      scope.localId,\n      scope.localId,\n      scope.appKind,\n      scope.localId,\n    ],\n  );\n  if (rows.length > 0) {\n    return true;\n  }\n  // The queue's deferred-update source has no queued rows to probe: the\n  // write lives in the durable history tail, detectable only by the\n  // version-vector coverage check.\n  return hasDeferredTailScopeWork(execSql, scope);\n}\n"]}

package/workflows/container-contents/projectionGeneration.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionGeneration.js","sourceRoot":"","sources":["projectionGeneration.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAiE;IAEjE,OAAO,KAAK,CAAC,0BAA0B,IAAI,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import type { ContainerMetadataState } from \"./metadataTypes\";\n\n/**\n * The shared writer-projection generation of a container state (container and\n * metadata-document projections move together). A leaf so hydration, metadata\n * settlement, and the projection cache can all read it without importing one\n * another.\n */\nexport function projectionGeneration(\n  state: Pick<ContainerMetadataState, \"writerProjectionGeneration\">,\n): number {\n  return state.writerProjectionGeneration ?? 0;\n}\n"]}
+{"version":3,"file":"projectionGeneration.js","sourceRoot":"","sources":["projectionGeneration.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAiE;IAEjE,OAAO,KAAK,CAAC,0BAA0B,IAAI,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import type { ContainerMetadataState } from \"./metadata/metadataTypes\";\n\n/**\n * The shared writer-projection generation of a container state (container and\n * metadata-document projections move together). A leaf so hydration, metadata\n * settlement, and the projection cache can all read it without importing one\n * another.\n */\nexport function projectionGeneration(\n  state: Pick<ContainerMetadataState, \"writerProjectionGeneration\">,\n): number {\n  return state.writerProjectionGeneration ?? 0;\n}\n"]}

package/workflows/container-contents/projectionView.js

@@ -1,4 +1,4 @@
-import { listContainerContentsDocumentsForContainers } from "./documentSubtreeQueries.js";
+import { listContainerContentsDocumentsForContainers } from "./documentQueries/documentSubtreeQueries.js";
 /**
  * Device-first projection reads for the local-projection store (Layer A).
  *

package/workflows/container-contents/projectionView.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionView.js","sourceRoot":"","sources":["projectionView.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2CAA2C,EAAE,MAAM,0BAA0B,CAAC;AAEvF;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAGtE;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CACL,KAAK,CAAC,YAAY,CAAC,MAAM,CACvB,CAAC,WAAW,EAAyB,EAAE,CACrC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5D,CACF,CACF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,iBAAiB,EAAE,EAAE;YACrB,8BAA8B,EAAE,IAAI,GAAG,EAAE;SAC1C,CAAC;IACJ,CAAC;IAED,OAAO,2CAA2C,CAChD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,YAAY,EACZ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerContentsSharedDocumentSummaries,\n  ContainerDocumentQueriesRuntime,\n} from \"./documentQueries/types\";\nimport { listContainerContentsDocumentsForContainers } from \"./documentSubtreeQueries\";\n\n/**\n * Device-first projection reads for the local-projection store (Layer A).\n *\n * These load document summaries and their container links straight from\n * SQLite — no network — so the explorer can paint a container's contents on\n * first open. They reuse the shared `documentSubtreeQueries` pipeline, kept in\n * this small module so the local projection store does not import raw\n * persistence itself.\n */\n\n/**\n * Load document summaries + container links for a flat set of container ids,\n * directly from SQLite. Returns empty results when no containers are given.\n */\nexport async function loadLocalContainerProjectionDocumentsFromRuntime(input: {\n  containerIds: ReadonlyArray<string>;\n  runtime: ContainerDocumentQueriesRuntime;\n}): Promise<ContainerContentsSharedDocumentSummaries> {\n  const containerIds = Array.from(\n    new Set(\n      input.containerIds.filter(\n        (containerId): containerId is string =>\n          typeof containerId === \"string\" && containerId.length > 0,\n      ),\n    ),\n  );\n  if (containerIds.length === 0) {\n    return {\n      documentSummaries: [],\n      linkedContainerIdsByDocumentId: new Map(),\n    };\n  }\n\n  return listContainerContentsDocumentsForContainers(\n    input.runtime.infra.execSql,\n    containerIds,\n    { sortDocumentSummaries: false },\n  );\n}\n"]}
+{"version":3,"file":"projectionView.js","sourceRoot":"","sources":["projectionView.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2CAA2C,EAAE,MAAM,0CAA0C,CAAC;AAMvG;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAGtE;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CACL,KAAK,CAAC,YAAY,CAAC,MAAM,CACvB,CAAC,WAAW,EAAyB,EAAE,CACrC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5D,CACF,CACF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,iBAAiB,EAAE,EAAE;YACrB,8BAA8B,EAAE,IAAI,GAAG,EAAE;SAC1C,CAAC;IACJ,CAAC;IAED,OAAO,2CAA2C,CAChD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,YAAY,EACZ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;AACJ,CAAC","sourcesContent":["import { listContainerContentsDocumentsForContainers } from \"./documentQueries/documentSubtreeQueries\";\nimport type {\n  ContainerContentsSharedDocumentSummaries,\n  ContainerDocumentQueriesRuntime,\n} from \"./documentQueries/types\";\n\n/**\n * Device-first projection reads for the local-projection store (Layer A).\n *\n * These load document summaries and their container links straight from\n * SQLite — no network — so the explorer can paint a container's contents on\n * first open. They reuse the shared `documentSubtreeQueries` pipeline, kept in\n * this small module so the local projection store does not import raw\n * persistence itself.\n */\n\n/**\n * Load document summaries + container links for a flat set of container ids,\n * directly from SQLite. Returns empty results when no containers are given.\n */\nexport async function loadLocalContainerProjectionDocumentsFromRuntime(input: {\n  containerIds: ReadonlyArray<string>;\n  runtime: ContainerDocumentQueriesRuntime;\n}): Promise<ContainerContentsSharedDocumentSummaries> {\n  const containerIds = Array.from(\n    new Set(\n      input.containerIds.filter(\n        (containerId): containerId is string =>\n          typeof containerId === \"string\" && containerId.length > 0,\n      ),\n    ),\n  );\n  if (containerIds.length === 0) {\n    return {\n      documentSummaries: [],\n      linkedContainerIdsByDocumentId: new Map(),\n    };\n  }\n\n  return listContainerContentsDocumentsForContainers(\n    input.runtime.infra.execSql,\n    containerIds,\n    { sortDocumentSummaries: false },\n  );\n}\n"]}

package/workflows/container-contents/recovery/folderRecovery.d.ts

@@ -0,0 +1,19 @@
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export interface RecoveryFolder {
+    containerId: string;
+    organizationId: string;
+    name: string;
+    icon: string | null;
+    pendingUpdateCount: number;
+    hasStructuralIntent: boolean;
+    revision: string;
+}
+export declare function createFolderRecoveryQueries(execSql: ExecSql): {
+    listRecoveryFolderMoveIds(input: {
+        currentOrganizationId: string | null;
+    }): Promise<string[]>;
+    listRecoveryFolders(input: {
+        currentOrganizationId: string | null;
+    }): Promise<RecoveryFolder[]>;
+    discardRecoveryFolder(input: Pick<RecoveryFolder, "containerId" | "organizationId" | "revision">): Promise<boolean>;
+};

package/workflows/container-contents/recovery/folderRecovery.js

@@ -0,0 +1,32 @@
+import { base64ToBytes } from "../../../internal/encoding/index.js";
+import { importUpdates } from "../../../internal/loro/index.js";
+import { createContainerMetadataDocument, readContainerMetadataValue, } from "../../../data/containers/containerMetadataDocument.js";
+import { discardRetainedContainerMetadata, listRecoveryFolderMoveIds, listRetainedContainerMetadata, } from "../../../data/persistence/container-contents/containerRecoveryPersistence.js";
+export function createFolderRecoveryQueries(execSql) {
+    return {
+        listRecoveryFolderMoveIds(input) {
+            return listRecoveryFolderMoveIds(execSql, input.currentOrganizationId);
+        },
+        async listRecoveryFolders(input) {
+            const records = await listRetainedContainerMetadata(execSql, input.currentOrganizationId);
+            return Promise.all(records.map(async ({ metadataUpdates, ...record }) => {
+                const doc = await createContainerMetadataDocument(record.containerId);
+                try {
+                    if (metadataUpdates)
+                        importUpdates(doc, [base64ToBytes(metadataUpdates)]);
+                    return {
+                        ...record,
+                        ...readContainerMetadataValue(doc, "Untitled folder"),
+                    };
+                }
+                finally {
+                    doc.free();
+                }
+            }));
+        },
+        discardRecoveryFolder(input) {
+            return discardRetainedContainerMetadata(execSql, input);
+        },
+    };
+}
+//# sourceMappingURL=folderRecovery.js.map

package/workflows/container-contents/recovery/folderRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folderRecovery.js","sourceRoot":"","sources":["folderRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2EAA2E,CAAC;AAanF,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,OAAO;QACL,yBAAyB,CAAC,KAEzB;YACC,OAAO,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,KAEzB;YACC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,OAAO,EACP,KAAK,CAAC,qBAAqB,CAC5B,CAAC;YACF,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE;gBACnD,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,CAAC;oBACH,IAAI,eAAe;wBACjB,aAAa,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACvD,OAAO;wBACL,GAAG,MAAM;wBACT,GAAG,0BAA0B,CAAC,GAAG,EAAE,iBAAiB,CAAC;qBACtD,CAAC;gBACJ,CAAC;wBAAS,CAAC;oBACT,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,qBAAqB,CACnB,KAGC;YAED,OAAO,gCAAgC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport { importUpdates } from \"@tearleads/loro\";\nimport {\n  createContainerMetadataDocument,\n  readContainerMetadataValue,\n} from \"../../../data/containers/containerMetadataDocument\";\nimport {\n  discardRetainedContainerMetadata,\n  listRecoveryFolderMoveIds,\n  listRetainedContainerMetadata,\n} from \"../../../data/persistence/container-contents/containerRecoveryPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\nexport interface RecoveryFolder {\n  containerId: string;\n  organizationId: string;\n  name: string;\n  icon: string | null;\n  pendingUpdateCount: number;\n  hasStructuralIntent: boolean;\n  revision: string;\n}\n\nexport function createFolderRecoveryQueries(execSql: ExecSql) {\n  return {\n    listRecoveryFolderMoveIds(input: {\n      currentOrganizationId: string | null;\n    }): Promise<string[]> {\n      return listRecoveryFolderMoveIds(execSql, input.currentOrganizationId);\n    },\n    async listRecoveryFolders(input: {\n      currentOrganizationId: string | null;\n    }): Promise<RecoveryFolder[]> {\n      const records = await listRetainedContainerMetadata(\n        execSql,\n        input.currentOrganizationId,\n      );\n      return Promise.all(\n        records.map(async ({ metadataUpdates, ...record }) => {\n          const doc = await createContainerMetadataDocument(record.containerId);\n          try {\n            if (metadataUpdates)\n              importUpdates(doc, [base64ToBytes(metadataUpdates)]);\n            return {\n              ...record,\n              ...readContainerMetadataValue(doc, \"Untitled folder\"),\n            };\n          } finally {\n            doc.free();\n          }\n        }),\n      );\n    },\n    discardRecoveryFolder(\n      input: Pick<\n        RecoveryFolder,\n        \"containerId\" | \"organizationId\" | \"revision\"\n      >,\n    ): Promise<boolean> {\n      return discardRetainedContainerMetadata(execSql, input);\n    },\n  };\n}\n"]}

package/workflows/container-contents/recovery/staleRootRecovery.js

@@ -0,0 +1,111 @@
+import { hasRemoteContainerMetadataState } from "../remoteHydration/reconciliation.js";
+function hasSameRecoveryContext(state, input) {
+    return (state.runtime.auth.isAuthenticated &&
+        state.runtime.auth.defaultOrganizationId === input.defaultOrganizationId &&
+        state.runtime.auth.organizationId === input.organizationId &&
+        state.runtime.auth.userId === input.userId &&
+        state.runtime.auth.rootContainerId === input.rootContainerId &&
+        state.runtime.state.containerId === input.staleContainerId &&
+        state.runtime.state.domainScope === input.domainScope);
+}
+function listAuthoritativeRootCandidates(state, organizationId) {
+    return Array.from(state.containersById.values()).filter((containerState) => containerState.container.id === state.runtime.auth.rootContainerId &&
+        containerState.container.parentId === null &&
+        containerState.container.organizationId === organizationId &&
+        (containerState.container.systemSlot ?? null) === null &&
+        containerState.container.effectiveAccessLevel === "admin" &&
+        hasRemoteContainerMetadataState(containerState));
+}
+/**
+ * Repairs the root identity left by a cold-cache login.
+ *
+ * Root reconciliation can delete the device-first local root without updating
+ * the session's default container. Documents created afterward are projected
+ * beneath that deleted id, so startup priming detects their writes but cannot
+ * route them. Recovery is intentionally narrow: the stale id must be absent
+ * from both the loaded topology and durable storage, and the active
+ * organization must contain the session-acknowledged root after the root lane
+ * has hydrated and verified its signed destination role. This recovery path only repairs document
+ * references; structural container descendants remain owned by normal root
+ * reconciliation. Durable reassignment deliberately precedes live session
+ * adoption so consumers never observe the new root before its documents move.
+ * If the live-session guard rejects that adoption, the idempotent reassignment
+ * remains applied and the sync lane is re-armed to retry under the next runtime
+ * snapshot.
+ */
+export async function recoverStaleSessionRoot(state, isCurrent = () => true) {
+    const staleContainerId = state.runtime.state.containerId;
+    const domainScope = state.runtime.state.domainScope;
+    const defaultOrganizationId = state.runtime.auth.defaultOrganizationId;
+    const organizationId = state.runtime.auth.organizationId;
+    const userId = state.runtime.auth.userId;
+    if (!isCurrent() ||
+        !state.runtime.auth.isAuthenticated ||
+        !staleContainerId ||
+        !defaultOrganizationId ||
+        !organizationId ||
+        !userId ||
+        organizationId !== defaultOrganizationId ||
+        !state.rootLaneHydrated ||
+        state.containersById.has(staleContainerId)) {
+        return { candidateCount: 0, reassigned: false, status: "not-needed" };
+    }
+    const recoveryContext = {
+        domainScope,
+        defaultOrganizationId,
+        organizationId,
+        staleContainerId,
+        userId,
+        rootContainerId: state.runtime.auth.rootContainerId,
+    };
+    const storedContainerExists = await state.persistence.containerExists(state.runtime.infra.execSql, staleContainerId);
+    if (storedContainerExists) {
+        return { candidateCount: 0, reassigned: false, status: "not-needed" };
+    }
+    if (!isCurrent() || !hasSameRecoveryContext(state, recoveryContext)) {
+        return { candidateCount: 0, reassigned: false, status: "context-changed" };
+    }
+    if (state.containersById.has(staleContainerId)) {
+        return { candidateCount: 0, reassigned: false, status: "not-needed" };
+    }
+    const candidates = listAuthoritativeRootCandidates(state, defaultOrganizationId);
+    const [remoteRootState] = candidates;
+    if (!remoteRootState || candidates.length > 1) {
+        return {
+            candidateCount: candidates.length,
+            reassigned: false,
+            status: "ambiguous",
+        };
+    }
+    if (!state.runtime.adoptRootContainer) {
+        return { candidateCount: 1, reassigned: false, status: "unsupported" };
+    }
+    if (!isCurrent() || !hasSameRecoveryContext(state, recoveryContext)) {
+        return { candidateCount: 0, reassigned: false, status: "context-changed" };
+    }
+    await state.persistence.reassignContainerDocuments(state.runtime.infra.execSql, {
+        fromContainerId: staleContainerId,
+        stillCurrent: isCurrent,
+        toContainerId: remoteRootState.container.id,
+    });
+    if (!isCurrent() || !hasSameRecoveryContext(state, recoveryContext)) {
+        return { candidateCount: 1, reassigned: false, status: "context-changed" };
+    }
+    const adoptionResult = state.runtime.adoptRootContainer({
+        domainScope,
+        expectedContainerId: staleContainerId,
+        nextContainerId: remoteRootState.container.id,
+        organizationId,
+        userId,
+    });
+    return {
+        candidateCount: 1,
+        reassigned: true,
+        status: adoptionResult === "already-adopted"
+            ? "already-adopted"
+            : adoptionResult
+                ? "reassigned"
+                : "context-changed",
+    };
+}
+//# sourceMappingURL=staleRootRecovery.js.map

package/workflows/container-contents/recovery/staleRootRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staleRootRecovery.js","sourceRoot":"","sources":["staleRootRecovery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AA6CpF,SAAS,sBAAsB,CAC7B,KAA6B,EAC7B,KAOC;IAED,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAClC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC,qBAAqB;QACxE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC1D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC1C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;QAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,KAA6B,EAC7B,cAAsB;IAEtB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACrD,CAAC,cAAc,EAAE,EAAE,CACjB,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAClE,cAAc,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC1C,cAAc,CAAC,SAAS,CAAC,cAAc,KAAK,cAAc;QAC1D,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI;QACtD,cAAc,CAAC,SAAS,CAAC,oBAAoB,KAAK,OAAO;QACzD,+BAA+B,CAAC,cAAc,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA6B,EAC7B,YAA2B,GAAG,EAAE,CAAC,IAAI;IAErC,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACzD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACpD,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACvE,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACzC,IACE,CAAC,SAAS,EAAE;QACZ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,gBAAgB;QACjB,CAAC,qBAAqB;QACtB,CAAC,cAAc;QACf,CAAC,MAAM;QACP,cAAc,KAAK,qBAAqB;QACxC,CAAC,KAAK,CAAC,gBAAgB;QACvB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAC1C,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG;QACtB,WAAW;QACX,qBAAqB;QACrB,cAAc;QACd,gBAAgB;QAChB,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;KACpD,CAAC;IAEF,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,eAAe,CACnE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,gBAAgB,CACjB,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,UAAU,GAAG,+BAA+B,CAChD,KAAK,EACL,qBAAqB,CACtB,CAAC;IACF,MAAM,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC;IACrC,IAAI,CAAC,eAAe,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,WAAW;SACpB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAChD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B;QACE,eAAe,EAAE,gBAAgB;QACjC,YAAY,EAAE,SAAS;QACvB,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE;KAC5C,CACF,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACtD,WAAW;QACX,mBAAmB,EAAE,gBAAgB;QACrC,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE;QAC7C,cAAc;QACd,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,IAAI;QAChB,MAAM,EACJ,cAAc,KAAK,iBAAiB;YAClC,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,cAAc;gBACd,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,iBAAiB;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerContentsPersistence } from \"../containerPersistence\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { hasRemoteContainerMetadataState } from \"../remoteHydration/reconciliation\";\nimport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsWorkflowRuntime,\n} from \"../runtime\";\n\nexport type StaleRootRecoveryStatus =\n  | \"already-adopted\"\n  | \"ambiguous\"\n  | \"context-changed\"\n  | \"not-needed\"\n  | \"reassigned\"\n  | \"unsupported\";\n\ninterface StaleRootRecoveryResult {\n  readonly candidateCount: number;\n  readonly reassigned: boolean;\n  readonly status: StaleRootRecoveryStatus;\n}\n\ninterface StaleRootRecoveryState {\n  readonly containersById: ReadonlyMap<string, ContainerState>;\n  readonly persistence: Pick<\n    ContainerContentsPersistence,\n    \"containerExists\" | \"reassignContainerDocuments\"\n  >;\n  readonly rootLaneHydrated: boolean;\n  readonly runtime: {\n    readonly adoptRootContainer?: ContainerContentsRootAdopter | undefined;\n    readonly auth: Pick<\n      ContainerContentsWorkflowRuntime[\"auth\"],\n      | \"defaultOrganizationId\"\n      | \"isAuthenticated\"\n      | \"organizationId\"\n      | \"userId\"\n      | \"rootContainerId\"\n    >;\n    readonly infra: Pick<ContainerContentsWorkflowRuntime[\"infra\"], \"execSql\">;\n    readonly state: Pick<\n      ContainerContentsWorkflowRuntime[\"state\"],\n      \"containerId\" | \"domainScope\"\n    >;\n  };\n}\n\nfunction hasSameRecoveryContext(\n  state: StaleRootRecoveryState,\n  input: {\n    domainScope: ContainerContentsWorkflowRuntime[\"state\"][\"domainScope\"];\n    defaultOrganizationId: string;\n    organizationId: string;\n    staleContainerId: string;\n    rootContainerId: string | null | undefined;\n    userId: string;\n  },\n): boolean {\n  return (\n    state.runtime.auth.isAuthenticated &&\n    state.runtime.auth.defaultOrganizationId === input.defaultOrganizationId &&\n    state.runtime.auth.organizationId === input.organizationId &&\n    state.runtime.auth.userId === input.userId &&\n    state.runtime.auth.rootContainerId === input.rootContainerId &&\n    state.runtime.state.containerId === input.staleContainerId &&\n    state.runtime.state.domainScope === input.domainScope\n  );\n}\n\nfunction listAuthoritativeRootCandidates(\n  state: StaleRootRecoveryState,\n  organizationId: string,\n): ContainerState[] {\n  return Array.from(state.containersById.values()).filter(\n    (containerState) =>\n      containerState.container.id === state.runtime.auth.rootContainerId &&\n      containerState.container.parentId === null &&\n      containerState.container.organizationId === organizationId &&\n      (containerState.container.systemSlot ?? null) === null &&\n      containerState.container.effectiveAccessLevel === \"admin\" &&\n      hasRemoteContainerMetadataState(containerState),\n  );\n}\n\n/**\n * Repairs the root identity left by a cold-cache login.\n *\n * Root reconciliation can delete the device-first local root without updating\n * the session's default container. Documents created afterward are projected\n * beneath that deleted id, so startup priming detects their writes but cannot\n * route them. Recovery is intentionally narrow: the stale id must be absent\n * from both the loaded topology and durable storage, and the active\n * organization must contain the session-acknowledged root after the root lane\n * has hydrated and verified its signed destination role. This recovery path only repairs document\n * references; structural container descendants remain owned by normal root\n * reconciliation. Durable reassignment deliberately precedes live session\n * adoption so consumers never observe the new root before its documents move.\n * If the live-session guard rejects that adoption, the idempotent reassignment\n * remains applied and the sync lane is re-armed to retry under the next runtime\n * snapshot.\n */\nexport async function recoverStaleSessionRoot(\n  state: StaleRootRecoveryState,\n  isCurrent: () => boolean = () => true,\n): Promise<StaleRootRecoveryResult> {\n  const staleContainerId = state.runtime.state.containerId;\n  const domainScope = state.runtime.state.domainScope;\n  const defaultOrganizationId = state.runtime.auth.defaultOrganizationId;\n  const organizationId = state.runtime.auth.organizationId;\n  const userId = state.runtime.auth.userId;\n  if (\n    !isCurrent() ||\n    !state.runtime.auth.isAuthenticated ||\n    !staleContainerId ||\n    !defaultOrganizationId ||\n    !organizationId ||\n    !userId ||\n    organizationId !== defaultOrganizationId ||\n    !state.rootLaneHydrated ||\n    state.containersById.has(staleContainerId)\n  ) {\n    return { candidateCount: 0, reassigned: false, status: \"not-needed\" };\n  }\n  const recoveryContext = {\n    domainScope,\n    defaultOrganizationId,\n    organizationId,\n    staleContainerId,\n    userId,\n    rootContainerId: state.runtime.auth.rootContainerId,\n  };\n\n  const storedContainerExists = await state.persistence.containerExists(\n    state.runtime.infra.execSql,\n    staleContainerId,\n  );\n  if (storedContainerExists) {\n    return { candidateCount: 0, reassigned: false, status: \"not-needed\" };\n  }\n  if (!isCurrent() || !hasSameRecoveryContext(state, recoveryContext)) {\n    return { candidateCount: 0, reassigned: false, status: \"context-changed\" };\n  }\n  if (state.containersById.has(staleContainerId)) {\n    return { candidateCount: 0, reassigned: false, status: \"not-needed\" };\n  }\n\n  const candidates = listAuthoritativeRootCandidates(\n    state,\n    defaultOrganizationId,\n  );\n  const [remoteRootState] = candidates;\n  if (!remoteRootState || candidates.length > 1) {\n    return {\n      candidateCount: candidates.length,\n      reassigned: false,\n      status: \"ambiguous\",\n    };\n  }\n  if (!state.runtime.adoptRootContainer) {\n    return { candidateCount: 1, reassigned: false, status: \"unsupported\" };\n  }\n  if (!isCurrent() || !hasSameRecoveryContext(state, recoveryContext)) {\n    return { candidateCount: 0, reassigned: false, status: \"context-changed\" };\n  }\n\n  await state.persistence.reassignContainerDocuments(\n    state.runtime.infra.execSql,\n    {\n      fromContainerId: staleContainerId,\n      stillCurrent: isCurrent,\n      toContainerId: remoteRootState.container.id,\n    },\n  );\n  if (!isCurrent() || !hasSameRecoveryContext(state, recoveryContext)) {\n    return { candidateCount: 1, reassigned: false, status: \"context-changed\" };\n  }\n  const adoptionResult = state.runtime.adoptRootContainer({\n    domainScope,\n    expectedContainerId: staleContainerId,\n    nextContainerId: remoteRootState.container.id,\n    organizationId,\n    userId,\n  });\n\n  return {\n    candidateCount: 1,\n    reassigned: true,\n    status:\n      adoptionResult === \"already-adopted\"\n        ? \"already-adopted\"\n        : adoptionResult\n          ? \"reassigned\"\n          : \"context-changed\",\n  };\n}\n"]}

package/workflows/container-contents/remoteHydration/completeHydration.js

@@ -1,4 +1,4 @@
-import { describeRemoteContainerHydration } from "../remoteHydrationLog.js";
+import { describeRemoteContainerHydration } from "./remoteHydrationLog.js";
 export async function finishRemoteHydration(input) {
     if (input.isCurrent?.() === false) {
         return;

package/workflows/container-contents/remoteHydration/completeHydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"completeHydration.js","sourceRoot":"","sources":["completeHydration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAMzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAS3C;IACC,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,aAAa,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAC1B,gCAAgC,CAAC;YAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa;SACd,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAC7B,KAAK,CAAC,eAAe,EACrB,CAAC;QACD,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;AACH,CAAC","sourcesContent":["import { describeRemoteContainerHydration } from \"../remoteHydrationLog\";\nimport type {\n  RemoteContainerHydrationHost,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\nexport async function finishRemoteHydration(input: {\n  changedCount: number;\n  complete: boolean;\n  host: RemoteContainerHydrationHost;\n  isCurrent?: (() => boolean) | undefined;\n  onFullyHydrated?: (() => Promise<void> | void) | undefined;\n  seenContainerIds: ReadonlySet<string>;\n  containerIdsBeforeHydration: ReadonlySet<string>;\n  state: RemoteContainerHydrationState;\n}): Promise<void> {\n  if (input.isCurrent?.() === false) {\n    return;\n  }\n  if (input.changedCount > 0) {\n    input.host.updateSnapshot();\n    let insertedCount = 0;\n    for (const containerId of input.seenContainerIds) {\n      if (!input.containerIdsBeforeHydration.has(containerId)) {\n        insertedCount++;\n      }\n    }\n    input.state.runtime.util.log(\n      describeRemoteContainerHydration({\n        changedCount: input.changedCount,\n        insertedCount,\n      }),\n    );\n  }\n  if (\n    input.complete &&\n    input.isCurrent?.() !== false &&\n    input.onFullyHydrated\n  ) {\n    await input.onFullyHydrated();\n  }\n}\n"]}
+{"version":3,"file":"completeHydration.js","sourceRoot":"","sources":["completeHydration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAMxE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAS3C;IACC,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,aAAa,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAC1B,gCAAgC,CAAC;YAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa;SACd,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAC7B,KAAK,CAAC,eAAe,EACrB,CAAC;QACD,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;AACH,CAAC","sourcesContent":["import { describeRemoteContainerHydration } from \"./remoteHydrationLog\";\nimport type {\n  RemoteContainerHydrationHost,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\nexport async function finishRemoteHydration(input: {\n  changedCount: number;\n  complete: boolean;\n  host: RemoteContainerHydrationHost;\n  isCurrent?: (() => boolean) | undefined;\n  onFullyHydrated?: (() => Promise<void> | void) | undefined;\n  seenContainerIds: ReadonlySet<string>;\n  containerIdsBeforeHydration: ReadonlySet<string>;\n  state: RemoteContainerHydrationState;\n}): Promise<void> {\n  if (input.isCurrent?.() === false) {\n    return;\n  }\n  if (input.changedCount > 0) {\n    input.host.updateSnapshot();\n    let insertedCount = 0;\n    for (const containerId of input.seenContainerIds) {\n      if (!input.containerIdsBeforeHydration.has(containerId)) {\n        insertedCount++;\n      }\n    }\n    input.state.runtime.util.log(\n      describeRemoteContainerHydration({\n        changedCount: input.changedCount,\n        insertedCount,\n      }),\n    );\n  }\n  if (\n    input.complete &&\n    input.isCurrent?.() !== false &&\n    input.onFullyHydrated\n  ) {\n    await input.onFullyHydrated();\n  }\n}\n"]}

package/workflows/container-contents/remoteHydration/destinationRootReload.js

@@ -1,4 +1,4 @@
-import { withMetadataRootReload } from "../../organizations/groupMetadataErrors.js";
+import { withMetadataRootReload } from "../../organizations/groupMetadata/groupMetadataErrors.js";
 /**
  * Reads a destination again once when its metadata root was behind the
  * directory. A prefetched projection is that same stale root, so the reread

package/workflows/container-contents/remoteHydration/destinationRootReload.js.map

@@ -1 +1 @@
-{"version":3,"file":"destinationRootReload.js","sourceRoot":"","sources":["destinationRootReload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAI3C,KAAY,EACZ,OAA0C,EAC1C,SAAqB;IAErB,OAAO,sBAAsB,CAC3B,CAAC,MAAM,EAAE,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EACzE,SAAS,CACV,CAAC;AACJ,CAAC","sourcesContent":["import { withMetadataRootReload } from \"../../organizations/groupMetadataErrors\";\n\n/**\n * Reads a destination again once when its metadata root was behind the\n * directory. A prefetched projection is that same stale root, so the reread\n * drops it and fetches after `evictRoot` clears the cached one.\n */\nexport function resolveWithMetadataRootReload<\n  Input extends { readonly prefetchedProjection?: unknown },\n  Result,\n>(\n  input: Input,\n  resolve: (input: Input) => Promise<Result>,\n  evictRoot: () => void,\n): Promise<Result> {\n  return withMetadataRootReload(\n    (reread) =>\n      resolve(reread ? { ...input, prefetchedProjection: undefined } : input),\n    evictRoot,\n  );\n}\n"]}
+{"version":3,"file":"destinationRootReload.js","sourceRoot":"","sources":["destinationRootReload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAE/F;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAI3C,KAAY,EACZ,OAA0C,EAC1C,SAAqB;IAErB,OAAO,sBAAsB,CAC3B,CAAC,MAAM,EAAE,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EACzE,SAAS,CACV,CAAC;AACJ,CAAC","sourcesContent":["import { withMetadataRootReload } from \"../../organizations/groupMetadata/groupMetadataErrors\";\n\n/**\n * Reads a destination again once when its metadata root was behind the\n * directory. A prefetched projection is that same stale root, so the reread\n * drops it and fetches after `evictRoot` clears the cached one.\n */\nexport function resolveWithMetadataRootReload<\n  Input extends { readonly prefetchedProjection?: unknown },\n  Result,\n>(\n  input: Input,\n  resolve: (input: Input) => Promise<Result>,\n  evictRoot: () => void,\n): Promise<Result> {\n  return withMetadataRootReload(\n    (reread) =>\n      resolve(reread ? { ...input, prefetchedProjection: undefined } : input),\n    evictRoot,\n  );\n}\n"]}

package/workflows/container-contents/remoteHydration/heldContainerRebind.js

@@ -1,5 +1,5 @@
 import { rebindsHeldContainer, } from "../../../data/containers/containerBinding.js";
-import { installContainerMetadataRecord } from "../metadataStateInstallation.js";
+import { installContainerMetadataRecord } from "../metadata/metadataStateInstallation.js";
 /**
  * Apply a re-home verified from the session user's create or the pinned
  * founder's replacement authorization before hydration updates or inserts

package/workflows/container-contents/remoteHydration/heldContainerRebind.js.map

@@ -1 +1 @@
-{"version":3,"file":"heldContainerRebind.js","sourceRoot":"","sources":["heldContainerRebind.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,GACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAO9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAM5C;IACC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE;QACnE,WAAW,EAAE,QAAQ,CAAC,EAAE;QACxB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE;YACJ,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC;QACD,YAAY,EAAE,KAAK,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnE,aAAa,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3C,aAAa,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAC/C,aAAa,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAC9C,8BAA8B,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import {\n  type HeldContainerBinding,\n  rebindsHeldContainer,\n} from \"../../../data/containers/containerBinding\";\nimport { installContainerMetadataRecord } from \"../metadataStateInstallation\";\nimport type {\n  ContainerState,\n  RemoteContainer,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\n/**\n * Apply a re-home verified from the session user's create or the pinned\n * founder's replacement authorization before hydration updates or inserts\n * the folder. Returns false when\n * the held binding changed underneath, leaving the listing unapplied.\n */\nexport async function rebindReHomedContainer(input: {\n  existingState: ContainerState | undefined;\n  heldBinding: HeldContainerBinding | null;\n  isCurrent?: (() => boolean) | undefined;\n  state: RemoteContainerHydrationState;\n  verified: RemoteContainer;\n}): Promise<boolean> {\n  const { existingState, heldBinding, state, verified } = input;\n  if (!heldBinding || !rebindsHeldContainer(heldBinding, verified)) return true;\n  const execSql = state.runtime.infra.execSql;\n  const rebound = await state.persistence.rebindHeldContainer(execSql, {\n    containerId: verified.id,\n    expected: heldBinding,\n    next: {\n      metadataDocumentId: verified.metadataDocumentId,\n      organizationId: verified.organizationId,\n    },\n    stillCurrent: input.isCurrent,\n  });\n  if (!rebound || input.isCurrent?.() === false) return false;\n  if (!existingState) return true;\n  const stored = await state.persistence.loadContainerMetadataState(\n    execSql,\n    verified.id,\n  );\n  if (!stored?.record || input.isCurrent?.() === false) return false;\n  existingState.container = stored.container;\n  existingState.containerWriterProjection = null;\n  existingState.metadataWriterProjection = null;\n  installContainerMetadataRecord(existingState, stored.record);\n  return true;\n}\n"]}
+{"version":3,"file":"heldContainerRebind.js","sourceRoot":"","sources":["heldContainerRebind.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,GACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAOvF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAM5C;IACC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE;QACnE,WAAW,EAAE,QAAQ,CAAC,EAAE;QACxB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE;YACJ,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC;QACD,YAAY,EAAE,KAAK,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnE,aAAa,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3C,aAAa,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAC/C,aAAa,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAC9C,8BAA8B,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import {\n  type HeldContainerBinding,\n  rebindsHeldContainer,\n} from \"../../../data/containers/containerBinding\";\nimport { installContainerMetadataRecord } from \"../metadata/metadataStateInstallation\";\nimport type {\n  ContainerState,\n  RemoteContainer,\n  RemoteContainerHydrationState,\n} from \"./types\";\n\n/**\n * Apply a re-home verified from the session user's create or the pinned\n * founder's replacement authorization before hydration updates or inserts\n * the folder. Returns false when\n * the held binding changed underneath, leaving the listing unapplied.\n */\nexport async function rebindReHomedContainer(input: {\n  existingState: ContainerState | undefined;\n  heldBinding: HeldContainerBinding | null;\n  isCurrent?: (() => boolean) | undefined;\n  state: RemoteContainerHydrationState;\n  verified: RemoteContainer;\n}): Promise<boolean> {\n  const { existingState, heldBinding, state, verified } = input;\n  if (!heldBinding || !rebindsHeldContainer(heldBinding, verified)) return true;\n  const execSql = state.runtime.infra.execSql;\n  const rebound = await state.persistence.rebindHeldContainer(execSql, {\n    containerId: verified.id,\n    expected: heldBinding,\n    next: {\n      metadataDocumentId: verified.metadataDocumentId,\n      organizationId: verified.organizationId,\n    },\n    stillCurrent: input.isCurrent,\n  });\n  if (!rebound || input.isCurrent?.() === false) return false;\n  if (!existingState) return true;\n  const stored = await state.persistence.loadContainerMetadataState(\n    execSql,\n    verified.id,\n  );\n  if (!stored?.record || input.isCurrent?.() === false) return false;\n  existingState.container = stored.container;\n  existingState.containerWriterProjection = null;\n  existingState.metadataWriterProjection = null;\n  installContainerMetadataRecord(existingState, stored.record);\n  return true;\n}\n"]}

package/workflows/container-contents/remoteHydration/index.d.ts

@@ -0,0 +1,28 @@
+import type { RemoteContainer, RemoteContainerHydrationHost, RemoteContainerHydrationState } from "./types.js";
+export type { ContainerState, PersistContainerStateResult, RemoteContainer, RemoteContainerHydrationHost, } from "./types.js";
+export declare class StaleRemoteHydrationError extends Error {
+}
+export declare function createGenerationGuardedHydrationHost(input: {
+    host: RemoteContainerHydrationHost;
+    isCurrent: () => boolean;
+}): RemoteContainerHydrationHost;
+interface RemoteContainerIngestor {
+    (remoteContainer: RemoteContainer): Promise<void>;
+    hasPending: () => boolean;
+    resume: () => Promise<void>;
+}
+export declare function createRemoteContainerIngestor(input: {
+    getSerializationBarrier?: (() => Promise<void> | null) | undefined;
+    host: RemoteContainerHydrationHost;
+    state: RemoteContainerHydrationState;
+}): RemoteContainerIngestor;
+export declare function hydrateRemoteContainers(input: {
+    followDiscoveredParentLanes?: boolean | undefined;
+    host: RemoteContainerHydrationHost;
+    isCurrent?: (() => boolean) | undefined;
+    onFullyHydrated?: (() => Promise<void> | void) | undefined;
+    parentIds?: ReadonlyArray<string | null> | undefined;
+    resetAllLaneWatermarks?: boolean | undefined;
+    resetRootLaneWatermark?: boolean | undefined;
+    state: RemoteContainerHydrationState;
+}): Promise<number>;