@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/container-contents/container-state/purge/purgeTree.js

@@ -0,0 +1,298 @@
+import { DEFAULT_DOCUMENT_KIND } from "../../../../data/documents/documentConstants.js";
+import { sqlDocumentContainerProjectionPersistence } from "../../../../data/persistence/containers/documentContainerProjectionPersistence.js";
+import { listDocumentsByContainerIdsOrDocumentIds } from "../../../../data/persistence/documents/documentsPersistence.js";
+import { unlinkRemoteContainerDocument } from "../../documentLinks/index.js";
+import { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "../../tombstones/documentPurge.js";
+import { collectSubtreeLeafFirst, snapshotContainerStates, } from "./purgeTreeCollection.js";
+import { deleteSubtreeContainers } from "./purgeTreeContainerDeletion.js";
+import { createSubtreePurgeScope } from "./purgeTreeScope.js";
+export { collectSubtreeLeafFirst } from "./purgeTreeCollection.js";
+// Destroy local-only documents locally. Destroy synced documents only when all
+// links are in the subtree; preserve documents with an external link. The purge
+// plan reduces owned documents to the server-required sole link first.
+export function classifySubtreeDocument(input) {
+    if (!input.documentId) {
+        return { kind: "purge-local" };
+    }
+    const hasExternalLink = input.linkedContainerIds.some((containerId) => !input.subtreeContainerIds.has(containerId));
+    if (!hasExternalLink) {
+        const linkedContainerIds = Array.from(new Set(input.linkedContainerIds.filter((containerId) => input.subtreeContainerIds.has(containerId))));
+        const retainedContainerId = input.preferredContainerId &&
+            linkedContainerIds.includes(input.preferredContainerId)
+            ? input.preferredContainerId
+            : linkedContainerIds[0];
+        return {
+            kind: "purge",
+            unlinkContainerIds: linkedContainerIds.filter((containerId) => containerId !== retainedContainerId),
+        };
+    }
+    return {
+        kind: "unlink",
+        containerIds: input.linkedContainerIds.filter((containerId) => input.subtreeContainerIds.has(containerId)),
+    };
+}
+async function planSubtreeDocuments(input) {
+    const documents = await listDocumentsByContainerIdsOrDocumentIds(input.execSql, {
+        containerIds: [...input.subtreeContainerIds],
+        documentIds: [],
+    });
+    const remoteDocumentIds = documents.flatMap((document) => document.documentId ? [document.documentId] : []);
+    const linkedContainerIdsByDocumentId = await sqlDocumentContainerProjectionPersistence.listLinkedContainerIdsByDocumentIds(input.execSql, remoteDocumentIds);
+    const purge = [];
+    const purgeLocal = [];
+    const unlinkByDocument = new Map();
+    for (const document of documents) {
+        const disposition = classifySubtreeDocument({
+            documentId: document.documentId ?? null,
+            linkedContainerIds: document.documentId
+                ? (linkedContainerIdsByDocumentId.get(document.documentId) ?? [])
+                : [],
+            preferredContainerId: document.containerId,
+            subtreeContainerIds: input.subtreeContainerIds,
+        });
+        if (disposition.kind === "purge-local") {
+            purgeLocal.push(document);
+        }
+        else if (disposition.kind === "purge") {
+            purge.push({
+                document,
+                unlinkContainerIds: disposition.unlinkContainerIds,
+            });
+        }
+        else if (document.documentId) {
+            unlinkByDocument.set(document.documentId, {
+                document,
+                containerIds: disposition.containerIds,
+            });
+        }
+    }
+    return { purge, purgeLocal, unlinkByDocument };
+}
+async function unlinkSubtreeDocument(input) {
+    const documentId = input.document.documentId;
+    if (!documentId) {
+        return true;
+    }
+    let rotationSnapshot;
+    try {
+        rotationSnapshot = await input.prepareDocumentRotationSnapshot(input.document);
+    }
+    catch {
+        return false;
+    }
+    if (!rotationSnapshot) {
+        return false;
+    }
+    for (const containerId of input.containerIds) {
+        const result = await unlinkRemoteContainerDocument({
+            beforeSubmit: () => input.beforeSubmit(containerId),
+            documentId,
+            expectedSubtreeRoot: input.expectedSubtreeRoot,
+            isCurrent: input.stillCurrent,
+            noteId: input.document.id,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            rotationSnapshot,
+            runtime: input.runtime,
+            targetContainerId: containerId,
+        });
+        if (result === null) {
+            return false;
+        }
+    }
+    return true;
+}
+function resolveSubtreeDocumentOperations(input, scope) {
+    const expectedSubtreeRoot = selectedSubtreeRoot(input);
+    const operations = input.documentOperations ?? {
+        purgeLocal: async (document) => (await purgeLocalContainerDocument({
+            beforeDeleteInTransaction: (execSql) => scope.assertLocalScopeInTransaction(execSql, document.containerId, document.id),
+            noteId: document.id,
+            expectedContainerId: document.containerId,
+            runtime: input.runtime,
+        })) !== null,
+        purgeRemote: async (document) => Boolean(document.documentId &&
+            (await purgeRemoteContainerDocument({
+                beforeSubmit: () => scope.allowsDocument(document),
+                documentId: document.documentId,
+                expectedSubtreeRoot,
+                stillCurrent: input.stillCurrent,
+                documentKind: document.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                noteId: document.id,
+                resolveProjectionUserKey: input.resolveProjectionUserKey,
+                runtime: input.runtime,
+            }))),
+        unlink: (document, containerIds) => unlinkSubtreeDocument({
+            // Target preparation and signing can outlast the upfront checks.
+            beforeSubmit: async (containerId) => (await scope.allowsDocument(document)) &&
+                (await scope.allowsContainer(containerId)),
+            containerIds,
+            document,
+            expectedSubtreeRoot,
+            stillCurrent: input.stillCurrent,
+            prepareDocumentRotationSnapshot: input.prepareDocumentRotationSnapshot,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            runtime: input.runtime,
+        }),
+    };
+    return {
+        purgeLocal: async (document) => (await scope.allowsDocument(document)) &&
+            (await operations.purgeLocal(document)),
+        purgeRemote: async (document) => (await scope.allowsDocument(document)) &&
+            (await operations.purgeRemote(document)),
+        unlink: async (document, containerIds) => {
+            if (!(await scope.allowsDocument(document)))
+                return false;
+            for (const containerId of containerIds) {
+                if (!(await scope.allowsContainer(containerId)))
+                    return false;
+            }
+            return operations.unlink(document, containerIds);
+        },
+    };
+}
+// Signed request paths must keep the root under the parent it was selected
+// from; a settled restore elsewhere preserves the root's own documents too.
+function selectedSubtreeRoot(input) {
+    return {
+        id: input.rootContainerId,
+        parentId: input.containersById.get(input.rootContainerId)?.container.parentId ??
+            null,
+    };
+}
+function purgeWasCancelled(input) {
+    return input.signal?.aborted === true || input.stillCurrent?.() === false;
+}
+// Tear down one whole document per progress step. A failed document is skipped,
+// leaving its container undeletable while the remaining subtree work continues.
+// Cancellation is honored only between complete document operations.
+async function teardownSubtreeDocuments(input) {
+    for (const { document, containerIds, } of input.plan.unlinkByDocument.values()) {
+        if (purgeWasCancelled(input)) {
+            return { aborted: true };
+        }
+        const unlinked = await input.documentOperations.unlink(document, containerIds);
+        input.reportStep(unlinked);
+    }
+    for (const { document, unlinkContainerIds } of input.plan.purge) {
+        if (purgeWasCancelled(input)) {
+            return { aborted: true };
+        }
+        if (unlinkContainerIds.length > 0 &&
+            !(await input.documentOperations.unlink(document, unlinkContainerIds))) {
+            input.reportStep(false);
+            continue;
+        }
+        input.reportStep(await input.documentOperations.purgeRemote(document));
+    }
+    for (const document of input.plan.purgeLocal) {
+        if (purgeWasCancelled(input)) {
+            return { aborted: true };
+        }
+        input.reportStep(await input.documentOperations.purgeLocal(document));
+    }
+    return { aborted: false };
+}
+// Permanently destroy a folder that lives inside Trash, including everything
+// under it (or, with keepRootContainer, everything under the Trash bin while
+// leaving the bin in place — this is "Empty Trash"). Documents are destroyed only
+// when the subtree holds their last link; multi-folder documents are unlinked
+// from the subtree and preserved. Containers are deleted leaf-first so each
+// delete obeys the leaf-only constraint the store and server enforce. Every step
+// is remote-first then local (the per-document and per-container workflows handle
+// that internally), so a cancel between steps leaves local state reflecting
+// exactly the completed remote work.
+//
+// Progress is determinate: the plan (a pure read) completes before any
+// destructive step, so onProgress reports completed/failed against a total known
+// up front. A failed item is skipped rather than aborting the run, so the result
+// reports whatever prefix was actually destroyed alongside completed/failed
+// counts and whether a cancellation cut it short. Returns null only when the
+// target container is absent from the snapshot.
+export async function purgeContainerTree(request) {
+    if (purgeWasCancelled(request)) {
+        return null;
+    }
+    const input = {
+        ...request,
+        containersById: snapshotContainerStates(request.containersById),
+    };
+    const subtreeStates = collectSubtreeLeafFirst(input.containersById, input.rootContainerId);
+    if (subtreeStates.length === 0) {
+        return null;
+    }
+    const subtreeContainerIds = new Set(subtreeStates.map((containerState) => containerState.container.id));
+    const plan = await planSubtreeDocuments({
+        execSql: input.runtime.infra.execSql,
+        subtreeContainerIds,
+    });
+    if (purgeWasCancelled(input)) {
+        return null;
+    }
+    // Empty Trash keeps the Trash bin itself: tear down everything it holds, but
+    // exclude the root from the container deletions (deleting a system container
+    // would be rejected anyway).
+    const containerStatesToDelete = input.keepRootContainer
+        ? subtreeStates.filter((containerState) => containerState.container.id !== input.rootContainerId)
+        : subtreeStates;
+    // The total is fully known here — planning is a pure read that completes before
+    // any destructive step. Unlink work is counted per document (not per container
+    // link) so completed can never exceed total even when a document has several
+    // in-subtree links.
+    const totalCount = plan.unlinkByDocument.size +
+        plan.purge.length +
+        plan.purgeLocal.length +
+        containerStatesToDelete.length;
+    let completedCount = 0;
+    let failedCount = 0;
+    const emitProgress = () => {
+        input.onProgress?.({ completedCount, failedCount, totalCount });
+    };
+    const reportStep = (ok) => {
+        if (ok) {
+            completedCount += 1;
+        }
+        else {
+            failedCount += 1;
+        }
+        emitProgress();
+    };
+    // Emit the initial 0/total so a determinate bar renders immediately, before the
+    // first (potentially slow) remote call.
+    emitProgress();
+    const scope = createSubtreePurgeScope(input);
+    const teardown = await teardownSubtreeDocuments({
+        documentOperations: resolveSubtreeDocumentOperations(input, scope),
+        plan,
+        reportStep,
+        signal: input.signal,
+        stillCurrent: input.stillCurrent,
+    });
+    let purgedContainerIds = [];
+    let remoteDeletedContainerIds = [];
+    let aborted = teardown.aborted;
+    if (!teardown.aborted) {
+        const deletion = await deleteSubtreeContainers({
+            allowsContainer: scope.allowsContainer,
+            allowsLocalScopeInTransaction: scope.allowsLocalScopeInTransaction,
+            root: selectedSubtreeRoot(input),
+            persistence: input.persistence,
+            reportStep,
+            runtime: input.runtime,
+            signal: input.signal,
+            stillCurrent: input.stillCurrent,
+            subtreeStates: containerStatesToDelete,
+        });
+        purgedContainerIds = deletion.purgedContainerIds;
+        remoteDeletedContainerIds = deletion.remoteDeletedContainerIds;
+        aborted = deletion.aborted;
+    }
+    return {
+        aborted,
+        completedCount,
+        failedCount,
+        purgedContainerIds,
+        remoteDeletedContainerIds,
+        totalCount,
+    };
+}
+//# sourceMappingURL=purgeTree.js.map

package/workflows/container-contents/container-state/purge/purgeTree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTree.js","sourceRoot":"","sources":["purgeTree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAGrF,OAAO,EAAE,yCAAyC,EAAE,MAAM,gFAAgF,CAAC;AAC3I,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AAGvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AA4DhE,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CACnD,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAC7D,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CACnC,IAAI,GAAG,CACL,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9C,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3C,CACF,CACF,CAAC;QACF,MAAM,mBAAmB,GACvB,KAAK,CAAC,oBAAoB;YAC1B,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO;YACb,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,CAC3C,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,mBAAmB,CACrD;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5D,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAGnC;IACC,MAAM,SAAS,GAAG,MAAM,wCAAwC,CAC9D,KAAK,CAAC,OAAO,EACb;QACE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QAC5C,WAAW,EAAE,EAAE;KAChB,CACF,CAAC;IACF,MAAM,iBAAiB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;IACF,MAAM,8BAA8B,GAClC,MAAM,yCAAyC,CAAC,mCAAmC,CACjF,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IAEJ,MAAM,KAAK,GAGN,EAAE,CAAC;IACR,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAG7B,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,uBAAuB,CAAC;YAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;YACvC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;gBACrC,CAAC,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACjE,CAAC,CAAC,EAAE;YACN,oBAAoB,EAAE,QAAQ,CAAC,WAAW;YAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ;gBACR,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC/B,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE;gBACxC,QAAQ;gBACR,YAAY,EAAE,WAAW,CAAC,YAAY;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAUpC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAmC,CAAC;IACxC,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,KAAK,CAAC,+BAA+B,CAC5D,KAAK,CAAC,QAAQ,CACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;YACjD,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;YACnD,UAAU;YACV,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,SAAS,EAAE,KAAK,CAAC,YAAY;YAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACzB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,gBAAgB;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,WAAW;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,SAAS,gCAAgC,CACvC,KAA8B,EAC9B,KAAiD;IAEjD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAA8B,KAAK,CAAC,kBAAkB,IAAI;QACxE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC7B,CAAC,MAAM,2BAA2B,CAAC;YACjC,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CACrC,KAAK,CAAC,6BAA6B,CACjC,OAAO,EACP,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,EAAE,CACZ;YACH,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnB,mBAAmB,EAAE,QAAQ,CAAC,WAAW;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC,KAAK,IAAI;QACd,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC9B,OAAO,CACL,QAAQ,CAAC,UAAU;YACjB,CAAC,MAAM,4BAA4B,CAAC;gBAClC,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAClD,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,mBAAmB;gBACnB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,qBAAqB;gBAC5D,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACnB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC,CACN;QACH,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CACjC,qBAAqB,CAAC;YACpB,iEAAiE;YACjE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAClC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACtC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAC5C,YAAY;YACZ,QAAQ;YACR,mBAAmB;YACnB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACL,CAAC;IACF,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC7B,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC9B,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YAChE,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,2EAA2E;AAC3E,4EAA4E;AAC5E,SAAS,mBAAmB,CAC1B,KAA0E;IAE1E,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,eAAe;QACzB,QAAQ,EACN,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ;YACnE,IAAI;KACP,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAG1B;IACC,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,qEAAqE;AACrE,KAAK,UAAU,wBAAwB,CAAC,KAMvC;IACC,KAAK,MAAM,EACT,QAAQ,EACR,YAAY,GACb,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CACpD,QAAQ,EACR,YAAY,CACb,CAAC;QACF,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChE,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,IACE,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,EACtE,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,4EAA4E;AAC5E,qCAAqC;AACrC,EAAE;AACF,uEAAuE;AACvE,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,6EAA6E;AAC7E,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgC;IAEhC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC;KAChE,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC3C,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,aAAa,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CACnE,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,uBAAuB,GAAG,KAAK,CAAC,iBAAiB;QACrD,CAAC,CAAC,aAAa,CAAC,MAAM,CAClB,CAAC,cAAc,EAAE,EAAE,CACjB,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,eAAe,CACxD;QACH,CAAC,CAAC,aAAa,CAAC;IAElB,gFAAgF;IAChF,+EAA+E;IAC/E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,UAAU,GACd,IAAI,CAAC,gBAAgB,CAAC,IAAI;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,UAAU,CAAC,MAAM;QACtB,uBAAuB,CAAC,MAAM,CAAC;IAEjC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,EAAW,EAAE,EAAE;QACjC,IAAI,EAAE,EAAE,CAAC;YACP,cAAc,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,WAAW,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,gFAAgF;IAChF,wCAAwC;IACxC,YAAY,EAAE,CAAC;IAEf,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,kBAAkB,EAAE,gCAAgC,CAAC,KAAK,EAAE,KAAK,CAAC;QAClE,IAAI;QACJ,UAAU;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,kBAAkB,GAAsB,EAAE,CAAC;IAC/C,IAAI,yBAAyB,GAAsB,EAAE,CAAC;IACtD,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;YAC7C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,6BAA6B,EAAE,KAAK,CAAC,6BAA6B;YAClE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,uBAAuB;SACvC,CAAC,CAAC;QACH,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QACjD,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;QAC/D,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,OAAO;QACP,cAAc;QACd,WAAW;QACX,kBAAkB;QAClB,yBAAyB;QACzB,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../../../data/documents/documentConstants\";\nimport type { DocumentSummary } from \"../../../../data/documents/documentSummary\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { sqlDocumentContainerProjectionPersistence } from \"../../../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { listDocumentsByContainerIdsOrDocumentIds } from \"../../../../data/persistence/documents/documentsPersistence\";\nimport type { SubtreePurgeRoot } from \"../../../documents/purge/subtreePurgeScope\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport { unlinkRemoteContainerDocument } from \"../../documentLinks\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../../runtime\";\nimport {\n  purgeLocalContainerDocument,\n  purgeRemoteContainerDocument,\n} from \"../../tombstones/documentPurge\";\nimport type { PurgeProgress } from \"./purgeProgress\";\nimport {\n  collectSubtreeLeafFirst,\n  snapshotContainerStates,\n} from \"./purgeTreeCollection\";\nimport { deleteSubtreeContainers } from \"./purgeTreeContainerDeletion\";\nimport { createSubtreePurgeScope } from \"./purgeTreeScope\";\n\nexport { collectSubtreeLeafFirst } from \"./purgeTreeCollection\";\n\n// The store runtime satisfies the per-document purge/unlink workflows, so the\n// cascade reuses it verbatim.\ntype PurgeContainerTreeRuntime = ContainerContentsWorkflowRuntime;\n\ninterface PurgeContainerTreeInput {\n  readonly containersById: ReadonlyMap<string, ContainerState>;\n  readonly documentOperations?: SubtreeDocumentOperations | undefined;\n  // When true, tear down everything UNDER the root (its documents plus every\n  // descendant container) but never delete the root container itself. This is\n  // how \"Empty Trash\" reuses the same engine: the Trash bin is a protected system\n  // container that must survive while its whole contents are destroyed.\n  readonly keepRootContainer?: boolean;\n  readonly onProgress?: ((progress: PurgeProgress) => void) | undefined;\n  readonly persistence: ContainerContentsPersistence;\n  readonly prepareDocumentRotationSnapshot: (\n    document: DocumentSummary,\n  ) => Promise<Uint8Array | null>;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly rootContainerId: string;\n  readonly runtime: PurgeContainerTreeRuntime;\n  /** Stops a stale store generation between complete destructive units. */\n  readonly stillCurrent?: (() => boolean) | undefined;\n  // Checked at each unit boundary (between whole documents / whole containers),\n  // never mid-remote-call, so a cancelled run stops on a consistent prefix.\n  readonly signal?: AbortSignal | undefined;\n}\n\ninterface PurgeContainerTreeResult {\n  readonly aborted: boolean;\n  readonly completedCount: number;\n  readonly failedCount: number;\n  readonly purgedContainerIds: readonly string[];\n  readonly remoteDeletedContainerIds: readonly string[];\n  readonly totalCount: number;\n}\n\ninterface SubtreeDocumentPlan {\n  // Synced documents whose every link falls inside the subtree: reduce them to\n  // one retained link, as required by the purge endpoint, then destroy them.\n  readonly purge: readonly {\n    document: DocumentSummary;\n    unlinkContainerIds: readonly string[];\n  }[];\n  // Synced documents also linked outside the subtree: keep them, but unlink\n  // from each in-subtree container so the containers can be deleted.\n  readonly unlinkByDocument: ReadonlyMap<\n    string,\n    { document: DocumentSummary; containerIds: readonly string[] }\n  >;\n  // Never-synced documents (no remote id): destroy locally only.\n  readonly purgeLocal: readonly DocumentSummary[];\n}\n\ntype SubtreeDocumentDisposition =\n  | { kind: \"purge\"; unlinkContainerIds: readonly string[] }\n  | { kind: \"purge-local\" }\n  | { kind: \"unlink\"; containerIds: readonly string[] };\n\n// Destroy local-only documents locally. Destroy synced documents only when all\n// links are in the subtree; preserve documents with an external link. The purge\n// plan reduces owned documents to the server-required sole link first.\nexport function classifySubtreeDocument(input: {\n  readonly documentId: string | null;\n  readonly linkedContainerIds: readonly string[];\n  readonly preferredContainerId?: string | null | undefined;\n  readonly subtreeContainerIds: ReadonlySet<string>;\n}): SubtreeDocumentDisposition {\n  if (!input.documentId) {\n    return { kind: \"purge-local\" };\n  }\n  const hasExternalLink = input.linkedContainerIds.some(\n    (containerId) => !input.subtreeContainerIds.has(containerId),\n  );\n  if (!hasExternalLink) {\n    const linkedContainerIds = Array.from(\n      new Set(\n        input.linkedContainerIds.filter((containerId) =>\n          input.subtreeContainerIds.has(containerId),\n        ),\n      ),\n    );\n    const retainedContainerId =\n      input.preferredContainerId &&\n      linkedContainerIds.includes(input.preferredContainerId)\n        ? input.preferredContainerId\n        : linkedContainerIds[0];\n    return {\n      kind: \"purge\",\n      unlinkContainerIds: linkedContainerIds.filter(\n        (containerId) => containerId !== retainedContainerId,\n      ),\n    };\n  }\n  return {\n    kind: \"unlink\",\n    containerIds: input.linkedContainerIds.filter((containerId) =>\n      input.subtreeContainerIds.has(containerId),\n    ),\n  };\n}\n\nasync function planSubtreeDocuments(input: {\n  readonly execSql: PurgeContainerTreeRuntime[\"infra\"][\"execSql\"];\n  readonly subtreeContainerIds: ReadonlySet<string>;\n}): Promise<SubtreeDocumentPlan> {\n  const documents = await listDocumentsByContainerIdsOrDocumentIds(\n    input.execSql,\n    {\n      containerIds: [...input.subtreeContainerIds],\n      documentIds: [],\n    },\n  );\n  const remoteDocumentIds = documents.flatMap((document) =>\n    document.documentId ? [document.documentId] : [],\n  );\n  const linkedContainerIdsByDocumentId =\n    await sqlDocumentContainerProjectionPersistence.listLinkedContainerIdsByDocumentIds(\n      input.execSql,\n      remoteDocumentIds,\n    );\n\n  const purge: Array<{\n    document: DocumentSummary;\n    unlinkContainerIds: readonly string[];\n  }> = [];\n  const purgeLocal: DocumentSummary[] = [];\n  const unlinkByDocument = new Map<\n    string,\n    { document: DocumentSummary; containerIds: readonly string[] }\n  >();\n  for (const document of documents) {\n    const disposition = classifySubtreeDocument({\n      documentId: document.documentId ?? null,\n      linkedContainerIds: document.documentId\n        ? (linkedContainerIdsByDocumentId.get(document.documentId) ?? [])\n        : [],\n      preferredContainerId: document.containerId,\n      subtreeContainerIds: input.subtreeContainerIds,\n    });\n    if (disposition.kind === \"purge-local\") {\n      purgeLocal.push(document);\n    } else if (disposition.kind === \"purge\") {\n      purge.push({\n        document,\n        unlinkContainerIds: disposition.unlinkContainerIds,\n      });\n    } else if (document.documentId) {\n      unlinkByDocument.set(document.documentId, {\n        document,\n        containerIds: disposition.containerIds,\n      });\n    }\n  }\n\n  return { purge, purgeLocal, unlinkByDocument };\n}\n\nasync function unlinkSubtreeDocument(input: {\n  /** Rechecks the document and this exact unlink target before dispatch. */\n  readonly beforeSubmit: (targetContainerId: string) => Promise<boolean>;\n  readonly expectedSubtreeRoot: SubtreePurgeRoot;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly containerIds: readonly string[];\n  readonly document: DocumentSummary;\n  readonly prepareDocumentRotationSnapshot: PurgeContainerTreeInput[\"prepareDocumentRotationSnapshot\"];\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly runtime: PurgeContainerTreeRuntime;\n}): Promise<boolean> {\n  const documentId = input.document.documentId;\n  if (!documentId) {\n    return true;\n  }\n  let rotationSnapshot: Uint8Array | null;\n  try {\n    rotationSnapshot = await input.prepareDocumentRotationSnapshot(\n      input.document,\n    );\n  } catch {\n    return false;\n  }\n  if (!rotationSnapshot) {\n    return false;\n  }\n  for (const containerId of input.containerIds) {\n    const result = await unlinkRemoteContainerDocument({\n      beforeSubmit: () => input.beforeSubmit(containerId),\n      documentId,\n      expectedSubtreeRoot: input.expectedSubtreeRoot,\n      isCurrent: input.stillCurrent,\n      noteId: input.document.id,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      rotationSnapshot,\n      runtime: input.runtime,\n      targetContainerId: containerId,\n    });\n    if (result === null) {\n      return false;\n    }\n  }\n  return true;\n}\n\ninterface SubtreeDocumentOperations {\n  readonly purgeLocal: (document: DocumentSummary) => Promise<boolean>;\n  readonly purgeRemote: (document: DocumentSummary) => Promise<boolean>;\n  readonly unlink: (\n    document: DocumentSummary,\n    containerIds: readonly string[],\n  ) => Promise<boolean>;\n}\n\nfunction resolveSubtreeDocumentOperations(\n  input: PurgeContainerTreeInput,\n  scope: ReturnType<typeof createSubtreePurgeScope>,\n): SubtreeDocumentOperations {\n  const expectedSubtreeRoot = selectedSubtreeRoot(input);\n  const operations: SubtreeDocumentOperations = input.documentOperations ?? {\n    purgeLocal: async (document) =>\n      (await purgeLocalContainerDocument({\n        beforeDeleteInTransaction: (execSql) =>\n          scope.assertLocalScopeInTransaction(\n            execSql,\n            document.containerId,\n            document.id,\n          ),\n        noteId: document.id,\n        expectedContainerId: document.containerId,\n        runtime: input.runtime,\n      })) !== null,\n    purgeRemote: async (document) =>\n      Boolean(\n        document.documentId &&\n          (await purgeRemoteContainerDocument({\n            beforeSubmit: () => scope.allowsDocument(document),\n            documentId: document.documentId,\n            expectedSubtreeRoot,\n            stillCurrent: input.stillCurrent,\n            documentKind: document.documentKind ?? DEFAULT_DOCUMENT_KIND,\n            noteId: document.id,\n            resolveProjectionUserKey: input.resolveProjectionUserKey,\n            runtime: input.runtime,\n          })),\n      ),\n    unlink: (document, containerIds) =>\n      unlinkSubtreeDocument({\n        // Target preparation and signing can outlast the upfront checks.\n        beforeSubmit: async (containerId) =>\n          (await scope.allowsDocument(document)) &&\n          (await scope.allowsContainer(containerId)),\n        containerIds,\n        document,\n        expectedSubtreeRoot,\n        stillCurrent: input.stillCurrent,\n        prepareDocumentRotationSnapshot: input.prepareDocumentRotationSnapshot,\n        resolveProjectionUserKey: input.resolveProjectionUserKey,\n        runtime: input.runtime,\n      }),\n  };\n  return {\n    purgeLocal: async (document) =>\n      (await scope.allowsDocument(document)) &&\n      (await operations.purgeLocal(document)),\n    purgeRemote: async (document) =>\n      (await scope.allowsDocument(document)) &&\n      (await operations.purgeRemote(document)),\n    unlink: async (document, containerIds) => {\n      if (!(await scope.allowsDocument(document))) return false;\n      for (const containerId of containerIds) {\n        if (!(await scope.allowsContainer(containerId))) return false;\n      }\n      return operations.unlink(document, containerIds);\n    },\n  };\n}\n\ninterface SubtreeTeardownResult {\n  readonly aborted: boolean;\n}\n\n// Signed request paths must keep the root under the parent it was selected\n// from; a settled restore elsewhere preserves the root's own documents too.\nfunction selectedSubtreeRoot(\n  input: Pick<PurgeContainerTreeInput, \"containersById\" | \"rootContainerId\">,\n): SubtreePurgeRoot {\n  return {\n    id: input.rootContainerId,\n    parentId:\n      input.containersById.get(input.rootContainerId)?.container.parentId ??\n      null,\n  };\n}\n\nfunction purgeWasCancelled(input: {\n  readonly signal?: AbortSignal | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): boolean {\n  return input.signal?.aborted === true || input.stillCurrent?.() === false;\n}\n\n// Tear down one whole document per progress step. A failed document is skipped,\n// leaving its container undeletable while the remaining subtree work continues.\n// Cancellation is honored only between complete document operations.\nasync function teardownSubtreeDocuments(input: {\n  readonly documentOperations: SubtreeDocumentOperations;\n  readonly plan: SubtreeDocumentPlan;\n  readonly reportStep: (ok: boolean) => void;\n  readonly signal?: AbortSignal | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<SubtreeTeardownResult> {\n  for (const {\n    document,\n    containerIds,\n  } of input.plan.unlinkByDocument.values()) {\n    if (purgeWasCancelled(input)) {\n      return { aborted: true };\n    }\n    const unlinked = await input.documentOperations.unlink(\n      document,\n      containerIds,\n    );\n    input.reportStep(unlinked);\n  }\n  for (const { document, unlinkContainerIds } of input.plan.purge) {\n    if (purgeWasCancelled(input)) {\n      return { aborted: true };\n    }\n    if (\n      unlinkContainerIds.length > 0 &&\n      !(await input.documentOperations.unlink(document, unlinkContainerIds))\n    ) {\n      input.reportStep(false);\n      continue;\n    }\n    input.reportStep(await input.documentOperations.purgeRemote(document));\n  }\n  for (const document of input.plan.purgeLocal) {\n    if (purgeWasCancelled(input)) {\n      return { aborted: true };\n    }\n    input.reportStep(await input.documentOperations.purgeLocal(document));\n  }\n  return { aborted: false };\n}\n\n// Permanently destroy a folder that lives inside Trash, including everything\n// under it (or, with keepRootContainer, everything under the Trash bin while\n// leaving the bin in place — this is \"Empty Trash\"). Documents are destroyed only\n// when the subtree holds their last link; multi-folder documents are unlinked\n// from the subtree and preserved. Containers are deleted leaf-first so each\n// delete obeys the leaf-only constraint the store and server enforce. Every step\n// is remote-first then local (the per-document and per-container workflows handle\n// that internally), so a cancel between steps leaves local state reflecting\n// exactly the completed remote work.\n//\n// Progress is determinate: the plan (a pure read) completes before any\n// destructive step, so onProgress reports completed/failed against a total known\n// up front. A failed item is skipped rather than aborting the run, so the result\n// reports whatever prefix was actually destroyed alongside completed/failed\n// counts and whether a cancellation cut it short. Returns null only when the\n// target container is absent from the snapshot.\nexport async function purgeContainerTree(\n  request: PurgeContainerTreeInput,\n): Promise<PurgeContainerTreeResult | null> {\n  if (purgeWasCancelled(request)) {\n    return null;\n  }\n  const input = {\n    ...request,\n    containersById: snapshotContainerStates(request.containersById),\n  };\n  const subtreeStates = collectSubtreeLeafFirst(\n    input.containersById,\n    input.rootContainerId,\n  );\n  if (subtreeStates.length === 0) {\n    return null;\n  }\n  const subtreeContainerIds = new Set(\n    subtreeStates.map((containerState) => containerState.container.id),\n  );\n\n  const plan = await planSubtreeDocuments({\n    execSql: input.runtime.infra.execSql,\n    subtreeContainerIds,\n  });\n  if (purgeWasCancelled(input)) {\n    return null;\n  }\n\n  // Empty Trash keeps the Trash bin itself: tear down everything it holds, but\n  // exclude the root from the container deletions (deleting a system container\n  // would be rejected anyway).\n  const containerStatesToDelete = input.keepRootContainer\n    ? subtreeStates.filter(\n        (containerState) =>\n          containerState.container.id !== input.rootContainerId,\n      )\n    : subtreeStates;\n\n  // The total is fully known here — planning is a pure read that completes before\n  // any destructive step. Unlink work is counted per document (not per container\n  // link) so completed can never exceed total even when a document has several\n  // in-subtree links.\n  const totalCount =\n    plan.unlinkByDocument.size +\n    plan.purge.length +\n    plan.purgeLocal.length +\n    containerStatesToDelete.length;\n\n  let completedCount = 0;\n  let failedCount = 0;\n  const emitProgress = () => {\n    input.onProgress?.({ completedCount, failedCount, totalCount });\n  };\n  const reportStep = (ok: boolean) => {\n    if (ok) {\n      completedCount += 1;\n    } else {\n      failedCount += 1;\n    }\n    emitProgress();\n  };\n  // Emit the initial 0/total so a determinate bar renders immediately, before the\n  // first (potentially slow) remote call.\n  emitProgress();\n\n  const scope = createSubtreePurgeScope(input);\n  const teardown = await teardownSubtreeDocuments({\n    documentOperations: resolveSubtreeDocumentOperations(input, scope),\n    plan,\n    reportStep,\n    signal: input.signal,\n    stillCurrent: input.stillCurrent,\n  });\n\n  let purgedContainerIds: readonly string[] = [];\n  let remoteDeletedContainerIds: readonly string[] = [];\n  let aborted = teardown.aborted;\n  if (!teardown.aborted) {\n    const deletion = await deleteSubtreeContainers({\n      allowsContainer: scope.allowsContainer,\n      allowsLocalScopeInTransaction: scope.allowsLocalScopeInTransaction,\n      root: selectedSubtreeRoot(input),\n      persistence: input.persistence,\n      reportStep,\n      runtime: input.runtime,\n      signal: input.signal,\n      stillCurrent: input.stillCurrent,\n      subtreeStates: containerStatesToDelete,\n    });\n    purgedContainerIds = deletion.purgedContainerIds;\n    remoteDeletedContainerIds = deletion.remoteDeletedContainerIds;\n    aborted = deletion.aborted;\n  }\n\n  return {\n    aborted,\n    completedCount,\n    failedCount,\n    purgedContainerIds,\n    remoteDeletedContainerIds,\n    totalCount,\n  };\n}\n"]}

package/workflows/container-contents/container-state/purge/purgeTreeCollection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTreeCollection.js","sourceRoot":"","sources":["purgeTreeCollection.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,MAA2C;IAE3C,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC/B,EAAE;QACF;YACE,GAAG,KAAK;YACR,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;YACjC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;SAC5B;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,cAAmD,EACnD,eAAuB;IAEvB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACvD,KAAK,MAAM,cAAc,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3C,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IACpD,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;IAChC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,WAAW,KAAK,SAAS;YAAE,SAAS;QACxC,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,cAAc;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import type { ContainerState } from \"../../remoteHydration\";\n\n/** Own the placement fields; live store updates cannot revise purge intent. */\nexport function snapshotContainerStates(\n  states: ReadonlyMap<string, ContainerState>,\n): ReadonlyMap<string, ContainerState> {\n  return new Map(\n    [...states].map(([id, state]) => [\n      id,\n      {\n        ...state,\n        container: { ...state.container },\n        record: { ...state.record },\n      },\n    ]),\n  );\n}\n\n// Collect the target and descendants leaf-first because container deletion is\n// leaf-only. The enqueued set guards self/cyclic parent chains.\nexport function collectSubtreeLeafFirst(\n  containersById: ReadonlyMap<string, ContainerState>,\n  rootContainerId: string,\n): ContainerState[] {\n  const childIdsByParentId = new Map<string, string[]>();\n  for (const containerState of containersById.values()) {\n    const parentId = containerState.container.parentId;\n    if (parentId === null) continue;\n    const siblings = childIdsByParentId.get(parentId) ?? [];\n    siblings.push(containerState.container.id);\n    childIdsByParentId.set(parentId, siblings);\n  }\n\n  const ordered: ContainerState[] = [];\n  const enqueued = new Set<string>([rootContainerId]);\n  // Read through the queue with a head index rather than shift(): shift() is\n  // O(N) per call, which would make the whole walk O(N^2).\n  const queue = [rootContainerId];\n  for (let head = 0; head < queue.length; head++) {\n    const containerId = queue[head];\n    if (containerId === undefined) continue;\n    const containerState = containersById.get(containerId);\n    if (containerState) ordered.push(containerState);\n    for (const childId of childIdsByParentId.get(containerId) ?? []) {\n      if (!enqueued.has(childId)) {\n        enqueued.add(childId);\n        queue.push(childId);\n      }\n    }\n  }\n\n  return ordered.reverse();\n}\n"]}

package/workflows/container-contents/container-state/purge/purgeTreeContainerDeletion.js

@@ -0,0 +1,75 @@
+import { deleteContainerState } from "../delete.js";
+// Descendants stay under the selected root. A root with a captured parent must
+// retain that ancestor; parentless roots have no parent constraint to send.
+function requiredDeletionAncestor(root, containerId) {
+    return containerId === root.id ? (root.parentId ?? root.id) : root.id;
+}
+function deletionWasCancelled(input) {
+    return input.signal?.aborted === true || input.stillCurrent?.() === false;
+}
+function recordContainerDeletionOutcome(input) {
+    if (input.deleted === "remote-deleted") {
+        input.remoteDeletedContainerIds.push(input.containerState.container.id);
+    }
+    if (input.deleted !== "deleted")
+        return false;
+    input.purgedContainerIds.push(input.containerState.container.id);
+    if (input.containerState.record.documentId) {
+        input.remoteDeletedContainerIds.push(input.containerState.container.id);
+    }
+    return true;
+}
+// Delete leaf-first. A surviving document or child blocks its container and all
+// ancestors; cancellation stops at a container boundary.
+export async function deleteSubtreeContainers(input) {
+    const purgedContainerIds = [];
+    const remoteDeletedContainerIds = [];
+    const blockedParentIds = new Set();
+    for (const containerState of input.subtreeStates) {
+        if (deletionWasCancelled(input)) {
+            return { aborted: true, purgedContainerIds, remoteDeletedContainerIds };
+        }
+        const containerId = containerState.container.id;
+        const parentId = containerState.container.parentId;
+        if (blockedParentIds.has(containerId) ||
+            !(await input.allowsContainer(containerId))) {
+            if (parentId !== null) {
+                blockedParentIds.add(parentId);
+            }
+            input.reportStep(false);
+            continue;
+        }
+        const deleted = await deleteContainerState({
+            beforeDeleteInTransaction: (execSql) => input.allowsLocalScopeInTransaction(execSql, containerId),
+            containerState,
+            requiredAncestorId: requiredDeletionAncestor(input.root, containerId),
+            persistence: input.persistence,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+        });
+        if (recordContainerDeletionOutcome({
+            containerState,
+            deleted,
+            purgedContainerIds,
+            remoteDeletedContainerIds,
+        })) {
+            input.reportStep(true);
+        }
+        else {
+            if ((deleted === "local-conflict" || deleted === "remote-deleted") &&
+                deletionWasCancelled(input)) {
+                return {
+                    aborted: true,
+                    purgedContainerIds,
+                    remoteDeletedContainerIds,
+                };
+            }
+            if (parentId !== null) {
+                blockedParentIds.add(parentId);
+            }
+            input.reportStep(false);
+        }
+    }
+    return { aborted: false, purgedContainerIds, remoteDeletedContainerIds };
+}
+//# sourceMappingURL=purgeTreeContainerDeletion.js.map

package/workflows/container-contents/container-state/purge/purgeTreeContainerDeletion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTreeContainerDeletion.js","sourceRoot":"","sources":["purgeTreeContainerDeletion.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAuBjD,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,wBAAwB,CAC/B,IAAsB,EACtB,WAAmB;IAEnB,OAAO,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC5E,CAAC;AAED,SAAS,8BAA8B,CAAC,KAKvC;IACC,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACvC,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3C,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,yBAAyB,GAAa,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;QACnD,IACE,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;YACjC,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,EAC3C,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YACzC,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CACrC,KAAK,CAAC,6BAA6B,CAAC,OAAO,EAAE,WAAW,CAAC;YAC3D,cAAc;YACd,kBAAkB,EAAE,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;YACrE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IACE,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO;YACP,kBAAkB;YAClB,yBAAyB;SAC1B,CAAC,EACF,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IACE,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,gBAAgB,CAAC;gBAC9D,oBAAoB,CAAC,KAAK,CAAC,EAC3B,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,kBAAkB;oBAClB,yBAAyB;iBAC1B,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { SubtreePurgeRoot } from \"../../../documents/purge/subtreePurgeScope\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../../runtime\";\nimport { deleteContainerState } from \"../delete\";\n\ninterface SubtreeContainerDeletionResult {\n  readonly aborted: boolean;\n  readonly purgedContainerIds: string[];\n  readonly remoteDeletedContainerIds: string[];\n}\n\ninterface DeleteSubtreeContainersInput {\n  readonly allowsContainer: (containerId: string) => Promise<boolean>;\n  readonly allowsLocalScopeInTransaction: (\n    execSql: ExecSql,\n    containerId: string,\n  ) => Promise<boolean>;\n  readonly persistence: ContainerContentsPersistence;\n  readonly reportStep: (ok: boolean) => void;\n  readonly root: SubtreePurgeRoot;\n  readonly runtime: ContainerContentsWorkflowRuntime;\n  readonly signal?: AbortSignal | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly subtreeStates: readonly ContainerState[];\n}\n\n// Descendants stay under the selected root. A root with a captured parent must\n// retain that ancestor; parentless roots have no parent constraint to send.\nfunction requiredDeletionAncestor(\n  root: SubtreePurgeRoot,\n  containerId: string,\n): string {\n  return containerId === root.id ? (root.parentId ?? root.id) : root.id;\n}\n\nfunction deletionWasCancelled(input: DeleteSubtreeContainersInput): boolean {\n  return input.signal?.aborted === true || input.stillCurrent?.() === false;\n}\n\nfunction recordContainerDeletionOutcome(input: {\n  containerState: ContainerState;\n  deleted: Awaited<ReturnType<typeof deleteContainerState>>;\n  purgedContainerIds: string[];\n  remoteDeletedContainerIds: string[];\n}): boolean {\n  if (input.deleted === \"remote-deleted\") {\n    input.remoteDeletedContainerIds.push(input.containerState.container.id);\n  }\n  if (input.deleted !== \"deleted\") return false;\n  input.purgedContainerIds.push(input.containerState.container.id);\n  if (input.containerState.record.documentId) {\n    input.remoteDeletedContainerIds.push(input.containerState.container.id);\n  }\n  return true;\n}\n\n// Delete leaf-first. A surviving document or child blocks its container and all\n// ancestors; cancellation stops at a container boundary.\nexport async function deleteSubtreeContainers(\n  input: DeleteSubtreeContainersInput,\n): Promise<SubtreeContainerDeletionResult> {\n  const purgedContainerIds: string[] = [];\n  const remoteDeletedContainerIds: string[] = [];\n  const blockedParentIds = new Set<string>();\n  for (const containerState of input.subtreeStates) {\n    if (deletionWasCancelled(input)) {\n      return { aborted: true, purgedContainerIds, remoteDeletedContainerIds };\n    }\n    const containerId = containerState.container.id;\n    const parentId = containerState.container.parentId;\n    if (\n      blockedParentIds.has(containerId) ||\n      !(await input.allowsContainer(containerId))\n    ) {\n      if (parentId !== null) {\n        blockedParentIds.add(parentId);\n      }\n      input.reportStep(false);\n      continue;\n    }\n    const deleted = await deleteContainerState({\n      beforeDeleteInTransaction: (execSql) =>\n        input.allowsLocalScopeInTransaction(execSql, containerId),\n      containerState,\n      requiredAncestorId: requiredDeletionAncestor(input.root, containerId),\n      persistence: input.persistence,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n    });\n    if (\n      recordContainerDeletionOutcome({\n        containerState,\n        deleted,\n        purgedContainerIds,\n        remoteDeletedContainerIds,\n      })\n    ) {\n      input.reportStep(true);\n    } else {\n      if (\n        (deleted === \"local-conflict\" || deleted === \"remote-deleted\") &&\n        deletionWasCancelled(input)\n      ) {\n        return {\n          aborted: true,\n          purgedContainerIds,\n          remoteDeletedContainerIds,\n        };\n      }\n      if (parentId !== null) {\n        blockedParentIds.add(parentId);\n      }\n      input.reportStep(false);\n    }\n  }\n  return { aborted: false, purgedContainerIds, remoteDeletedContainerIds };\n}\n"]}

package/workflows/container-contents/container-state/purge/purgeTreeScope.js

@@ -0,0 +1,175 @@
+import { KeyingVerificationError } from "../../../../internal/crypto/index.js";
+import { verifyContainerWriterProjection } from "../../../../data/keyingProjectionVerification/container/containerProjectionVerification.js";
+import { runWithSecurityIncidentReporting } from "../../../../data/keyingProjectionVerification/error.js";
+import { rethrowProjectionVerificationCancelled } from "../../../../data/keyingProjectionVerification/types.js";
+import { hasUnsettledDocumentPlacement } from "../../../../data/persistence/container-contents/documentPurgePlacement.js";
+import { sqlDocumentsPersistence } from "../../../../data/persistence/documents/documentsPersistence.js";
+import { errorMessage } from "../../../../data/shared/errorMessage.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
+import { assertLocalPurgeScope } from "./localPurgeScope.js";
+import { snapshotContainerStates } from "./purgeTreeCollection.js";
+import { readLocalPurgeScope } from "./readLocalPurgeScope.js";
+async function verifiedRemoteScope(input, current, verifiedAncestorsById) {
+    const { runtime, rootContainerId } = input;
+    const targetId = current.container.id;
+    return runWithSecurityIncidentReporting(runtime.util.reportSecurityIncident, {
+        objectId: targetId,
+        objectKind: "container",
+        operation: "container.purge.scope",
+    }, async () => {
+        runtime.apiClient.evictContainerWriterProjection(targetId);
+        const projection = await runtime.apiClient.getContainerWriterProjection(targetId);
+        if (!projection || input.stillCurrent?.() === false)
+            return false;
+        if (projection.containerId !== targetId ||
+            projection.organizationId !== current.container.organizationId) {
+            throw new KeyingVerificationError("object_mismatch", "Subtree purge container identity mismatch");
+        }
+        const path = await verifyContainerWriterProjection({
+            execSql: runtime.infra.execSql,
+            projection,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
+        });
+        const rootIndex = path.findIndex((head) => head.state.containerId === rootContainerId);
+        const latest = await input.persistence.loadContainerMetadataState(runtime.infra.execSql, targetId);
+        const pendingMoves = await readPendingMoves(input);
+        const allowed = rootIndex >= 0 &&
+            path[rootIndex]?.state.parentContainerId ===
+                input.containersById.get(rootContainerId)?.container.parentId &&
+            latest?.container.parentId === current.container.parentId &&
+            latest.record?.documentId === current.record.documentId &&
+            !path
+                .slice(rootIndex)
+                .some((head) => pendingMoves.has(head.state.containerId)) &&
+            input.stillCurrent?.() !== false;
+        if (allowed)
+            verifiedAncestorsById.set(targetId, path.slice(rootIndex).map((head) => head.state.containerId));
+        return allowed;
+    });
+}
+/**
+ * A local-only unit cites no signed request, so a remote ordinary root must
+ * prove that it still sits under the parent it was selected from. A system
+ * root's signed topology is fixed by its destination role.
+ */
+async function rootPlacementIsCurrent(input, verifiedAncestorsById) {
+    const root = input.containersById.get(input.rootContainerId);
+    if (!root?.record.documentId || (root.container.systemSlot ?? null) !== null)
+        return true;
+    return verifiedRemoteScope(input, root, verifiedAncestorsById);
+}
+async function allowsContainer(input, containerId, verifiedAncestorsById, localOnlyUnit) {
+    const { runtime, persistence, rootContainerId } = input;
+    if (input.stillCurrent?.() === false)
+        return false;
+    const execSql = runtime.infra.execSql;
+    const pendingMoves = await readPendingMoves(input);
+    if (pendingMoves.has(rootContainerId))
+        return false;
+    const seen = new Set([rootContainerId]);
+    let currentId = containerId;
+    let verifiedRemoteAncestry = false;
+    while (currentId !== rootContainerId) {
+        if (!currentId || seen.has(currentId) || pendingMoves.has(currentId))
+            return false;
+        seen.add(currentId);
+        const expected = input.containersById.get(currentId);
+        const current = await persistence.loadContainerMetadataState(execSql, currentId);
+        if (!expected ||
+            !current?.record ||
+            current.container.parentId !== expected.container.parentId ||
+            current.container.organizationId !== expected.container.organizationId ||
+            current.record.documentId !== expected.record.documentId)
+            return false;
+        if (current.record.documentId) {
+            if (!(await verifiedRemoteScope(input, {
+                container: current.container,
+                record: current.record,
+            }, verifiedAncestorsById)))
+                return false;
+            verifiedRemoteAncestry = true;
+            break;
+        }
+        currentId = current.container.parentId;
+    }
+    if (localOnlyUnit &&
+        !verifiedRemoteAncestry &&
+        !(await rootPlacementIsCurrent(input, verifiedAncestorsById)))
+        return false;
+    return readLocalPurgeScope({
+        ...input,
+        containerId,
+        execSql,
+        verifiedAncestorsById,
+    });
+}
+async function readPendingMoves(input) {
+    return new Set((await input.persistence.listUnsyncedMoveIntents(input.runtime.infra.execSql)).map((intent) => intent.containerId));
+}
+async function documentPlacementIsCurrent(input, document) {
+    const execSql = input.runtime.infra.execSql;
+    if (await hasUnsettledDocumentPlacement(execSql, document.id))
+        return false;
+    const current = await sqlDocumentsPersistence.loadDocument(execSql, document.id);
+    return (current !== null &&
+        current.documentId === document.documentId &&
+        current.containerId === document.containerId &&
+        input.stillCurrent?.() !== false);
+}
+/** Listing edges only select candidates; each destructive unit proves its scope. */
+export function createSubtreePurgeScope(request) {
+    const input = {
+        ...request,
+        containersById: snapshotContainerStates(request.containersById),
+    };
+    const verifiedAncestorsById = new Map();
+    return {
+        allowsLocalScopeInTransaction: (execSql, containerId) => checkAvailableScope(input, async () => {
+            await assertLocalPurgeScope({
+                ...input,
+                execSql,
+                containerId,
+                verifiedAncestorsById,
+            });
+            return true;
+        }),
+        assertLocalScopeInTransaction: (execSql, containerId, localId) => assertLocalPurgeScope({
+            ...input,
+            execSql,
+            containerId,
+            localId,
+            verifiedAncestorsById,
+        }),
+        allowsContainer: (containerId) => checkAvailableScope(input, () => allowsContainer(input, containerId, verifiedAncestorsById, !input.containersById.get(containerId)?.record.documentId)),
+        allowsDocument: (document) => checkAvailableScope(input, async () => {
+            if (!document.containerId ||
+                !(await documentPlacementIsCurrent(input, document)))
+                return false;
+            if (!(await allowsContainer(input, document.containerId, verifiedAncestorsById, !document.documentId)))
+                return false;
+            // Freeze local placement checks together after all remote verification.
+            return readLocalPurgeScope({
+                ...input,
+                containerId: document.containerId,
+                execSql: input.runtime.infra.execSql,
+                localId: document.id,
+                verifiedAncestorsById,
+            }, document);
+        }),
+    };
+}
+async function checkAvailableScope(input, check) {
+    try {
+        return await check();
+    }
+    catch (error) {
+        rethrowProjectionVerificationCancelled(error);
+        if (error instanceof KeyingVerificationError)
+            throw error;
+        input.runtime.util.log(`Container contents: purge scope unavailable: ${errorMessage(error)}`);
+        return false;
+    }
+}
+//# sourceMappingURL=purgeTreeScope.js.map