@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/attachments/attachmentPersistence.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Attachment-slot persistence for stored documents.
+ *
+ * These are the workflow-level seams the document store writes attachment rows
+ * through: the pending-upload queue, the local blob projection, and the detach
+ * marker that keeps an unlinked slot's row alive for the next sync.
+ */
+import type { DocumentsPersistence, LocalAttachmentRecord, PendingAttachmentRecord } from "../../../data/persistence/documents/documentsPersistence.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export declare function saveLocalDocumentAttachments(input: {
+    attachments: ReadonlyArray<LocalAttachmentRecord>;
+    execSql: ExecSql;
+    persistence: DocumentsPersistence;
+}): Promise<void>;
+export declare function deleteLocalDocumentAttachment(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+    slotId: string;
+    storageKey: string;
+}): Promise<void>;
+/**
+ * Mark a slot's local blob row detached without dropping it.
+ *
+ * Unlinking an attachment from a synced document cannot delete the row: it is
+ * also the marker `syncDetachedAttachments` needs to detach the remote binding
+ * on the next sync (and to survive a restart before that sync runs). Marking it
+ * keeps that marker while taking the slot out of the local blob read models
+ * right away, so the blob browser stops listing a reference the document no
+ * longer has.
+ */
+export declare function markLocalDocumentAttachmentDetached(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+    slotId: string;
+    storageKey: string;
+}): Promise<void>;
+export declare function savePendingDocumentAttachment(input: {
+    attachment: PendingAttachmentRecord;
+    execSql: ExecSql;
+    persistence: DocumentsPersistence;
+}): Promise<void>;
+export declare function deletePendingDocumentAttachment(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+    slotId: string;
+    storageKey: string;
+}): Promise<void>;
+export declare function saveHydratedDocumentAttachment(input: {
+    execSql: ExecSql;
+    persistence: DocumentsPersistence;
+    attachment: LocalAttachmentRecord;
+    expectedStorageKey: string | null;
+    expectedSnapshotEndVersion: string | null;
+    stillCurrent: () => boolean;
+}): Promise<boolean>;

package/workflows/documents/attachments/attachmentPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentPersistence.js","sourceRoot":"","sources":["attachmentPersistence.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IACC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAC3C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,2BAA2B,CACjD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAC3C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAC7C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAO9C;IACC,OAAO,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC","sourcesContent":["/**\n * Attachment-slot persistence for stored documents.\n *\n * These are the workflow-level seams the document store writes attachment rows\n * through: the pending-upload queue, the local blob projection, and the detach\n * marker that keeps an unlinked slot's row alive for the next sync.\n */\nimport type {\n  DocumentsPersistence,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\nexport async function saveLocalDocumentAttachments(input: {\n  attachments: ReadonlyArray<LocalAttachmentRecord>;\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n}): Promise<void> {\n  for (const attachment of input.attachments) {\n    await input.persistence.saveLocalAttachment(input.execSql, attachment);\n  }\n}\n\nexport async function deleteLocalDocumentAttachment(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n  slotId: string;\n  storageKey: string;\n}): Promise<void> {\n  await input.persistence.deleteLocalAttachment(\n    input.execSql,\n    input.localId,\n    input.slotId,\n    input.storageKey,\n  );\n}\n\n/**\n * Mark a slot's local blob row detached without dropping it.\n *\n * Unlinking an attachment from a synced document cannot delete the row: it is\n * also the marker `syncDetachedAttachments` needs to detach the remote binding\n * on the next sync (and to survive a restart before that sync runs). Marking it\n * keeps that marker while taking the slot out of the local blob read models\n * right away, so the blob browser stops listing a reference the document no\n * longer has.\n */\nexport async function markLocalDocumentAttachmentDetached(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n  slotId: string;\n  storageKey: string;\n}): Promise<void> {\n  await input.persistence.markLocalAttachmentDetached(\n    input.execSql,\n    input.localId,\n    input.slotId,\n    input.storageKey,\n  );\n}\n\nexport async function savePendingDocumentAttachment(input: {\n  attachment: PendingAttachmentRecord;\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n}): Promise<void> {\n  await input.persistence.savePendingAttachment(\n    input.execSql,\n    input.attachment,\n  );\n}\n\nexport async function deletePendingDocumentAttachment(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n  slotId: string;\n  storageKey: string;\n}): Promise<void> {\n  await input.persistence.deletePendingAttachment(\n    input.execSql,\n    input.localId,\n    input.slotId,\n    input.storageKey,\n  );\n}\n\nexport function saveHydratedDocumentAttachment(input: {\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n  attachment: LocalAttachmentRecord;\n  expectedStorageKey: string | null;\n  expectedSnapshotEndVersion: string | null;\n  stillCurrent: () => boolean;\n}): Promise<boolean> {\n  return input.persistence.saveHydratedAttachment(input.execSql, input);\n}\n"]}

package/workflows/documents/attachments/blobMutationLock.d.ts

@@ -0,0 +1,8 @@
+import { type ExecSql } from "../../../data/sqlite/sqlSchema.js";
+/**
+ * Serialize byte-store mutations that address the same document blob key.
+ *
+ * Lock order is blob key, then the connection-wide SQL mutation lock. Callers
+ * must not acquire this lock from inside `runSerializedSqlMutation`.
+ */
+export declare function runSerializedDocumentBlobMutation<T>(execSql: ExecSql, storageKey: string, operation: () => Promise<T> | T): Promise<T>;

package/workflows/documents/attachments/blobMutationLock.js

@@ -0,0 +1,35 @@
+import { resolveCanonicalExecSql, } from "../../../data/sqlite/sqlSchema.js";
+const mutationQueuesByExecSql = new WeakMap();
+/**
+ * Serialize byte-store mutations that address the same document blob key.
+ *
+ * Lock order is blob key, then the connection-wide SQL mutation lock. Callers
+ * must not acquire this lock from inside `runSerializedSqlMutation`.
+ */
+export async function runSerializedDocumentBlobMutation(execSql, storageKey, operation) {
+    const canonicalExecSql = resolveCanonicalExecSql(execSql);
+    const queues = mutationQueuesByExecSql.get(canonicalExecSql) ?? new Map();
+    mutationQueuesByExecSql.set(canonicalExecSql, queues);
+    const previous = queues.get(storageKey) ?? Promise.resolve();
+    let releaseCurrent = () => undefined;
+    const current = new Promise((resolve) => {
+        releaseCurrent = resolve;
+    });
+    const waitForPrevious = previous.catch(() => undefined);
+    const queuedCurrent = waitForPrevious.then(() => current);
+    queues.set(storageKey, queuedCurrent);
+    await waitForPrevious;
+    try {
+        return await operation();
+    }
+    finally {
+        releaseCurrent();
+        if (queues.get(storageKey) === queuedCurrent) {
+            queues.delete(storageKey);
+            if (queues.size === 0) {
+                mutationQueuesByExecSql.delete(canonicalExecSql);
+            }
+        }
+    }
+}
+//# sourceMappingURL=blobMutationLock.js.map

package/workflows/documents/attachments/blobMutationLock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blobMutationLock.js","sourceRoot":"","sources":["blobMutationLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAExC,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAGxC,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,UAAkB,EAClB,SAA+B;IAE/B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1E,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7D,IAAI,cAAc,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,eAAe,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import {\n  type ExecSql,\n  resolveCanonicalExecSql,\n} from \"../../../data/sqlite/sqlSchema\";\n\nconst mutationQueuesByExecSql = new WeakMap<\n  ExecSql,\n  Map<string, Promise<void>>\n>();\n\n/**\n * Serialize byte-store mutations that address the same document blob key.\n *\n * Lock order is blob key, then the connection-wide SQL mutation lock. Callers\n * must not acquire this lock from inside `runSerializedSqlMutation`.\n */\nexport async function runSerializedDocumentBlobMutation<T>(\n  execSql: ExecSql,\n  storageKey: string,\n  operation: () => Promise<T> | T,\n): Promise<T> {\n  const canonicalExecSql = resolveCanonicalExecSql(execSql);\n  const queues = mutationQueuesByExecSql.get(canonicalExecSql) ?? new Map();\n  mutationQueuesByExecSql.set(canonicalExecSql, queues);\n\n  const previous = queues.get(storageKey) ?? Promise.resolve();\n  let releaseCurrent: () => void = () => undefined;\n  const current = new Promise<void>((resolve) => {\n    releaseCurrent = resolve;\n  });\n  const waitForPrevious = previous.catch(() => undefined);\n  const queuedCurrent = waitForPrevious.then(() => current);\n  queues.set(storageKey, queuedCurrent);\n  await waitForPrevious;\n\n  try {\n    return await operation();\n  } finally {\n    releaseCurrent();\n    if (queues.get(storageKey) === queuedCurrent) {\n      queues.delete(storageKey);\n      if (queues.size === 0) {\n        mutationQueuesByExecSql.delete(canonicalExecSql);\n      }\n    }\n  }\n}\n"]}

package/workflows/documents/attachments/orphanBlobReclaimState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphanBlobReclaimState.js","sourceRoot":"","sources":["orphanBlobReclaimState.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,GAAG,IAAI,OAAO,EAGvB,CAAC;AAEJ,MAAM,UAAU,sBAAsB,CACpC,WAA0C,EAC1C,OAAgB;IAEhB,IAAI,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG;YACN,mBAAmB,EAAE,IAAI,GAAG,EAAE;YAC9B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,EAAE;SAC1D,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { DocumentOrphanBlobPersistence } from \"../../../data/persistence/documents/orphanBlobPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\nexport interface OrphanBlobReclaimState {\n  deferredStorageKeys: Map<string, number>;\n  rerun: boolean;\n  running: Promise<void> | undefined;\n  sweepKey: string;\n}\n\nconst states = new WeakMap<\n  DocumentOrphanBlobPersistence,\n  WeakMap<ExecSql, OrphanBlobReclaimState>\n>();\n\nexport function orphanBlobReclaimState(\n  persistence: DocumentOrphanBlobPersistence,\n  execSql: ExecSql,\n): OrphanBlobReclaimState {\n  let connections = states.get(persistence);\n  if (!connections) {\n    connections = new WeakMap();\n    states.set(persistence, connections);\n  }\n  let state = connections.get(execSql);\n  if (!state) {\n    state = {\n      deferredStorageKeys: new Map(),\n      rerun: false,\n      running: undefined,\n      sweepKey: `sweep:document-orphans:${crypto.randomUUID()}`,\n    };\n    connections.set(execSql, state);\n  }\n  return state;\n}\n"]}

package/workflows/documents/attachments/orphanBlobReclaims.d.ts

@@ -0,0 +1,6 @@
+import type { DocumentsPersistence } from "../../../data/persistence/documents/types.js";
+import type { DocumentsWorkflowRuntimeGroups } from "../runtime.js";
+type DocumentOrphanBlobReclaimRuntime = Pick<DocumentsWorkflowRuntimeGroups, "infra" | "util">;
+/** Await all requested batches; maintenance failures never fail committed writes. */
+export declare function reclaimDocumentOrphanBlobs(runtime: DocumentOrphanBlobReclaimRuntime, persistence?: DocumentsPersistence): Promise<void>;
+export {};

package/workflows/documents/attachments/orphanBlobReclaims.js

@@ -0,0 +1,143 @@
+import { errorMessage } from "../../../data/shared/errorMessage.js";
+import { resolveCanonicalExecSql, runOncePerConnection, runSerializedSqlMutation, } from "../../../data/sqlite/sqlSchema.js";
+import { defaultDocumentsPersistence } from "../persistence.js";
+import { runSerializedDocumentBlobMutation } from "./blobMutationLock.js";
+import { orphanBlobReclaimState, } from "./orphanBlobReclaimState.js";
+const ORPHAN_BLOB_RECLAIM_BATCH_SIZE = 16;
+const ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS = 250;
+const ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS = 30_000;
+const ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE = 3;
+const ORPHAN_BLOB_RECLAIM_YIELD_MS = 16;
+function clearExpiredDeferredStorageKeys(deferredStorageKeys, now) {
+    for (const [storageKey, retryAt] of deferredStorageKeys) {
+        if (retryAt <= now)
+            deferredStorageKeys.delete(storageKey);
+    }
+}
+function waitForMaintenanceYield() {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ORPHAN_BLOB_RECLAIM_YIELD_MS);
+    });
+}
+async function sweepAgedDocumentOrphans(execSql, persistence, state) {
+    let swept = false;
+    await runOncePerConnection(execSql, state.sweepKey, async () => {
+        swept = true;
+        while (await persistence.orphanBlobs.sweep(execSql)) {
+            await waitForMaintenanceYield();
+        }
+    });
+    return swept;
+}
+async function reclaimQueuedBlobs(runtime, persistence, state) {
+    const execSql = runtime.infra.execSql;
+    await persistence.ensureSchema(execSql);
+    let shouldContinue = false;
+    const startedAt = Date.now();
+    const { deferredStorageKeys } = state;
+    const failedStorageKeys = [];
+    let warmedBlobStore = false;
+    let sweptAgedOrphans = false;
+    reclaimQueue: while (true) {
+        clearExpiredDeferredStorageKeys(deferredStorageKeys, Date.now());
+        const queuedStorageKeys = await persistence.orphanBlobs.list(execSql, ORPHAN_BLOB_RECLAIM_BATCH_SIZE + deferredStorageKeys.size);
+        const storageKeys = queuedStorageKeys
+            .filter((storageKey) => !deferredStorageKeys.has(storageKey))
+            .slice(0, ORPHAN_BLOB_RECLAIM_BATCH_SIZE);
+        if (storageKeys.length === 0) {
+            // Explicit delete paths get priority. Once their queue is drained, sweep
+            // crash residue once per connection and immediately drain what it queues.
+            if (!sweptAgedOrphans &&
+                (await sweepAgedDocumentOrphans(execSql, persistence, state))) {
+                sweptAgedOrphans = true;
+                continue;
+            }
+            break;
+        }
+        const firstStorageKey = storageKeys[0];
+        if (!warmedBlobStore && firstStorageKey) {
+            // Initialize lazy keyring/OPFS-backed stores before taking any blob-key
+            // lock. A failed preview is harmless: deletion can still reclaim the key.
+            await runtime.infra.blobStore
+                .openByteSource(firstStorageKey)
+                .catch(() => undefined);
+            warmedBlobStore = true;
+        }
+        for (const storageKey of storageKeys) {
+            await runSerializedDocumentBlobMutation(execSql, storageKey, async () => {
+                const shouldDelete = await runSerializedSqlMutation(execSql, async (lockedExecSql) => {
+                    if (await persistence.orphanBlobs.isReferenced(lockedExecSql, storageKey)) {
+                        await persistence.orphanBlobs.acknowledge(lockedExecSql, storageKey);
+                        return false;
+                    }
+                    return true;
+                });
+                if (!shouldDelete)
+                    return;
+                try {
+                    await runtime.infra.blobStore.deleteBytes(storageKey);
+                    await runSerializedSqlMutation(execSql, (lockedExecSql) => persistence.orphanBlobs.acknowledge(lockedExecSql, storageKey));
+                }
+                catch {
+                    failedStorageKeys.push(storageKey);
+                    deferredStorageKeys.set(storageKey, Date.now() + ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS);
+                }
+            });
+            if (Date.now() - startedAt >= ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS) {
+                shouldContinue = true;
+                break reclaimQueue;
+            }
+        }
+    }
+    if (failedStorageKeys.length > 0) {
+        const sample = failedStorageKeys
+            .slice(0, ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE)
+            .join(", ");
+        runtime.util.log(`Documents: orphan maintenance deferred ${failedStorageKeys.length} blob(s): ${sample}`);
+    }
+    return shouldContinue;
+}
+function runDocumentOrphanReclaims(runtime, persistence = defaultDocumentsPersistence) {
+    if (runtime.infra.dbStatus !== "ready") {
+        return Promise.resolve();
+    }
+    const state = orphanBlobReclaimState(persistence.orphanBlobs, resolveCanonicalExecSql(runtime.infra.execSql));
+    if (state.running) {
+        state.rerun = true;
+        return state.running;
+    }
+    const reclaim = (async () => {
+        try {
+            let hasMore;
+            do {
+                state.rerun = false;
+                hasMore = false;
+                try {
+                    hasMore = await reclaimQueuedBlobs(runtime, persistence, state);
+                }
+                catch (error) {
+                    const message = errorMessage(error);
+                    runtime.util.log(`Documents: orphan maintenance failed: ${message}`);
+                }
+                if (hasMore || state.rerun)
+                    await waitForMaintenanceYield();
+            } while (hasMore || state.rerun);
+        }
+        finally {
+            state.running = undefined;
+            state.rerun = false;
+        }
+    })();
+    state.running = reclaim;
+    return reclaim;
+}
+/** Await all requested batches; maintenance failures never fail committed writes. */
+export async function reclaimDocumentOrphanBlobs(runtime, persistence = defaultDocumentsPersistence) {
+    try {
+        await runDocumentOrphanReclaims(runtime, persistence);
+    }
+    catch (error) {
+        runtime.util.log(`Documents: orphan maintenance failed: ${errorMessage(error)}`);
+    }
+}
+//# sourceMappingURL=orphanBlobReclaims.js.map

package/workflows/documents/attachments/orphanBlobReclaims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphanBlobReclaims.js","sourceRoot":"","sources":["orphanBlobReclaims.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAEL,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAC/C,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAClD,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAC9C,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAOxC,SAAS,+BAA+B,CACtC,mBAAwC,EACxC,GAAW;IAEX,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACxD,IAAI,OAAO,IAAI,GAAG;YAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAAgB,EAChB,WAAiC,EACjC,KAA6B;IAE7B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC7D,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,uBAAuB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAyC,EACzC,WAAiC,EACjC,KAA6B;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,+BAA+B,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAC1D,OAAO,EACP,8BAA8B,GAAG,mBAAmB,CAAC,IAAI,CAC1D,CAAC;QACF,MAAM,WAAW,GAAG,iBAAiB;aAClC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,yEAAyE;YACzE,0EAA0E;YAC1E,IACE,CAAC,gBAAgB;gBACjB,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,EAC7D,CAAC;gBACD,gBAAgB,GAAG,IAAI,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS;iBAC1B,cAAc,CAAC,eAAe,CAAC;iBAC/B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,iCAAiC,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;gBACtE,MAAM,YAAY,GAAG,MAAM,wBAAwB,CACjD,OAAO,EACP,KAAK,EAAE,aAAa,EAAE,EAAE;oBACtB,IACE,MAAM,WAAW,CAAC,WAAW,CAAC,YAAY,CACxC,aAAa,EACb,UAAU,CACX,EACD,CAAC;wBACD,MAAM,WAAW,CAAC,WAAW,CAAC,WAAW,CACvC,aAAa,EACb,UAAU,CACX,CAAC;wBACF,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,YAAY;oBAAE,OAAO;gBAC1B,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBACtD,MAAM,wBAAwB,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,EAAE,CACxD,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAC/D,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACnC,mBAAmB,CAAC,GAAG,CACrB,UAAU,EACV,IAAI,CAAC,GAAG,EAAE,GAAG,kCAAkC,CAChD,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,kCAAkC,EAAE,CAAC;gBACjE,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,iBAAiB;aAC7B,KAAK,CAAC,CAAC,EAAE,mCAAmC,CAAC;aAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,0CAA0C,iBAAiB,CAAC,MAAM,aAAa,MAAM,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,yBAAyB,CAChC,OAAyC,EACzC,cAAoC,2BAA2B;IAE/D,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAClC,WAAW,CAAC,WAAW,EACvB,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAC/C,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,IAAI,OAAgB,CAAC;YACrB,GAAG,CAAC;gBACF,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;gBACpB,OAAO,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,IAAI,OAAO,IAAI,KAAK,CAAC,KAAK;oBAAE,MAAM,uBAAuB,EAAE,CAAC;YAC9D,CAAC,QAAQ,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACnC,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC1B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyC,EACzC,cAAoC,2BAA2B;IAE/D,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,yCAAyC,YAAY,CAAC,KAAK,CAAC,EAAE,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { DocumentsPersistence } from \"../../../data/persistence/documents/types\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport {\n  type ExecSql,\n  resolveCanonicalExecSql,\n  runOncePerConnection,\n  runSerializedSqlMutation,\n} from \"../../../data/sqlite/sqlSchema\";\nimport { defaultDocumentsPersistence } from \"../persistence\";\nimport type { DocumentsWorkflowRuntimeGroups } from \"../runtime\";\nimport { runSerializedDocumentBlobMutation } from \"./blobMutationLock\";\nimport {\n  type OrphanBlobReclaimState,\n  orphanBlobReclaimState,\n} from \"./orphanBlobReclaimState\";\n\nconst ORPHAN_BLOB_RECLAIM_BATCH_SIZE = 16;\nconst ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS = 250;\nconst ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS = 30_000;\nconst ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE = 3;\nconst ORPHAN_BLOB_RECLAIM_YIELD_MS = 16;\n\ntype DocumentOrphanBlobReclaimRuntime = Pick<\n  DocumentsWorkflowRuntimeGroups,\n  \"infra\" | \"util\"\n>;\n\nfunction clearExpiredDeferredStorageKeys(\n  deferredStorageKeys: Map<string, number>,\n  now: number,\n): void {\n  for (const [storageKey, retryAt] of deferredStorageKeys) {\n    if (retryAt <= now) deferredStorageKeys.delete(storageKey);\n  }\n}\n\nfunction waitForMaintenanceYield(): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ORPHAN_BLOB_RECLAIM_YIELD_MS);\n  });\n}\n\nasync function sweepAgedDocumentOrphans(\n  execSql: ExecSql,\n  persistence: DocumentsPersistence,\n  state: OrphanBlobReclaimState,\n): Promise<boolean> {\n  let swept = false;\n  await runOncePerConnection(execSql, state.sweepKey, async () => {\n    swept = true;\n    while (await persistence.orphanBlobs.sweep(execSql)) {\n      await waitForMaintenanceYield();\n    }\n  });\n  return swept;\n}\n\nasync function reclaimQueuedBlobs(\n  runtime: DocumentOrphanBlobReclaimRuntime,\n  persistence: DocumentsPersistence,\n  state: OrphanBlobReclaimState,\n): Promise<boolean> {\n  const execSql = runtime.infra.execSql;\n  await persistence.ensureSchema(execSql);\n  let shouldContinue = false;\n\n  const startedAt = Date.now();\n  const { deferredStorageKeys } = state;\n  const failedStorageKeys: string[] = [];\n  let warmedBlobStore = false;\n  let sweptAgedOrphans = false;\n\n  reclaimQueue: while (true) {\n    clearExpiredDeferredStorageKeys(deferredStorageKeys, Date.now());\n    const queuedStorageKeys = await persistence.orphanBlobs.list(\n      execSql,\n      ORPHAN_BLOB_RECLAIM_BATCH_SIZE + deferredStorageKeys.size,\n    );\n    const storageKeys = queuedStorageKeys\n      .filter((storageKey) => !deferredStorageKeys.has(storageKey))\n      .slice(0, ORPHAN_BLOB_RECLAIM_BATCH_SIZE);\n    if (storageKeys.length === 0) {\n      // Explicit delete paths get priority. Once their queue is drained, sweep\n      // crash residue once per connection and immediately drain what it queues.\n      if (\n        !sweptAgedOrphans &&\n        (await sweepAgedDocumentOrphans(execSql, persistence, state))\n      ) {\n        sweptAgedOrphans = true;\n        continue;\n      }\n      break;\n    }\n\n    const firstStorageKey = storageKeys[0];\n    if (!warmedBlobStore && firstStorageKey) {\n      // Initialize lazy keyring/OPFS-backed stores before taking any blob-key\n      // lock. A failed preview is harmless: deletion can still reclaim the key.\n      await runtime.infra.blobStore\n        .openByteSource(firstStorageKey)\n        .catch(() => undefined);\n      warmedBlobStore = true;\n    }\n\n    for (const storageKey of storageKeys) {\n      await runSerializedDocumentBlobMutation(execSql, storageKey, async () => {\n        const shouldDelete = await runSerializedSqlMutation(\n          execSql,\n          async (lockedExecSql) => {\n            if (\n              await persistence.orphanBlobs.isReferenced(\n                lockedExecSql,\n                storageKey,\n              )\n            ) {\n              await persistence.orphanBlobs.acknowledge(\n                lockedExecSql,\n                storageKey,\n              );\n              return false;\n            }\n            return true;\n          },\n        );\n        if (!shouldDelete) return;\n        try {\n          await runtime.infra.blobStore.deleteBytes(storageKey);\n          await runSerializedSqlMutation(execSql, (lockedExecSql) =>\n            persistence.orphanBlobs.acknowledge(lockedExecSql, storageKey),\n          );\n        } catch {\n          failedStorageKeys.push(storageKey);\n          deferredStorageKeys.set(\n            storageKey,\n            Date.now() + ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS,\n          );\n        }\n      });\n      if (Date.now() - startedAt >= ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS) {\n        shouldContinue = true;\n        break reclaimQueue;\n      }\n    }\n  }\n\n  if (failedStorageKeys.length > 0) {\n    const sample = failedStorageKeys\n      .slice(0, ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE)\n      .join(\", \");\n    runtime.util.log(\n      `Documents: orphan maintenance deferred ${failedStorageKeys.length} blob(s): ${sample}`,\n    );\n  }\n  return shouldContinue;\n}\n\nfunction runDocumentOrphanReclaims(\n  runtime: DocumentOrphanBlobReclaimRuntime,\n  persistence: DocumentsPersistence = defaultDocumentsPersistence,\n): Promise<void> {\n  if (runtime.infra.dbStatus !== \"ready\") {\n    return Promise.resolve();\n  }\n  const state = orphanBlobReclaimState(\n    persistence.orphanBlobs,\n    resolveCanonicalExecSql(runtime.infra.execSql),\n  );\n  if (state.running) {\n    state.rerun = true;\n    return state.running;\n  }\n\n  const reclaim = (async () => {\n    try {\n      let hasMore: boolean;\n      do {\n        state.rerun = false;\n        hasMore = false;\n        try {\n          hasMore = await reclaimQueuedBlobs(runtime, persistence, state);\n        } catch (error) {\n          const message = errorMessage(error);\n          runtime.util.log(`Documents: orphan maintenance failed: ${message}`);\n        }\n        if (hasMore || state.rerun) await waitForMaintenanceYield();\n      } while (hasMore || state.rerun);\n    } finally {\n      state.running = undefined;\n      state.rerun = false;\n    }\n  })();\n  state.running = reclaim;\n  return reclaim;\n}\n\n/** Await all requested batches; maintenance failures never fail committed writes. */\nexport async function reclaimDocumentOrphanBlobs(\n  runtime: DocumentOrphanBlobReclaimRuntime,\n  persistence: DocumentsPersistence = defaultDocumentsPersistence,\n): Promise<void> {\n  try {\n    await runDocumentOrphanReclaims(runtime, persistence);\n  } catch (error) {\n    runtime.util.log(\n      `Documents: orphan maintenance failed: ${errorMessage(error)}`,\n    );\n  }\n}\n"]}

package/workflows/documents/authorAccessFailure.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorAccessFailure.js","sourceRoot":"","sources":["authorAccessFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAGvF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAuB,EACvB,SAA2D;IAE3D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport type { DocumentCreateTerminalFailureHandler } from \"./createProjectionFetch\";\n\n/** A verified read-only path is a local permission refusal, not tampered proof. */\nexport async function recordDocumentAuthorAccessFailure<T>(\n  build: () => Promise<T>,\n  onFailure: DocumentCreateTerminalFailureHandler | undefined,\n): Promise<T | null> {\n  try {\n    return await build();\n  } catch (error) {\n    if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    await onFailure?.({ message: error.message, status: error.status });\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"authorAccessFailure.js","sourceRoot":"","sources":["authorAccessFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAGvF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAuB,EACvB,SAA2D;IAE3D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\nimport type { DocumentCreateTerminalFailureHandler } from \"./create/createProjectionFetch\";\n\n/** A verified read-only path is a local permission refusal, not tampered proof. */\nexport async function recordDocumentAuthorAccessFailure<T>(\n  build: () => Promise<T>,\n  onFailure: DocumentCreateTerminalFailureHandler | undefined,\n): Promise<T | null> {\n  try {\n    return await build();\n  } catch (error) {\n    if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    await onFailure?.({ message: error.message, status: error.status });\n    return null;\n  }\n}\n"]}

package/workflows/documents/create/createAdoption.js

@@ -0,0 +1,100 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { assertDocumentWriterProjectionConsistent, readLinkedContainerIdsFromDocumentManifest, unwrapDocumentContentKeyFromWriterProjection, } from "../../../data/documents/shared/projection.js";
+import { persistedDocumentCreateStateFromWriterProjection } from "../../../data/documents/shared/responses.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { readAccessEvent, readAccessManifest, } from "../../../data/keyingProjectionVerification/readers.js";
+/**
+ * A retry after a lost create response can only recover the local user's own
+ * create: the server serves whatever document holds the stable id we minted,
+ * and an honest server only ever committed ours under it. A create event signed
+ * by anyone else is a foreign document colliding on that id (a member with
+ * write access on the same container, or a dishonest server), which must not be
+ * adopted as if it were the pending local write.
+ *
+ * The create event is located by walking the served head's predecessor chain,
+ * not by scanning the history for any parentless manifest: the history is
+ * server-supplied, so a dishonest server could splice in a genesis this user
+ * signed for a different document. Every manifest on the chain must also name
+ * the requested document.
+ */
+function assertCreateEventSignedLocally(input, writerProjection) {
+    const label = "Document create conflict";
+    const historyByHash = new Map(writerProjection.documentManifestHistory.map((bundle) => [
+        bundle.manifestHash,
+        bundle,
+    ]));
+    const visited = new Set();
+    let bundle = writerProjection.documentManifest;
+    for (;;) {
+        const manifest = readAccessManifest(bundle.manifest, `${label} manifest`);
+        if (manifest.objectKind !== "document" ||
+            manifest.objectId !== input.documentId) {
+            throw new KeyingVerificationError("object_mismatch", `${label} manifest chain names another document`);
+        }
+        if (manifest.previousManifestHash === null) {
+            const createEvent = readAccessEvent(bundle.event.event, `${label} create event`);
+            if (createEvent.signerUserId !== input.expectedSignerUserId) {
+                throw new KeyingVerificationError("signer_mismatch", `${label} create event was signed by another user`);
+            }
+            return;
+        }
+        if (visited.has(bundle.manifestHash)) {
+            throw new KeyingVerificationError("invalid_shape", `${label} manifest history is cyclic`);
+        }
+        visited.add(bundle.manifestHash);
+        const previous = historyByHash.get(manifest.previousManifestHash);
+        if (!previous) {
+            throw new KeyingVerificationError("invalid_shape", `${label} does not expose its create event`);
+        }
+        bundle = previous;
+    }
+}
+function assertExpectedAdoptionScope(input, writerProjection) {
+    const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(writerProjection);
+    const expectedPath = writerProjection.authorizingContainerPaths.find((projection) => projection.containerId === input.expectedContainerId &&
+        projection.organizationId === input.expectedOrganizationId);
+    if (linkedContainerIds.length !== 1 ||
+        linkedContainerIds[0] !== input.expectedContainerId ||
+        !expectedPath) {
+        throw new Error("Document create conflict belongs to another container or organization");
+    }
+}
+/** Recover a committed retry only when it belongs to the intended org scope. */
+export async function adoptExistingRemoteDocument(input) {
+    const writerProjection = await input.apiClient.getDocumentWriterProjection(input.documentId);
+    if (!writerProjection)
+        return null;
+    // Reject a foreign collision before verification can pin its checkpoints.
+    assertExpectedAdoptionScope(input, writerProjection);
+    assertCreateEventSignedLocally(input, writerProjection);
+    const verifiedByHash = new Map();
+    const principalPolicyCache = new Map();
+    const targets = await assertDocumentWriterProjectionConsistent(writerProjection, {
+        execSql: input.execSql,
+        principalPolicyCache,
+        verifiedByHash,
+        ...projectionVerificationOptions(input),
+    });
+    if (targets.length !== 1 ||
+        targets[0]?.containerId !== input.expectedContainerId) {
+        throw new Error("Document create conflict belongs to another container or organization");
+    }
+    const contentKey = await unwrapDocumentContentKeyFromWriterProjection({
+        execSql: input.execSql,
+        principalPolicyCache,
+        secretKey: input.targetSecretKey,
+        verifiedByHash,
+        writerProjection,
+        ...projectionVerificationOptions(input),
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    input.apiClient.primeDocumentWriterProjection(writerProjection.documentId, writerProjection);
+    return {
+        contentKey,
+        documentId: writerProjection.documentId,
+        persistedState: persistedDocumentCreateStateFromWriterProjection(writerProjection),
+        writerProjection,
+    };
+}
+//# sourceMappingURL=createAdoption.js.map

package/workflows/documents/create/createAdoption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAdoption.js","sourceRoot":"","sources":["createAdoption.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wCAAwC,EACxC,0CAA0C,EAC1C,4CAA4C,GAC7C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gDAAgD,EAAE,MAAM,0CAA0C,CAAC;AAM5G,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EACL,eAAe,EACf,kBAAkB,GACnB,MAAM,oDAAoD,CAAC;AAc5D;;;;;;;;;;;;;GAaG;AACH,SAAS,8BAA8B,CACrC,KAAkC,EAClC,gBAAkD;IAElD,MAAM,KAAK,GAAG,0BAA0B,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,gBAAgB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,YAAY;QACnB,MAAM;KACP,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,MAAM,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;IAC/C,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;QAC1E,IACE,QAAQ,CAAC,UAAU,KAAK,UAAU;YAClC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,EACtC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,wCAAwC,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,eAAe,CACjC,MAAM,CAAC,KAAK,CAAC,KAAK,EAClB,GAAG,KAAK,eAAe,CACxB,CAAC;YACF,IAAI,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAC5D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,0CAA0C,CACnD,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,KAAK,6BAA6B,CACtC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,KAAK,mCAAmC,CAC5C,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAkC,EAClC,gBAAkD;IAElD,MAAM,kBAAkB,GACtB,0CAA0C,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,IAAI,CAClE,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QACpD,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,CAC7D,CAAC;IACF,IACE,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC/B,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,mBAAmB;QACnD,CAAC,YAAY,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC;IAElC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,2BAA2B,CACxE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,2BAA2B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACrD,8BAA8B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAC5D,gBAAgB,EAChB;QACE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CACF,CAAC;IACF,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,KAAK,CAAC,mBAAmB,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,4CAA4C,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB;QACpB,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,gBAAgB;QAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAC3C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CACjB,CAAC;IACF,OAAO;QACL,UAAU;QACV,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,cAAc,EACZ,gDAAgD,CAAC,gBAAgB,CAAC;QACpE,gBAAgB;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  readLinkedContainerIdsFromDocumentManifest,\n  unwrapDocumentContentKeyFromWriterProjection,\n} from \"../../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromWriterProjection } from \"../../../data/documents/shared/responses\";\nimport type {\n  CreateRemoteDocumentResult,\n  DocumentCreateApi,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport {\n  readAccessEvent,\n  readAccessManifest,\n} from \"../../../data/keyingProjectionVerification/readers\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\ntype RemoteDocumentAdoptionInput = {\n  readonly apiClient: DocumentCreateApi;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly expectedContainerId: string;\n  readonly expectedOrganizationId: string;\n  /** The local user whose pending create the retry is recovering. */\n  readonly expectedSignerUserId: string;\n  readonly targetSecretKey: Uint8Array;\n} & ProjectionVerificationOptions;\n\n/**\n * A retry after a lost create response can only recover the local user's own\n * create: the server serves whatever document holds the stable id we minted,\n * and an honest server only ever committed ours under it. A create event signed\n * by anyone else is a foreign document colliding on that id (a member with\n * write access on the same container, or a dishonest server), which must not be\n * adopted as if it were the pending local write.\n *\n * The create event is located by walking the served head's predecessor chain,\n * not by scanning the history for any parentless manifest: the history is\n * server-supplied, so a dishonest server could splice in a genesis this user\n * signed for a different document. Every manifest on the chain must also name\n * the requested document.\n */\nfunction assertCreateEventSignedLocally(\n  input: RemoteDocumentAdoptionInput,\n  writerProjection: DocumentWriterProjectionResponse,\n): void {\n  const label = \"Document create conflict\";\n  const historyByHash = new Map(\n    writerProjection.documentManifestHistory.map((bundle) => [\n      bundle.manifestHash,\n      bundle,\n    ]),\n  );\n  const visited = new Set<string>();\n  let bundle = writerProjection.documentManifest;\n  for (;;) {\n    const manifest = readAccessManifest(bundle.manifest, `${label} manifest`);\n    if (\n      manifest.objectKind !== \"document\" ||\n      manifest.objectId !== input.documentId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${label} manifest chain names another document`,\n      );\n    }\n    if (manifest.previousManifestHash === null) {\n      const createEvent = readAccessEvent(\n        bundle.event.event,\n        `${label} create event`,\n      );\n      if (createEvent.signerUserId !== input.expectedSignerUserId) {\n        throw new KeyingVerificationError(\n          \"signer_mismatch\",\n          `${label} create event was signed by another user`,\n        );\n      }\n      return;\n    }\n    if (visited.has(bundle.manifestHash)) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        `${label} manifest history is cyclic`,\n      );\n    }\n    visited.add(bundle.manifestHash);\n    const previous = historyByHash.get(manifest.previousManifestHash);\n    if (!previous) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        `${label} does not expose its create event`,\n      );\n    }\n    bundle = previous;\n  }\n}\n\nfunction assertExpectedAdoptionScope(\n  input: RemoteDocumentAdoptionInput,\n  writerProjection: DocumentWriterProjectionResponse,\n): void {\n  const linkedContainerIds =\n    readLinkedContainerIdsFromDocumentManifest(writerProjection);\n  const expectedPath = writerProjection.authorizingContainerPaths.find(\n    (projection) =>\n      projection.containerId === input.expectedContainerId &&\n      projection.organizationId === input.expectedOrganizationId,\n  );\n  if (\n    linkedContainerIds.length !== 1 ||\n    linkedContainerIds[0] !== input.expectedContainerId ||\n    !expectedPath\n  ) {\n    throw new Error(\n      \"Document create conflict belongs to another container or organization\",\n    );\n  }\n}\n\n/** Recover a committed retry only when it belongs to the intended org scope. */\nexport async function adoptExistingRemoteDocument(\n  input: RemoteDocumentAdoptionInput,\n): Promise<CreateRemoteDocumentResult | null> {\n  const writerProjection = await input.apiClient.getDocumentWriterProjection(\n    input.documentId,\n  );\n  if (!writerProjection) return null;\n\n  // Reject a foreign collision before verification can pin its checkpoints.\n  assertExpectedAdoptionScope(input, writerProjection);\n  assertCreateEventSignedLocally(input, writerProjection);\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache = new Map<string, VerifiedPrincipalPolicy>();\n  const targets = await assertDocumentWriterProjectionConsistent(\n    writerProjection,\n    {\n      execSql: input.execSql,\n      principalPolicyCache,\n      verifiedByHash,\n      ...projectionVerificationOptions(input),\n    },\n  );\n  if (\n    targets.length !== 1 ||\n    targets[0]?.containerId !== input.expectedContainerId\n  ) {\n    throw new Error(\n      \"Document create conflict belongs to another container or organization\",\n    );\n  }\n  const contentKey = await unwrapDocumentContentKeyFromWriterProjection({\n    execSql: input.execSql,\n    principalPolicyCache,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  if (input.stillCurrent?.() === false) return null;\n  input.apiClient.primeDocumentWriterProjection(\n    writerProjection.documentId,\n    writerProjection,\n  );\n  return {\n    contentKey,\n    documentId: writerProjection.documentId,\n    persistedState:\n      persistedDocumentCreateStateFromWriterProjection(writerProjection),\n    writerProjection,\n  };\n}\n"]}

package/workflows/documents/create/createProjection.d.ts

@@ -0,0 +1,14 @@
+import type { ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+/**
+ * Build the writer projection a document-create response establishes, from the
+ * container projection the create was authored against plus the manifest,
+ * content-key bundle, and KEK targets the server just returned. This is the
+ * same material a cold `GET /documents/:id/writer-projection` would yield, so
+ * seeding it lets the first read after a create resolve locally. Shared by the
+ * plain document-create path and the container-with-metadata-document path,
+ * whose response carries an equivalent `DocumentCreateResponse`.
+ */
+export declare function documentWriterProjectionFromCreateResponse(input: {
+    containerProjection: ContainerWriterProjectionResponse;
+    response: DocumentCreateResponse;
+}): DocumentWriterProjectionResponse;

package/workflows/documents/create/createProjectionFetch.d.ts

@@ -0,0 +1,27 @@
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentCreateApi } from "../../../data/documents/shared/types.js";
+export type DocumentCreateTerminalFailureHandler = (failure: {
+    readonly message: string;
+    readonly status: number | null;
+}) => Promise<void> | void;
+/**
+ * Resolve the container writer projection a create is authored against,
+ * persisting a terminal fetch failure through the caller's handler. A pending
+ * local create can never submit without this projection, so the failure (e.g.
+ * a 402 billing block or a 403 after access revocation) is what the write
+ * queue must surface — collapsing it to a silent null left the queued create
+ * invisible forever: no failure row, no attempt timestamp, and sync telemetry
+ * reporting no pending work.
+ *
+ * The recorded row follows the standard failure lifecycle rather than
+ * sticking: a document whose create later succeeds cannot skip its follow-up
+ * sync (its record carries no commit LSN until a sync response persists one,
+ * so shouldSkipCleanScheduledDocumentSync stays false), and that clean pass
+ * clears the row. Across restarts the row itself is a priming ticket that
+ * re-drives the store, exactly like a recorded revalidation refusal.
+ */
+export declare function fetchContainerWriterProjectionForCreate(input: {
+    apiClient: DocumentCreateApi;
+    containerId: string;
+    onTerminalSubmitFailure?: DocumentCreateTerminalFailureHandler | undefined;
+}): Promise<ContainerWriterProjectionResponse | null>;

package/workflows/documents/create/createProjectionFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createProjectionFetch.js","sourceRoot":"","sources":["createProjectionFetch.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,KAAK,CAAC,WAAW,EACjB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,uBAAuB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { DocumentCreateApi } from \"../../../data/documents/shared/types\";\n\nexport type DocumentCreateTerminalFailureHandler = (failure: {\n  readonly message: string;\n  readonly status: number | null;\n}) => Promise<void> | void;\n\n/**\n * Resolve the container writer projection a create is authored against,\n * persisting a terminal fetch failure through the caller's handler. A pending\n * local create can never submit without this projection, so the failure (e.g.\n * a 402 billing block or a 403 after access revocation) is what the write\n * queue must surface — collapsing it to a silent null left the queued create\n * invisible forever: no failure row, no attempt timestamp, and sync telemetry\n * reporting no pending work.\n *\n * The recorded row follows the standard failure lifecycle rather than\n * sticking: a document whose create later succeeds cannot skip its follow-up\n * sync (its record carries no commit LSN until a sync response persists one,\n * so shouldSkipCleanScheduledDocumentSync stays false), and that clean pass\n * clears the row. Across restarts the row itself is a priming ticket that\n * re-drives the store, exactly like a recorded revalidation refusal.\n */\nexport async function fetchContainerWriterProjectionForCreate(input: {\n  apiClient: DocumentCreateApi;\n  containerId: string;\n  onTerminalSubmitFailure?: DocumentCreateTerminalFailureHandler | undefined;\n}): Promise<ContainerWriterProjectionResponse | null> {\n  const result = await input.apiClient.getContainerWriterProjectionResult(\n    input.containerId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  result.report();\n  await input.onTerminalSubmitFailure?.(result);\n  return null;\n}\n"]}

package/workflows/documents/create/createResponse.js

@@ -0,0 +1,49 @@
+import { acknowledgeDocumentMutation } from "../../../data/documents/shared/mutationAcknowledgement.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { persistedDocumentCreateStateFromResponse } from "../../../data/documents/shared/responses.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { nullOnProjectionVerificationCancellation } from "../../../data/keyingProjectionVerification/types.js";
+import { adoptExistingRemoteDocument } from "./createAdoption.js";
+import { documentWriterProjectionFromCreateResponse } from "./createProjection.js";
+/** A matched acknowledgement remains committed if authorization evidence races. */
+export async function acknowledgeRemoteDocumentCreate(input) {
+    const { materializedPlan, response } = input;
+    const persistedState = persistedDocumentCreateStateFromResponse(materializedPlan.plan, response);
+    await acknowledgeDocumentMutation({
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    const writerProjection = documentWriterProjectionFromCreateResponse(input);
+    try {
+        const targets = await nullOnProjectionVerificationCancellation(() => assertDocumentWriterProjectionConsistent(writerProjection, input));
+        if (!targets || input.stillCurrent?.() === false)
+            return null;
+    }
+    catch (error) {
+        if (!(error instanceof ProjectionDependencyUnavailableError))
+            throw error;
+        // A principal pin can advance while POST is in flight. Recover the already
+        // committed document from fresh evidence, without submitting another create.
+        // The adoption path still verifies its author, scope, chain and key binding.
+        return nullOnProjectionVerificationCancellation(() => adoptExistingRemoteDocument({
+            ...input,
+            documentId: response.id,
+            expectedContainerId: input.containerProjection.containerId,
+            expectedOrganizationId: input.containerProjection.organizationId,
+            expectedSignerUserId: input.author.signerUserId,
+        }));
+    }
+    input.apiClient.primeDocumentWriterProjection(response.id, writerProjection);
+    return {
+        contentKey: materializedPlan.contentKey,
+        documentId: response.id,
+        persistedState,
+        plan: materializedPlan.plan,
+        response,
+        writerProjection,
+    };
+}
+//# sourceMappingURL=createResponse.js.map

package/workflows/documents/create/createResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createResponse.js","sourceRoot":"","sources":["createResponse.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AASpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,wCAAwC,EAAE,MAAM,kDAAkD,CAAC;AAE5G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AAEhF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KASiC;IAEjC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,wCAAwC,CAC7D,gBAAgB,CAAC,IAAI,EACrB,QAAQ,CACT,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAClE,wCAAwC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,2BAA2B,CAAC;YAC1B,GAAG,KAAK;YACR,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,WAAW;YAC1D,sBAAsB,EAAE,KAAK,CAAC,mBAAmB,CAAC,cAAc;YAChE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,UAAU;QACvC,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,cAAc;QACd,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,QAAQ;QACR,gBAAgB;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentCreateResponse,\n} from \"@tearleads/validators/response\";\nimport { acknowledgeDocumentMutation } from \"../../../data/documents/shared/mutationAcknowledgement\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromResponse } from \"../../../data/documents/shared/responses\";\nimport type {\n  CreateRemoteDocumentResult,\n  DocumentCreateApi,\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { nullOnProjectionVerificationCancellation } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { adoptExistingRemoteDocument } from \"./createAdoption\";\nimport { documentWriterProjectionFromCreateResponse } from \"./createProjection\";\n\n/** A matched acknowledgement remains committed if authorization evidence races. */\nexport async function acknowledgeRemoteDocumentCreate(\n  input: {\n    readonly apiClient: DocumentCreateApi;\n    readonly author: DocumentCreateAuthor;\n    readonly containerProjection: ContainerWriterProjectionResponse;\n    readonly execSql: ExecSql;\n    readonly materializedPlan: MaterializedDocumentCreatePlan;\n    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n    readonly response: DocumentCreateResponse;\n    readonly targetSecretKey: Uint8Array;\n  } & ProjectionVerificationOptions,\n): Promise<CreateRemoteDocumentResult | null> {\n  const { materializedPlan, response } = input;\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    materializedPlan.plan,\n    response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const writerProjection = documentWriterProjectionFromCreateResponse(input);\n  try {\n    const targets = await nullOnProjectionVerificationCancellation(() =>\n      assertDocumentWriterProjectionConsistent(writerProjection, input),\n    );\n    if (!targets || input.stillCurrent?.() === false) return null;\n  } catch (error) {\n    if (!(error instanceof ProjectionDependencyUnavailableError)) throw error;\n    // A principal pin can advance while POST is in flight. Recover the already\n    // committed document from fresh evidence, without submitting another create.\n    // The adoption path still verifies its author, scope, chain and key binding.\n    return nullOnProjectionVerificationCancellation(() =>\n      adoptExistingRemoteDocument({\n        ...input,\n        documentId: response.id,\n        expectedContainerId: input.containerProjection.containerId,\n        expectedOrganizationId: input.containerProjection.organizationId,\n        expectedSignerUserId: input.author.signerUserId,\n      }),\n    );\n  }\n  input.apiClient.primeDocumentWriterProjection(response.id, writerProjection);\n  return {\n    contentKey: materializedPlan.contentKey,\n    documentId: response.id,\n    persistedState,\n    plan: materializedPlan.plan,\n    response,\n    writerProjection,\n  };\n}\n"]}

package/workflows/documents/create/documentCreationPersistence.js

@@ -0,0 +1,16 @@
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { encodeVersionVector, exportFullHistorySnapshot, } from "../../../internal/loro/index.js";
+export function createInitialDocumentRows(input) {
+    return input.persistence.createDocumentWithHistoryCheckpoint(input.execSql, input.record, {
+        endVersionVector: encodeVersionVector(input.currentDoc),
+        snapshot: bytesToBase64(exportFullHistorySnapshot(input.currentDoc)),
+    }, input.pendingUpdate || input.stillCurrent
+        ? {
+            ...(input.pendingUpdate
+                ? { pendingUpdate: input.pendingUpdate }
+                : {}),
+            ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),
+        }
+        : undefined, input.saveClientProjection);
+}
+//# sourceMappingURL=documentCreationPersistence.js.map

package/workflows/documents/create/documentCreationPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentCreationPersistence.js","sourceRoot":"","sources":["documentCreationPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAQzB,MAAM,UAAU,yBAAyB,CAAC,KAUzC;IACC,OAAO,KAAK,CAAC,WAAW,CAAC,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ;QACE,gBAAgB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QACvD,QAAQ,EAAE,aAAa,CAAC,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;KACrE,EACD,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY;QACvC,CAAC,CAAC;YACE,GAAG,CAAC,KAAK,CAAC,aAAa;gBACrB,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE;QACH,CAAC,CAAC,SAAS,EACb,KAAK,CAAC,oBAAoB,CAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  encodeVersionVector,\n  exportFullHistorySnapshot,\n} from \"@tearleads/loro\";\nimport type {\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport type { PendingUpdateFields } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\nexport function createInitialDocumentRows(input: {\n  currentDoc: Parameters<typeof encodeVersionVector>[0];\n  execSql: ExecSql;\n  persistence: DocumentsPersistence;\n  pendingUpdate?: PendingUpdateFields | undefined;\n  record: StoredDocumentRecord;\n  stillCurrent?: (() => boolean) | undefined;\n  saveClientProjection: Parameters<\n    DocumentsPersistence[\"createDocumentWithHistoryCheckpoint\"]\n  >[4];\n}): Promise<string | null> {\n  return input.persistence.createDocumentWithHistoryCheckpoint(\n    input.execSql,\n    input.record,\n    {\n      endVersionVector: encodeVersionVector(input.currentDoc),\n      snapshot: bytesToBase64(exportFullHistorySnapshot(input.currentDoc)),\n    },\n    input.pendingUpdate || input.stillCurrent\n      ? {\n          ...(input.pendingUpdate\n            ? { pendingUpdate: input.pendingUpdate }\n            : {}),\n          ...(input.stillCurrent ? { stillCurrent: input.stillCurrent } : {}),\n        }\n      : undefined,\n    input.saveClientProjection,\n  );\n}\n"]}