mindoodb 0.0.38 → 0.0.40

package/dist/core/BaseMindooDB.js

@@ -229,6 +229,27 @@ class BaseMindooDB {
         // Cache for imported public keys (CryptoKey objects) to avoid re-importing the same key
         // Map<publicKeyPEM, CryptoKey>
         this.publicKeyCache = new Map();
+        /**
+         * Author signing keys whose entries were skipped during materialization
+         * because the key was not (yet) trusted by the tenant directory, mapped to
+         * the ids of the affected documents.
+         *
+         * This is the record that makes skipped entries recoverable: when the
+         * directory later learns about the author (a `grantaccess` document arrives
+         * on sync), {@link reconcileAuthorTrust} purges and force-re-emits exactly
+         * these documents so they re-materialize with the now-trusted entries and
+         * every `iterateChangesSince` consumer (views, summary, full-text) catches
+         * up. Persisted in the metadata checkpoint so the healing also works when
+         * the directory is synced in a later session while this DB is closed.
+         */
+        this.pendingUntrustedAuthors = new Map();
+        /**
+         * Set while restoring a metadata checkpoint that predates the
+         * `pendingUntrustedAuthors` field. Triggers a one-time heal scan at open
+         * ({@link reconcileAuthorTrustAtOpen}) that detects store entries missing
+         * from the cached materialization and seeds the pending map from them.
+         */
+        this.legacyCheckpointNeedsAuthorTrustScan = false;
         // Local cache support
         this.cacheManager = null;
         this.cachePrefix = null;
@@ -326,6 +347,12 @@ class BaseMindooDB {
          * the warmer settled can still display its outcome.
          */
         this.warmerProgress = null;
+        // ---------------------------------------------------------------------------
+        // Author-trust reconciliation: heal documents whose entries were skipped
+        // because their author was not yet known to the tenant directory.
+        // ---------------------------------------------------------------------------
+        /** Serializes concurrent author-trust reconciles (per database). */
+        this.authorTrustReconcileChain = Promise.resolve();
         (0, databaseIdValidation_1.validateDatabaseId)(store.getId(), "dbId");
         (0, databaseIdValidation_1.validateDatabaseId)(attachmentStore.getId(), "dbId");
         if (store.getId() !== attachmentStore.getId()) {
@@ -1191,6 +1218,18 @@ class BaseMindooDB {
         if (this.lastReconciledKeyBagFingerprint !== null) {
             checkpoint.keyBagFingerprint = this.lastReconciledKeyBagFingerprint;
         }
+        // Persist the pending untrusted-author map (additive field). Written even
+        // when empty: the field's PRESENCE marks the checkpoint as
+        // author-trust-aware, so restore can distinguish it from a legacy
+        // checkpoint that needs the one-time heal scan (see
+        // reconcileAuthorTrustAtOpen).
+        const pendingUntrusted = {};
+        for (const [publicKey, docIds] of this.pendingUntrustedAuthors) {
+            if (docIds.size > 0) {
+                pendingUntrusted[publicKey] = Array.from(docIds);
+            }
+        }
+        checkpoint.pendingUntrustedAuthors = pendingUntrusted;
         return new TextEncoder().encode(JSON.stringify(checkpoint));
     }
     /**
@@ -1219,6 +1258,24 @@ class BaseMindooDB {
             }
             this.lastReconciledKeyBagFingerprint =
                 typeof checkpoint.keyBagFingerprint === "string" ? checkpoint.keyBagFingerprint : null;
+            // Pending untrusted-author map. A checkpoint written before this field
+            // existed may hide entries that were silently skipped because their
+            // author was unknown at the time - flag it for the one-time heal scan.
+            this.pendingUntrustedAuthors.clear();
+            if (checkpoint.pendingUntrustedAuthors && typeof checkpoint.pendingUntrustedAuthors === "object") {
+                this.legacyCheckpointNeedsAuthorTrustScan = false;
+                for (const [publicKey, docIds] of Object.entries(checkpoint.pendingUntrustedAuthors)) {
+                    if (!Array.isArray(docIds))
+                        continue;
+                    const validIds = docIds.filter((id) => typeof id === "string");
+                    if (validIds.length > 0) {
+                        this.pendingUntrustedAuthors.set(publicKey, new Set(validIds));
+                    }
+                }
+            }
+            else {
+                this.legacyCheckpointNeedsAuthorTrustScan = true;
+            }
             this.syncScanCursors.clear();
             if (checkpoint.syncScanCursors && typeof checkpoint.syncScanCursors === "object") {
                 for (const [key, value] of Object.entries(checkpoint.syncScanCursors)) {
@@ -1410,6 +1467,28 @@ class BaseMindooDB {
         this.publicKeyCache.set(publicKey, cryptoKey);
         return cryptoKey;
     }
+    /**
+     * Remember that entries of `publicKey` were skipped for `docId` because the
+     * key is not (yet) trusted by the tenant directory. The record is persisted
+     * in the metadata checkpoint and consumed by {@link reconcileAuthorTrust}
+     * once the directory later trusts the key (e.g. a grantaccess document
+     * arrived on a delayed directory sync), so the skipped entries get
+     * re-materialized instead of staying invisible forever.
+     */
+    recordPendingUntrustedAuthor(publicKey, docId) {
+        let docIds = this.pendingUntrustedAuthors.get(publicKey);
+        if (!docIds) {
+            docIds = new Set();
+            this.pendingUntrustedAuthors.set(publicKey, docIds);
+        }
+        if (docIds.has(docId)) {
+            return;
+        }
+        docIds.add(docId);
+        this.logger.info(`Recorded pending untrusted author for doc ${docId}: entries skipped until the directory trusts the key`);
+        this.cacheMetaDirty = true;
+        this.cacheManager?.markDirty();
+    }
     /**
      * Compute the author's metadata-binding signature for a new entry (audit
      * finding #5). The signature covers the canonical, versioned, length-prefixed
@@ -1818,6 +1897,12 @@ class BaseMindooDB {
                 if (this.reconcileRestoredIndexOnInit) {
                     await this.reconcileRestoredIndexWithStore();
                 }
+                // Author-trust healing: entries skipped in an earlier session because
+                // their author was unknown to the directory become materializable once
+                // a grantaccess arrived while this DB was closed. Also runs the
+                // one-time legacy heal scan for checkpoints that predate the
+                // pending-untrusted-author tracking.
+                await this.reconcileAuthorTrustAtOpen();
                 this.probeFulltextSetupAtOpen();
                 this.probeSummarySetupAtOpen();
                 return;
@@ -2091,6 +2176,190 @@ class BaseMindooDB {
         // can skip the scan.
         this.markKeyBagFingerprintReconciled(await this.computeCurrentKeyBagFingerprint());
     }
+    /**
+     * Re-materialize documents whose entries were previously skipped because the
+     * author's signing key was not (yet) trusted by the tenant directory.
+     *
+     * This is the counterpart to {@link reconcileKeyVisibility} for AUTHOR trust
+     * instead of decryption keys: when a `grantaccess` document arrives on a
+     * delayed directory sync, entries that were quarantined/skipped earlier
+     * (recorded in {@link pendingUntrustedAuthors}) become valid. For each
+     * affected document we purge every cached materialization (L1/L2/summary/
+     * full-text) and force a changeSeq bump on the index so all
+     * `iterateChangesSince` consumers (virtual views, summary buffer, full-text
+     * index) re-process the doc; the body itself re-materializes lazily on the
+     * next load and now includes the previously skipped entries.
+     *
+     * Safe to call repeatedly; concurrent calls are serialized and a call with
+     * no pending or no newly-trusted keys is a fast no-op. Errors are logged,
+     * never thrown (best-effort hook semantics).
+     *
+     * @param newlyTrustedKeys Signing keys that just became trusted (directory
+     *   cache diff). When omitted, every pending key is re-checked against the
+     *   directory - used at DB open to catch trust changes that happened while
+     *   this database was closed.
+     */
+    reconcileAuthorTrust(newlyTrustedKeys) {
+        const run = () => this.reconcileAuthorTrustNow(newlyTrustedKeys).catch((error) => {
+            this.logger.warn(`reconcileAuthorTrust failed: ${error}`);
+        });
+        const chained = this.authorTrustReconcileChain.then(run, run);
+        this.authorTrustReconcileChain = chained;
+        return chained;
+    }
+    async reconcileAuthorTrustNow(newlyTrustedKeys) {
+        if (this.isTimeTravelMode()) {
+            return;
+        }
+        if (this.pendingUntrustedAuthors.size === 0) {
+            return;
+        }
+        const candidateKeys = Array.from(this.pendingUntrustedAuthors.keys()).filter((key) => !newlyTrustedKeys || newlyTrustedKeys.has(key));
+        if (candidateKeys.length === 0) {
+            return;
+        }
+        // Confirm against the directory even when the caller supplied a diff:
+        // validatePublicSigningKey is the same trust source the materialization
+        // paths use, so both stay consistent.
+        const directory = await this.tenant.openDirectory();
+        const trustedKeys = [];
+        for (const key of candidateKeys) {
+            try {
+                if (await directory.validatePublicSigningKey(key)) {
+                    trustedKeys.push(key);
+                }
+            }
+            catch (error) {
+                // Transient directory failure: keep the pending record so a later
+                // reconcile retries (fail open towards retry, never towards loss).
+                this.logger.warn(`reconcileAuthorTrust: directory validation failed for a pending key: ${error}`);
+            }
+        }
+        if (trustedKeys.length === 0) {
+            return;
+        }
+        const affectedDocIds = new Set();
+        for (const key of trustedKeys) {
+            for (const docId of this.pendingUntrustedAuthors.get(key) ?? []) {
+                affectedDocIds.add(docId);
+            }
+            this.pendingUntrustedAuthors.delete(key);
+        }
+        this.logger.info(`reconcileAuthorTrust: ${trustedKeys.length} author key(s) became trusted, re-materializing ${affectedDocIds.size} document(s)`);
+        // Deterministic ordering keeps the resulting changefeed stable between
+        // runs (mirrors reconcileKeyVisibility).
+        const docIds = Array.from(affectedDocIds).sort((left, right) => left.localeCompare(right));
+        for (const docId of docIds) {
+            // Drop every cached form of the stale materialization first so the
+            // next load rebuilds from the store with the now-trusted entries.
+            await this.purgeMaterializedDocument(docId);
+            const metadata = await this.scanAllMetadata(this.store, { docId });
+            const lifecycleEntries = metadata.filter((entry) => entry.entryType === "doc_create"
+                || entry.entryType === "doc_change"
+                || entry.entryType === "doc_delete"
+                || entry.entryType === "doc_undelete"
+                || entry.entryType === "doc_snapshot");
+            const visibility = this.deriveDocumentVisibilityMetadata(metadata);
+            if (!visibility) {
+                continue;
+            }
+            // Author trust and key visibility are independent layers: without the
+            // decryption key the doc stays governed by reconcileKeyVisibility.
+            if (!(await this.tenant.hasDecryptionKey(visibility.decryptionKeyId))) {
+                continue;
+            }
+            const { awaitingWitness, witnessed } = (0, storeEntryTime_1.metadataWitnessState)(lifecycleEntries);
+            // Force the changeSeq bump: the tracked index fields may be identical to
+            // the stale entry, but the materialized content WILL differ once the
+            // previously skipped entries are applied - consumers must re-read.
+            this.updateIndex(docId, visibility.lastModified, visibility.isDeleted, visibility.decryptionKeyId, "visible", awaitingWitness, witnessed, true);
+        }
+        this.cacheMetaDirty = true;
+        this.cacheManager?.markDirty();
+    }
+    /**
+     * Open-time author-trust healing, called from {@link initialize} after a
+     * cache restore. Two jobs:
+     *
+     *  1. Legacy checkpoints (written before {@link pendingUntrustedAuthors}
+     *     existed) may hide entries that were silently skipped - detect them via
+     *     the persisted automerge-hash lookup and seed the pending map.
+     *  2. Re-check all pending authors against the directory, healing documents
+     *     whose authors became trusted while this database was closed (e.g. the
+     *     directory was synced in a session that never opened this DB).
+     */
+    async reconcileAuthorTrustAtOpen() {
+        if (this.isTimeTravelMode() || this._isAdminOnlyDb || this.store.getId() === "directory") {
+            return;
+        }
+        if (this.legacyCheckpointNeedsAuthorTrustScan) {
+            this.legacyCheckpointNeedsAuthorTrustScan = false;
+            try {
+                await this.seedPendingAuthorsFromLegacyCheckpoint();
+            }
+            catch (error) {
+                this.logger.warn(`Legacy author-trust heal scan failed: ${error}`);
+            }
+            // Whether or not entries were found, the checkpoint is upgraded on the
+            // next flush (the pendingUntrustedAuthors field is always written), so
+            // this scan runs at most once per database.
+            this.cacheMetaDirty = true;
+            this.cacheManager?.markDirty();
+        }
+        if (this.pendingUntrustedAuthors.size === 0) {
+            return;
+        }
+        await this.reconcileAuthorTrust();
+    }
+    /**
+     * One-time heal scan for checkpoints written before the pending
+     * untrusted-author tracking existed: entries skipped back then left no
+     * record, but the persisted automerge-hash lookup
+     * ({@link automergeHashToEntryId}) only contains changes that were actually
+     * APPLIED to a materialization. A store head entry whose hash is missing
+     * from that lookup therefore marks a document whose cached state is missing
+     * entries - seed the pending map with the authors of all unapplied entries
+     * so the regular reconcile can heal (or keep waiting for) them.
+     */
+    async seedPendingAuthorsFromLegacyCheckpoint() {
+        const allMetadata = await this.scanAllMetadata(this.store);
+        const replayByDoc = new Map();
+        for (const entry of allMetadata) {
+            if (!this.isDocumentReplayEntry(entry)) {
+                continue;
+            }
+            const entries = replayByDoc.get(entry.docId) ?? [];
+            entries.push(entry);
+            replayByDoc.set(entry.docId, entries);
+        }
+        let seededDocs = 0;
+        for (const [docId, replayEntries] of replayByDoc) {
+            const applied = this.automergeHashToEntryId.get(docId);
+            // Heads applied => every entry reachable from them was applied too
+            // (Automerge buffers dependents of missing changes), so checking the
+            // active DAG heads is sufficient and avoids false positives for entries
+            // that are only covered by a snapshot.
+            const headEntryIds = this.findActiveReplayHeadEntryIds(replayEntries);
+            const hasUnappliedHead = headEntryIds.some((entryId) => {
+                const parsed = (0, idGeneration_1.parseDocEntryId)(entryId);
+                return parsed !== null && !(applied?.has(parsed.automergeHash));
+            });
+            if (!hasUnappliedHead) {
+                continue;
+            }
+            seededDocs++;
+            for (const entry of replayEntries) {
+                const parsed = (0, idGeneration_1.parseDocEntryId)(entry.id);
+                if (!parsed || applied?.has(parsed.automergeHash)) {
+                    continue;
+                }
+                this.recordPendingUntrustedAuthor(entry.createdByPublicKey, docId);
+            }
+        }
+        if (seededDocs > 0) {
+            this.logger.info(`Legacy author-trust heal scan found ${seededDocs} document(s) with unapplied store entries`);
+        }
+    }
     async reconcileRestoredIndexWithStore() {
         const lifecycleMetadata = await this.scanAllMetadata(this.store);
         const lifecycleDocIds = Array.from(new Set(lifecycleMetadata
@@ -2780,6 +3049,20 @@ class BaseMindooDB {
                 scannedEntries: 0,
                 totalSourceEntries: totalSourceEstimate,
             });
+            // Upper scan bound: the source head captured BEFORE the scan started.
+            // Pushing to a witnessing target re-anchors the just-transferred
+            // entries to a fresh receiptOrder on the source (applyWitnessReceipts),
+            // i.e. past the running cursor — without this bound the scan would
+            // re-discover its own transfers and never terminate (first-sync loop).
+            // Entries beyond the bound (re-anchored or written concurrently) are
+            // picked up by the next sync.
+            const scanUpperBound = sourceHead?.maxReceiptOrder;
+            // IDs already transferred in this sync session. Guards against
+            // re-pushing entries the scan re-discovers when the target bloom
+            // snapshot is stale (fetched once up front; empty on a first sync, so
+            // it would classify every re-discovered id as "definitely missing"
+            // and skip the exact hasEntries check).
+            const transferredThisSync = new Set();
             let currentPage = 0;
             // Scan-page pipelining (sync-v5, phase 4): while page N is being
             // filtered and transferred, page N+1 is already being fetched.
@@ -2803,13 +3086,25 @@ class BaseMindooDB {
                     ? sourceStore.scanEntriesSince(page.nextCursor, pageSize)
                     : null;
                 currentPage++;
-                scanned += page.entries.length;
+                // Clamp the page to the scan bound. Pages are ordered by
+                // (receiptOrder, id), so everything past the first out-of-bound
+                // entry is out of bound as well.
+                let pageEntries = page.entries;
+                let reachedScanBound = false;
+                if (scanUpperBound !== undefined && pageEntries.length > 0) {
+                    const inBound = pageEntries.filter((m) => (m.receiptOrder ?? 0) <= scanUpperBound);
+                    if (inBound.length < pageEntries.length) {
+                        reachedScanBound = true;
+                        pageEntries = inBound;
+                    }
+                }
+                scanned += pageEntries.length;
                 if (signal?.aborted) {
                     discardPrefetch();
                     persistScanCursor(cursor);
                     return { transferred, transferredBytes, scanned, cancelled: true, rejected };
                 }
-                if (page.entries.length > 0) {
+                if (pageEntries.length > 0) {
                     onProgress?.({
                         phase: 'transferring',
                         message: `Scanned ${scanned} entries, checking for changes (page ${currentPage})...`,
@@ -2818,8 +3113,12 @@ class BaseMindooDB {
                         totalSourceEntries: totalSourceEstimate,
                         currentPage,
                     });
-                    const ids = page.entries.map((m) => m.id);
-                    const missingIds = await this.filterMissingIds(targetStore, ids, targetBloom);
+                    const ids = pageEntries
+                        .map((m) => m.id)
+                        .filter((id) => !transferredThisSync.has(id));
+                    const missingIds = ids.length > 0
+                        ? await this.filterMissingIds(targetStore, ids, targetBloom)
+                        : [];
                     if (signal?.aborted) {
                         discardPrefetch();
                         persistScanCursor(cursor);
@@ -2843,6 +3142,9 @@ class BaseMindooDB {
                             persistScanCursor(cursor);
                             return { transferred, transferredBytes, scanned, cancelled: true, rejected };
                         }
+                        for (const id of missingIds) {
+                            transferredThisSync.add(id);
+                        }
                     }
                 }
                 onProgress?.({
@@ -2854,6 +3156,18 @@ class BaseMindooDB {
                     totalSourceEntries: totalSourceEstimate,
                     currentPage,
                 });
+                if (reachedScanBound) {
+                    // Persist the last in-bound position (NOT page.nextCursor, which
+                    // already points into the out-of-bound tail): a concurrent write
+                    // that landed between the bound and the re-anchored tail must be
+                    // scanned by the next sync.
+                    const lastInBound = pageEntries.length > 0 ? pageEntries[pageEntries.length - 1] : null;
+                    if (lastInBound) {
+                        cursor = { receiptOrder: lastInBound.receiptOrder ?? 0, id: lastInBound.id };
+                    }
+                    discardPrefetch();
+                    break;
+                }
                 cursor = page.nextCursor;
                 if (!page.hasMore) {
                     break;
@@ -3154,6 +3468,7 @@ class BaseMindooDB {
                     `Custom document IDs must match ${types_1.CUSTOM_DOC_ID_REGEX.source}.`);
             }
             this.validateIdPrefixOption("createDocuments", options);
+            this.validateAssumeUniqueIdOption("createDocuments", options);
         }
         const results = new Array(inputs.length).fill(null);
         const prepared = [];
@@ -3210,6 +3525,15 @@ class BaseMindooDB {
         this.logger.info(`Bulk-created ${prepared.length} documents (${inputs.length - prepared.length} already existed)`);
         return results;
     }
+    /**
+     * Validate `CreateOptions.assumeUniqueId`: only meaningful for a
+     * caller-provided `id` (generated ids are unique by construction).
+     */
+    validateAssumeUniqueIdOption(methodName, options) {
+        if (options.assumeUniqueId && options.id === undefined) {
+            throw new Error(`${methodName}: assumeUniqueId requires a caller-provided id`);
+        }
+    }
     /**
      * Validate `CreateOptions.idPrefix`: mutually exclusive with `id` and must
      * match {@link DOC_ID_PREFIX_REGEX}.
@@ -3283,6 +3607,12 @@ class BaseMindooDB {
         const keyId = await this.resolveCreateKeyId(options);
         const useCustomDocId = options.id !== undefined;
         this.validateIdPrefixOption("createDocument", options);
+        this.validateAssumeUniqueIdOption("createDocument", options);
+        // A caller-provided id needs the deterministic seed change UNLESS the
+        // caller asserts the id is random/unique (`assumeUniqueId`): convergence
+        // of concurrent same-id creates is then not a concern and the create can
+        // follow the generated-ID path (initialValues baked into doc_create).
+        const useDeterministicSeed = useCustomDocId && !options.assumeUniqueId;
         // Sanitize caller-provided initial values: internal/reserved fields (those
         // starting with "_", e.g. "_attachments") are managed by MindooDB and must
         // not be seeded by callers. `undefined` values are treated as "not set"
@@ -3296,12 +3626,13 @@ class BaseMindooDB {
                 throw new Error(`createDocument: invalid document id "${options.id}". ` +
                     `Custom document IDs must match ${types_1.CUSTOM_DOC_ID_REGEX.source}.`);
             }
-            // Custom-ID documents are seeded with a hard-coded initial change so that
-            // independent replicas converge on the same Automerge hash. Baking
-            // caller values into that change would diverge the hash per content, so
-            // initialValues is unsupported on the custom-ID path in v1. Create the
-            // document first, then apply values via changeDoc().
-            if (hasInitialValues) {
+            // Convergent custom-ID documents are seeded with a hard-coded initial
+            // change so that independent replicas converge on the same Automerge
+            // hash. Baking caller values into that change would diverge the hash per
+            // content, so initialValues is unsupported on the deterministic-seed
+            // path in v1. Create the document first, then apply values via
+            // changeDoc() — or assert `assumeUniqueId` for random ids.
+            if (useDeterministicSeed && hasInitialValues) {
                 throw new Error("createDocument: initialValues is not supported together with a custom id; " +
                     "create the document, then apply values with changeDoc().");
             }
@@ -3338,14 +3669,15 @@ class BaseMindooDB {
         this.logger.debug(`Creating document ${docId} with key ${keyId}${useCustomSigningKey ? ' using custom signing key' : ''}${useCustomDocId ? ' with caller-provided id' : ''}`);
         // Build the initial Automerge document and its first change bytes.
         //
-        // For UUID7 documents we use the historical path (Automerge.init + change).
-        // For custom-ID documents we apply a hard-coded initial change so that
-        // independent replicas using the same id produce the same Automerge hash
-        // and `doc_create` entry id, allowing later changes to merge.
+        // For UUID7 documents (and unique-by-assertion custom ids) we use the
+        // historical path (Automerge.init + change). For convergent custom-ID
+        // documents we apply a hard-coded initial change so that independent
+        // replicas using the same id produce the same Automerge hash and
+        // `doc_create` entry id, allowing later changes to merge.
         const now = (0, timeSource_1.semanticNow)();
         let newDoc;
         let changeBytes;
-        if (useCustomDocId) {
+        if (useDeterministicSeed) {
             this.logger.debug(`Seeding custom-id document ${docId} with hard-coded initial Automerge change`);
             changeBytes = getCustomIdInitialChangeBytes();
             try {
@@ -3525,6 +3857,11 @@ class BaseMindooDB {
         const keyId = await this.resolveCreateKeyId(options);
         const useCustomDocId = options.id !== undefined;
         this.validateIdPrefixOption("createDocuments", options);
+        this.validateAssumeUniqueIdOption("createDocuments", options);
+        // See createDocumentInternal: `assumeUniqueId` opts a caller-provided id
+        // out of the deterministic seed, so initialValues fold into doc_create
+        // and the document costs a single store entry.
+        const useDeterministicSeed = useCustomDocId && !options.assumeUniqueId;
         // Sanitize caller-provided initial values: internal/reserved fields are
         // managed by MindooDB and must not be seeded by callers. `undefined`
         // values are treated as "not set" (Automerge cannot represent undefined).
@@ -3547,7 +3884,7 @@ class BaseMindooDB {
         // following the same seeding rules as the single-create path.
         let seedDoc;
         let createChangeBytes;
-        if (useCustomDocId) {
+        if (useDeterministicSeed) {
             createChangeBytes = getCustomIdInitialChangeBytes();
             const fresh = automerge_adapter_1.Automerge.init();
             const [appliedDoc] = automerge_adapter_1.Automerge.applyChanges(fresh, [createChangeBytes]);
@@ -3569,12 +3906,13 @@ class BaseMindooDB {
             }
             createChangeBytes = localChange;
         }
-        // Custom-id + initialValues (bulk-only): the deterministic seed change must
-        // stay byte-identical across replicas, so the values go into a separate
-        // follow-up change that ships in the same batch.
+        // Convergent custom-id + initialValues (bulk-only): the deterministic seed
+        // change must stay byte-identical across replicas, so the values go into a
+        // separate follow-up change that ships in the same batch. Unique-by-
+        // assertion ids skip this — their values are already in doc_create.
         let finalDoc = seedDoc;
         let valueChangeBytes = null;
-        if (useCustomDocId && initialValueEntries.length > 0) {
+        if (useDeterministicSeed && initialValueEntries.length > 0) {
             finalDoc = automerge_adapter_1.Automerge.change(seedDoc, { time: now }, (doc) => {
                 for (const [key, value] of initialValueEntries) {
                     doc[key] = value;
@@ -8160,6 +8498,12 @@ class BaseMindooDB {
             if (cryptoKey) {
                 keyMap.set(publicKey, cryptoKey);
             }
+            else {
+                // Author key not (yet) trusted by the directory: the entries below
+                // will be skipped. Record the author so a later grantaccess sync
+                // can re-materialize this document (reconcileAuthorTrust).
+                this.recordPendingUntrustedAuthor(publicKey, docId);
+            }
         }
         // Verify all signatures in parallel using cached keys
         const signatureVerificationResults = await Promise.all(validEntries.map(async (entryData) => {
@@ -8959,7 +9303,14 @@ class BaseMindooDB {
             }
             // Verify the author signature over the encrypted payload.
             const cryptoKey = await this.getOrImportPublicKey(entry.createdByPublicKey);
-            if (!cryptoKey || !(await this.verifyEntrySignatureWithKey(cryptoKey, entry))) {
+            if (!cryptoKey) {
+                // Author key not (yet) trusted by the directory. Remember it so a
+                // later grantaccess sync can re-materialize the doc (reconcileAuthorTrust).
+                this.recordPendingUntrustedAuthor(entry.createdByPublicKey, docId);
+                quarantine(meta, "invalid_signature", "author key not trusted by directory");
+                continue;
+            }
+            if (!(await this.verifyEntrySignatureWithKey(cryptoKey, entry))) {
                 quarantine(meta, "invalid_signature", "signature verification failed");
                 continue;
             }
@@ -9363,6 +9714,12 @@ class BaseMindooDB {
                 if (cryptoKey) {
                     keyMap.set(publicKey, cryptoKey);
                 }
+                else {
+                    // Author key not (yet) trusted by the directory: the entries below
+                    // will be skipped. Record the author so a later grantaccess sync
+                    // can re-materialize this document (reconcileAuthorTrust).
+                    this.recordPendingUntrustedAuthor(publicKey, docId);
+                }
             }
             // Verify all signatures in parallel using cached keys
             const signatureStartedAt = Date.now();
@@ -10251,6 +10608,13 @@ class BaseMindooDB {
                 // single-flight; never blocks or fails the sync.
                 if (this.store.getId() === "directory") {
                     await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
+                    // Author-trust reconcile: refresh the directory trust caches NOW
+                    // (instead of waiting up to DIRECTORY_SYNC_INTERVAL_MS for the next
+                    // cache-miss validation) so grantaccess documents that just arrived
+                    // immediately unblock entries other open databases skipped while
+                    // the author was still unknown. Awaited so a subsequent content-DB
+                    // sync in the same flow observes the healed state.
+                    await this.tenant.reconcileAuthorTrustAfterDirectorySyncSafe();
                 }
             }
             if (options?.signal?.aborted) {