mindoodb 0.0.72 → 0.0.74

package/dist/core/BaseMindooTenant.d.ts

@@ -50,11 +50,12 @@ export declare class BaseMindooTenant implements MindooTenant {
      */
     private unsubscribeKeyBagChanges;
     /**
-     * Single-flight latch for {@link reconcileKeyBagChanges}. Concurrent calls
-     * coalesce onto the same in-flight reconcile so live listener firings and
-     * explicit calls cannot race against each other or duplicate work.
+     * Single-flight for {@link reconcileKeyBagChanges}. Concurrent calls
+     * coalesce so live listener firings and explicit calls cannot race; a call
+     * arriving mid-run gets one follow-up run, so a KeyBag change made while
+     * databases were being reconciled is not left unconsumed.
      */
-    private keyBagReconcilePromise;
+    private readonly keyBagReconcile;
     private decryptedTenantKeyCache?;
     private decryptedUserSigningKeyCache?;
     private decryptedUserEncryptionKeyCache?;
@@ -74,8 +75,10 @@ export declare class BaseMindooTenant implements MindooTenant {
     private readonly importedVerifyKeyCache;
     private static readonly MAX_IMPORTED_KEY_CACHE_ENTRIES;
     private logger;
-    private reconcileInFlight;
+    private readonly keyDistributionReconcile;
     private userKeyReconcileScheduled;
+    /** Fire-and-forget work of this tenant; see {@link whenBackgroundIdle}. */
+    private readonly backgroundTasks;
     private readonly userKeys;
     private readonly sealedGenerations;
     private cacheManager;
@@ -134,6 +137,19 @@ export declare class BaseMindooTenant implements MindooTenant {
      * unbounded-allocates.
      */
     scheduleUserKeyReconcile(): void;
+    /**
+     * Register fire-and-forget work so {@link whenBackgroundIdle} and shutdown
+     * wait for it. The task must handle its own errors.
+     */
+    trackBackgroundTask(task: Promise<unknown>): void;
+    /**
+     * Resolve once neither this tenant nor any of its open databases has
+     * background work left (trust/key reconciles, auto-follow catch-ups,
+     * pending change events), including work that finishing tasks start.
+     *
+     * @internal Shutdown and test hook.
+     */
+    whenBackgroundIdle(): Promise<void>;
     noteUserDirectoryFetched(): void;
     noteUserDirectoryFetchFailed(error: unknown): void;
     listPendingUserKeyDevices(): Promise<PendingUserKeyDevice[]>;
@@ -292,6 +308,22 @@ export declare class BaseMindooTenant implements MindooTenant {
      * cutoffs in ascending order.
      */
     listTimeTravelCacheDates(dbId: string): Promise<number[]>;
+    /**
+     * Ids of the documents an admin-signed purge request removed from `dbId`
+     * (see {@link MindooTenant.getPurgedDocumentIds}). Read from the local
+     * directory; empty for the directory itself.
+     */
+    getPurgedDocumentIds(dbId: string): Promise<ReadonlySet<string>>;
+    /**
+     * After a document's history was purged from a live database: scrub it from
+     * every open time-travel snapshot of that database, and drop the persisted
+     * snapshot caches, which hold materialized plaintext, summaries and full-text
+     * tokens of the document as of their cutoffs. Those caches are rebuilt on the
+     * next open.
+     *
+     * @internal Called by {@link BaseMindooDB.purgeDocumentHistory}.
+     */
+    forgetPurgedDocumentInSnapshots(dbId: string, docId: string): Promise<void>;
     /**
      * Remove every persisted cache record of a time-travel snapshot (see
      * {@link MindooTenant.purgeTimeTravelCache}). Deletes all records whose id
@@ -309,12 +341,14 @@ export declare class BaseMindooTenant implements MindooTenant {
      * Designed as the single barrier callers can `await` to be certain that
      * subsequent reads observe the latest add/remove of doc keys. Behaviour:
      *
-     *  - Idempotent and concurrency-safe. Concurrent callers share the same
-     *    in-flight reconcile via {@link keyBagReconcilePromise}, and a second
-     *    call after the cursor catches up is a fast no-op.
+     *  - Idempotent and concurrency-safe. Concurrent callers share one run;
+     *    a call arriving mid-run gets one follow-up run (see
+     *    {@link keyBagReconcile}), and a call after the cursor catches up is a
+     *    fast no-op.
      *  - Cursor-based. Replays from the persisted cursor in
      *    {@link keyBagChangeCursor}, so missed live notifications are
-     *    automatically recovered.
+     *    automatically recovered. The cursor advances only after every open
+     *    database was reconciled, so a failed run is retried by the next call.
      *  - Tenant-scoped. Events for other tenants in a shared KeyBag are
      *    consumed (the cursor still advances) but ignored.
      *  - Invalidates the cached tenant default key when its add/remove was
@@ -323,6 +357,7 @@ export declare class BaseMindooTenant implements MindooTenant {
      *    cuts and never participate in visibility reconciliation.
      */
     reconcileKeyBagChanges(): Promise<void>;
+    private runKeyBagReconcile;
     /**
      * Author-trust reconcile across all open live databases: when the tenant
      * directory learns about new trusted signing keys (grantaccess documents
@@ -502,9 +537,8 @@ export declare class BaseMindooTenant implements MindooTenant {
      * Single-flight, best-effort wrapper around
      * {@link reconcileKeyDistributionsForCurrentUser} for the run-always trigger
      * (docs/accesscontrol.md §13). Fired on directory bring-up and after every
-     * directory pull. Never throws and never blocks sync: a reconcile error is
-     * logged and swallowed. The in-flight guard prevents the driver's own
-     * directory access from re-triggering it.
+     * directory pull. Never throws: a reconcile error is logged and swallowed.
+     * Resolves after a run that started after this call.
      */
     reconcileKeyDistributionsForCurrentUserSafe(): Promise<void>;
     /**

package/dist/core/BaseMindooTenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EACzB,sBAAsB,EAEtB,sBAAsB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAG/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,oBAAoB,CAA6C;IACzE,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAA8B;IAG5D,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,yBAAyB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IAGrE,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;QAC/B,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC;IA2EH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,qBAAqB,IAAI,aAAa;IAItC,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,IAAI,cAAc;IAInC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIrC,qGAAqG;IACrG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAUhC,wBAAwB,IAAI,IAAI;IAIhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI5C,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI5D,kBAAkB,IAAI,OAAO,CAAC,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAI5E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI5F,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC,0BAA0B,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI9D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI;IAIzE,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE;IAI3C,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDjF,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,IAAI,CAAC;IAOhB,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA+B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8GjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsDhG;;;;;;;;OAQG;YACW,0BAA0B;IAYlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB3D;;;;;;;;;;;OAWG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMrF;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAiBb,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAwDhB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAgDlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;IAyElC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;YAuDtD,cAAc;IAqE5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAMlC;IAEX;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/D;;;;;;;;OAQG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD/F;;;;;;;;;;;;;;;;;;;OAmBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmD7C;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxF;;;;OAIG;IACG,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5F;;;;;;OAMG;IACG,0CAA0C,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAqB9C,OAAO,CAAC,4BAA4B;IAMpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiQtH;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0GzF,OAAO,CAAC,eAAe;YAmBT,mBAAmB;YAqEnB,iCAAiC;IAsC/C;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,EACrC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IA4EjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IA0BvB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gFAAgF;QAChF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA4DF;;;;OAIG;YACW,gCAAgC;IA6B9C;;;;;;;OAOG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAclE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;;OAQG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAIpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}
+{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EACzB,sBAAsB,EAEtB,sBAAsB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAG/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,oBAAoB,CAA6C;IACzE,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqD;IAGrF,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAMtC;IACH,OAAO,CAAC,yBAAyB,CAAS;IAC1C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IAGrE,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;QAC/B,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC;IA+EH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,qBAAqB,IAAI,aAAa;IAItC,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,IAAI,cAAc;IAInC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIrC,qGAAqG;IACrG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAYhC;;;OAGG;IACH,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAIjD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAezC,wBAAwB,IAAI,IAAI;IAIhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI5C,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI5D,kBAAkB,IAAI,OAAO,CAAC,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAI5E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI5F,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC,0BAA0B,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI9D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI;IAIzE,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE;IAI3C,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDjF,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,IAAI,CAAC;IAOhB,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA+B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8GjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsDhG;;;;;;;;OAQG;YACW,0BAA0B;IAYlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB3D;;;;;;;;;;;OAWG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMrF;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAiBb,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAwDhB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAgDlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;IAyElC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;YAuDtD,cAAc;IAqE5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAMlC;IAEX;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/D;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmBtE;;;;;;;;OAQG;IACG,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI/B,kBAAkB;IAsChC;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxF;;;;OAIG;IACG,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5F;;;;;;OAMG;IACG,0CAA0C,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAqB9C,OAAO,CAAC,4BAA4B;IAMpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiQtH;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0GzF,OAAO,CAAC,eAAe;YAmBT,mBAAmB;YAqEnB,iCAAiC;IAsC/C;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,EACrC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IA4EjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IA0BvB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gFAAgF;QAChF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA4DF;;;;OAIG;YACW,gCAAgC;IA6B9C;;;;;;OAMG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;;OAQG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAIpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}

package/dist/core/BaseMindooTenant.js

@@ -30,6 +30,8 @@ const joinRequestUri_1 = require("./uri/joinRequestUri");
 const EncryptedLocalCacheStore_1 = require("./cache/EncryptedLocalCacheStore");
 const CacheManager_1 = require("./cache/CacheManager");
 const databaseIdValidation_1 = require("./databaseIdValidation");
+const BackgroundTaskTracker_1 = require("./BackgroundTaskTracker");
+const singleFlight_1 = require("./utils/singleFlight");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -73,11 +75,12 @@ class BaseMindooTenant {
          */
         this.unsubscribeKeyBagChanges = null;
         /**
-         * Single-flight latch for {@link reconcileKeyBagChanges}. Concurrent calls
-         * coalesce onto the same in-flight reconcile so live listener firings and
-         * explicit calls cannot race against each other or duplicate work.
+         * Single-flight for {@link reconcileKeyBagChanges}. Concurrent calls
+         * coalesce so live listener firings and explicit calls cannot race; a call
+         * arriving mid-run gets one follow-up run, so a KeyBag change made while
+         * databases were being reconciled is not left unconsumed.
          */
-        this.keyBagReconcilePromise = null;
+        this.keyBagReconcile = new singleFlight_1.SingleFlight(() => this.runKeyBagReconcile());
         /**
          * Cache of imported AES-GCM `CryptoKey`s, keyed by usage + raw key bytes
          * (hex). `subtle.importKey` costs a WebCrypto round trip per call, which
@@ -92,14 +95,23 @@ class BaseMindooTenant {
          * documents, so the per-call SPKI import is on the hot read path.
          */
         this.importedVerifyKeyCache = new Map();
-        // Single-flight guard for SDK-driven key-distribution reconcile (§13). The
-        // reconcile driver itself calls getDirectoryDB / updateUnifiedCache /
-        // syncStoreChanges, any of which can re-enter a trigger; this flag keeps the
-        // run-always trigger (directory bring-up + after each directory pull) from
-        // recursing or overlapping. Reconcile is idempotent, so a skipped overlap is
-        // harmless — the next trigger re-runs it.
-        this.reconcileInFlight = false;
+        // Single-flight for the SDK-driven key-distribution reconcile (§13), fired on
+        // directory bring-up and after each directory pull. A trigger arriving
+        // mid-run (e.g. a pull that brought a new distribution) gets one follow-up
+        // run instead of being dropped. The driver's own re-trigger (directory
+        // bring-up inside getDirectoryDB) is fire-and-forget, never awaited inside
+        // the run, so it queues a follow-up rather than waiting for itself.
+        this.keyDistributionReconcile = new singleFlight_1.SingleFlight(async () => {
+            try {
+                await this.reconcileKeyDistributionsForCurrentUser();
+            }
+            catch (error) {
+                this.logger.warn(`reconcileKeyDistributionsForCurrentUserSafe: ${error}`);
+            }
+        });
         this.userKeyReconcileScheduled = false;
+        /** Fire-and-forget work of this tenant; see {@link whenBackgroundIdle}. */
+        this.backgroundTasks = new BackgroundTaskTracker_1.BackgroundTaskTracker();
         this.userKeys = new UserKeyManager_1.UserKeyManager(this);
         this.sealedGenerations = new Map();
         // Local cache support
@@ -136,7 +148,9 @@ class BaseMindooTenant {
             // Fire-and-forget: errors are surfaced via the reconcile path itself.
             // We intentionally do not await here to keep the mutation call site
             // synchronous from the listener's perspective.
-            void this.reconcileKeyBagChanges();
+            this.trackBackgroundTask(this.reconcileKeyBagChanges().catch((error) => {
+                this.logger.warn(`reconcileKeyBagChanges: ${error}`);
+            }));
         });
         // Pre-warm the per-user CryptoKey caches so getDecryptedSigningKey()
         // and getDecryptedEncryptionKey() never run PBKDF2 + decryptPrivateKey
@@ -191,6 +205,9 @@ class BaseMindooTenant {
         // times - the disposer is nulled out after the first call.
         this.unsubscribeKeyBagChanges?.();
         this.unsubscribeKeyBagChanges = null;
+        // Background catch-ups write into the cache; let them finish before the
+        // final flush instead of racing the teardown.
+        await this.whenBackgroundIdle();
         if (this.cacheManager) {
             await this.cacheManager.dispose();
             this.cacheManager = null;
@@ -235,12 +252,40 @@ class BaseMindooTenant {
         if (this.userKeys.isReconciling() || this.userKeyReconcileScheduled)
             return;
         this.userKeyReconcileScheduled = true;
-        queueMicrotask(() => {
+        this.trackBackgroundTask(Promise.resolve().then(() => {
             this.userKeyReconcileScheduled = false;
             if (this.userKeys.isReconciling())
                 return;
-            void this.reconcileUserKeysSafe();
-        });
+            return this.reconcileUserKeysSafe();
+        }));
+    }
+    /**
+     * Register fire-and-forget work so {@link whenBackgroundIdle} and shutdown
+     * wait for it. The task must handle its own errors.
+     */
+    trackBackgroundTask(task) {
+        this.backgroundTasks.run(task);
+    }
+    /**
+     * Resolve once neither this tenant nor any of its open databases has
+     * background work left (trust/key reconciles, auto-follow catch-ups,
+     * pending change events), including work that finishing tasks start.
+     *
+     * @internal Shutdown and test hook.
+     */
+    async whenBackgroundIdle() {
+        for (;;) {
+            let waited = await this.backgroundTasks.settle();
+            for (const db of Array.from(this.databaseCache.values())) {
+                const idle = db.whenBackgroundIdle;
+                if (idle && (await idle.call(db))) {
+                    waited = true;
+                }
+            }
+            if (!waited) {
+                return;
+            }
+        }
     }
     noteUserDirectoryFetched() {
         this.userKeys.noteUserDirectoryFetched();
@@ -1078,6 +1123,49 @@ class BaseMindooTenant {
         }
         return Array.from(cutoffs).sort((a, b) => a - b);
     }
+    /**
+     * Ids of the documents an admin-signed purge request removed from `dbId`
+     * (see {@link MindooTenant.getPurgedDocumentIds}). Read from the local
+     * directory; empty for the directory itself.
+     */
+    async getPurgedDocumentIds(dbId) {
+        const purged = new Set();
+        if (dbId === "directory") {
+            return purged;
+        }
+        const directory = await this.openDirectory();
+        for (const request of await directory.getRequestedDocHistoryPurges()) {
+            if (request.dbId !== dbId || !Array.isArray(request.docIds)) {
+                continue;
+            }
+            for (const docId of request.docIds) {
+                if (typeof docId === "string" && docId.length > 0) {
+                    purged.add(docId);
+                }
+            }
+        }
+        return purged;
+    }
+    /**
+     * After a document's history was purged from a live database: scrub it from
+     * every open time-travel snapshot of that database, and drop the persisted
+     * snapshot caches, which hold materialized plaintext, summaries and full-text
+     * tokens of the document as of their cutoffs. Those caches are rebuilt on the
+     * next open.
+     *
+     * @internal Called by {@link BaseMindooDB.purgeDocumentHistory}.
+     */
+    async forgetPurgedDocumentInSnapshots(dbId, docId) {
+        const snapshotKeyPrefix = `${dbId}::tt:`;
+        for (const [key, db] of this.databaseCache) {
+            if (key.startsWith(snapshotKeyPrefix)) {
+                await db.forgetPurgedDocument(docId);
+            }
+        }
+        for (const cutoff of await this.listTimeTravelCacheDates(dbId)) {
+            await this.purgeTimeTravelCache(dbId, cutoff);
+        }
+    }
     /**
      * Remove every persisted cache record of a time-travel snapshot (see
      * {@link MindooTenant.purgeTimeTravelCache}). Deletes all records whose id
@@ -1138,12 +1226,14 @@ class BaseMindooTenant {
      * Designed as the single barrier callers can `await` to be certain that
      * subsequent reads observe the latest add/remove of doc keys. Behaviour:
      *
-     *  - Idempotent and concurrency-safe. Concurrent callers share the same
-     *    in-flight reconcile via {@link keyBagReconcilePromise}, and a second
-     *    call after the cursor catches up is a fast no-op.
+     *  - Idempotent and concurrency-safe. Concurrent callers share one run;
+     *    a call arriving mid-run gets one follow-up run (see
+     *    {@link keyBagReconcile}), and a call after the cursor catches up is a
+     *    fast no-op.
      *  - Cursor-based. Replays from the persisted cursor in
      *    {@link keyBagChangeCursor}, so missed live notifications are
-     *    automatically recovered.
+     *    automatically recovered. The cursor advances only after every open
+     *    database was reconciled, so a failed run is retried by the next call.
      *  - Tenant-scoped. Events for other tenants in a shared KeyBag are
      *    consumed (the cursor still advances) but ignored.
      *  - Invalidates the cached tenant default key when its add/remove was
@@ -1152,34 +1242,30 @@ class BaseMindooTenant {
      *    cuts and never participate in visibility reconciliation.
      */
     async reconcileKeyBagChanges() {
-        if (this.keyBagReconcilePromise) {
-            return this.keyBagReconcilePromise;
-        }
-        this.keyBagReconcilePromise = (async () => {
-            let sawTenantDocKeyChange = false;
-            let latestCursor = this.keyBagChangeCursor;
-            // Consume every pending event so the cursor advances even for
-            // unrelated tenants sharing the same bag. We only need to react to
-            // doc keys for our own tenant though.
-            for await (const event of this.keyBag.iterateChangesSince(this.keyBagChangeCursor)) {
-                latestCursor = { changeSeq: event.changeSeq };
-                if (event.type !== "doc" || event.tenantId !== this.tenantId) {
-                    continue;
-                }
-                sawTenantDocKeyChange = true;
-                if (event.keyId === types_1.DEFAULT_TENANT_KEY_ID) {
-                    // The cached plaintext default key may now refer to a rotated
-                    // or removed version; drop it so the next access re-resolves.
-                    this.decryptedTenantKeyCache = undefined;
-                }
+        return this.keyBagReconcile.run();
+    }
+    async runKeyBagReconcile() {
+        let sawTenantDocKeyChange = false;
+        let latestCursor = this.keyBagChangeCursor;
+        // Consume every pending event so the cursor advances even for
+        // unrelated tenants sharing the same bag. We only need to react to
+        // doc keys for our own tenant though.
+        for await (const event of this.keyBag.iterateChangesSince(this.keyBagChangeCursor)) {
+            latestCursor = { changeSeq: event.changeSeq };
+            if (event.type !== "doc" || event.tenantId !== this.tenantId) {
+                continue;
             }
-            this.keyBagChangeCursor = latestCursor;
-            if (!sawTenantDocKeyChange) {
-                return;
+            sawTenantDocKeyChange = true;
+            if (event.keyId === types_1.DEFAULT_TENANT_KEY_ID) {
+                // The cached plaintext default key may now refer to a rotated
+                // or removed version; drop it so the next access re-resolves.
+                this.decryptedTenantKeyCache = undefined;
             }
+        }
+        if (sawTenantDocKeyChange) {
             // Notify every open live database; time-travel views are read-only
             // historical snapshots and intentionally skip reconciliation.
-            for (const db of this.databaseCache.values()) {
+            for (const db of Array.from(this.databaseCache.values())) {
                 if (db.isTimeTravelMode()) {
                     continue;
                 }
@@ -1188,13 +1274,8 @@ class BaseMindooTenant {
                     await reconcile.call(db);
                 }
             }
-        })();
-        try {
-            await this.keyBagReconcilePromise;
-        }
-        finally {
-            this.keyBagReconcilePromise = null;
         }
+        this.keyBagChangeCursor = latestCursor;
     }
     /**
      * Author-trust reconcile across all open live databases: when the tenant
@@ -2024,24 +2105,11 @@ class BaseMindooTenant {
      * Single-flight, best-effort wrapper around
      * {@link reconcileKeyDistributionsForCurrentUser} for the run-always trigger
      * (docs/accesscontrol.md §13). Fired on directory bring-up and after every
-     * directory pull. Never throws and never blocks sync: a reconcile error is
-     * logged and swallowed. The in-flight guard prevents the driver's own
-     * directory access from re-triggering it.
+     * directory pull. Never throws: a reconcile error is logged and swallowed.
+     * Resolves after a run that started after this call.
      */
     async reconcileKeyDistributionsForCurrentUserSafe() {
-        if (this.reconcileInFlight) {
-            return;
-        }
-        this.reconcileInFlight = true;
-        try {
-            await this.reconcileKeyDistributionsForCurrentUser();
-        }
-        catch (error) {
-            this.logger.warn(`reconcileKeyDistributionsForCurrentUserSafe: ${error}`);
-        }
-        finally {
-            this.reconcileInFlight = false;
-        }
+        await this.keyDistributionReconcile.run();
     }
     /**
      * Export **all** stored versions of a document key for an admin-blind key