Cloud Team Collections (S3 + Supabase)

[JohnThomson]

The full Cloud Team Collections feature — a cloud backend (one S3 bucket + Supabase Postgres/edge functions) for Bloom's Team Collections, alongside the existing folder implementation — packaged as 9 dependency-ordered, review-grained commits. Replaces draft PR #8048 (same tree, byte-identical — verified by an empty git diff against the cloud-collections working branch), whose ~200 orchestration-grained commits were not reviewable.

Suggested review order = commit order:

1. Design docs, wire contracts (CONTRACTS.md v1.5), project records
2. Server: tc schema, RLS, RPCs, pgTAP (65 green)
3. Server: edge functions for the two-phase checkin/download protocols (deno tests 33 green)
4. Local dev stack (Supabase + MinIO; zero external infra)
5. C# client core: auth (Firebase Option A + dev GoTrue), API client, repo cache, S3 transfer (AWSSDK v4)
6. C# backend: CloudTeamCollection, polling monitor, progressive join, background downloads, account-switch takeover with per-collection-copy seats
7. HTTP API layer: sharing/membership/capabilities/join cards
8. React UI + XLF strings (en)
9. Playwright-over-CDP E2E harness + 10 two-instance scenarios

Review caveat: each commit is a coherent reviewable unit and the order makes most of them compile, but only the FINAL tree is test-verified (C# cloud filter 428/428, full suite green, pgTAP 65/65, deno 33/33, E2E matrix green with every scenario passing on this tree). This is the accepted trade-off; per-commit CI-green is not a goal.

Bot review history (on #8048): Greptile reviewed the full diff via the file-limit bypass, found 1 P1 (S3 credential scoping) + 2 P2s — all fixed and verified resolved by its re-review ('No new blocking issues'). Devin cannot analyze a diff this size. CI green.

Remaining before merge: John's two [HUMAN] visual checks (centered check-in dialog; real web upload/download per GOING-LIVE.md 4.3) and the OUTSTANDING BUGS #0 follow-up decision (server-side same-user cross-seat check-in) — tracked in Design/CloudTeamCollections/orchestration/DOGFOOD-BATCH-1.md.

🤖 Generated with Claude Code

Devin review

---

This change is 

[JohnThomson]

@greptile-apps review

(Claude Fable 5: regenerated packaging branch — same 9 review-grained commits, now including the 13-14 Jul dogfood fixes: member display names + CONTRACTS v1.6, identity-first book resolution, --attended launch flag, remote-rename dedup, pending-invite constraint fix. Byte-identical to cloud-collections at f5a00c1.)

[greptile-apps]

Greptile Summary

This PR implements the full Cloud Team Collections feature — a cloud backend (S3 + Supabase) for Bloom's Team Collections, alongside the existing folder implementation. It is a large, coherent addition packaged as 9 dependency-ordered commits covering server schema/RLS/RPCs, edge functions, a local dev stack, C# client core (auth, API client, repo cache, S3 transfer), the cloud backend class itself, HTTP API layer, React UI, XLF strings, and a Playwright E2E harness.

• Efficiency regen (E2–E9): download credentials are cached collection-wide instead of re-fetched per book; idle polls skip the full cache Save + index rebuild; the self-healing rename scan builds the instanceId → folder index once per poll rather than O(missing × local); the history panel fetches only new events via a cursor; collection-file downloads use a per-file manifest and pull only changed files pinned to their committed S3 version.
• Behavior changes: cloud login now persists across restarts via DPAPI (DpapiCloudTokenStore), and the "Updates Available (N)" badge now counts books checked out by other users (the latest committed version is still fetchable).

Important Files Changed

Filename	Overview
src/BloomExe/TeamCollection/Cloud/CloudTeamCollection.cs	Core cloud backend: implements GetUpdatesAvailableCount, ReceiveAllUpdates, E2–E9 optimizations, and polling. Contains a stale NOTE in ReceiveAllUpdates that contradicts both the doc comment and the code regarding which books are excluded from the badge count.
src/BloomExe/TeamCollection/Cloud/CloudBookTransfer.cs	New file: S3 upload/download with SHA-256 checksum verification, pinned version-id downloads, parallel transfer, staging-then-atomic-swap pattern, and retry logic.
src/BloomExe/TeamCollection/Cloud/CloudCollectionClient.cs	New file: RestSharp client for Supabase RPCs and edge functions with auth-retry, typed error mapping, and Newtonsoft-based serialization.
src/BloomExe/TeamCollection/Cloud/CloudRepoCache.cs	New file: thread-safe, persisted book/group cache with full/delta snapshot apply, write-through on mutations, and atomic Save via temp-then-move.
src/BloomExe/TeamCollection/Cloud/CloudAuth.cs	New file: provider-agnostic session lifecycle with proactive refresh at 80% TTL and on-demand 401 retry.
src/BloomExe/TeamCollection/Cloud/CloudTokenStore.cs	New file: DPAPI-backed persistent token store using DataProtectionScope.CurrentUser.
src/BloomBrowserUI/utils/bloomApi.ts	Adds useWatchApiDataWithReload and getApiDataOnce shared hooks. Correct caching and dep-suppression.
src/BloomBrowserUI/teamCollection/sharingApi.ts	New file: typed TS bindings for SharingApi endpoints using the new shared hooks.
src/BloomBrowserUI/teamCollection/teamCollectionApi.tsx	Adds capabilities/status-metadata/cloudCollectionId hooks with getApiDataOnce to prevent per-book re-fetches.
DistFiles/localization/en/Bloom.xlf	New XLF strings for cloud TC UI. Previously flagged double-hyphen fixed (now uses semicolon).

_{Reviews (6): Last reviewed commit: "Cloud TC E2E: Playwright-over-CDP harnes..." | Re-trigger Greptile}

[JohnThomson]

@greptile-apps review

(Claude Fable 5) Regenerated review branch: re-merged origin/master, and folded in fixes for the Devin slice-review findings (upload-race lock, cache LockedSeat/LocalVersionSeq, experimental-feature-flag token collision, blank cloud history-event label). Byte-identical to the cloud-collections working branch.

[JohnThomson]

@greptile-apps review

(Claude Fable 5) Regenerated after a fresh-eyes review pass over yesterday's fixes: hardened the remote-rename guard (now keyed to the authoritative repo lock, so a checked-out-and-renamed book can't be reverted/clobbered at startup), display-name cache now invalidates on account switch, and the run.sh freshness check uses build outputs that incremental builds actually touch. Regeneration scripts now live in-repo (Design/CloudTeamCollections/orchestration/regen-*.sh). Byte-identical to cloud-collections.

[JohnThomson]

@greptile-apps review

(Claude Fable 5) Regenerated after a documentation cleanup: removed 13 spent orchestration scratch files (one-time agent launch prompts, an implemented design sketch, stale scouting notes) — the diff shrinks from 256 to 243 files. The durable docs (design, CONTRACTS, GOING-LIVE deploy plan, task specs, state log, regeneration procedure) are unchanged. No code changes beyond three comment pointers in the e2e harness. Byte-identical to cloud-collections.

[JohnThomson]

@greptile-apps review

(Claude Code, Opus 4.8) Regenerated after applying the /simplify quality-review pass across the whole branch — intended as no behavior change:

• C#: dead-API removal + reuse consolidation (duplicate S3 client → CloudBookTransfer.BuildDefaultClient; manual S3 pagination → S3Extensions.ListAllObjects; hoisted AvailablePath reuse; localManifest hash-reuse in UploadChangedFiles with a new pinning test).
• C# file-org (pure relocation): CloudTeamCollection.CollectionFiles.cs + TeamCollection.AutoApply.cs partials, Dev/FirebaseCloudAuthProvider split out of CloudAuth.cs, and HandleReceiveUpdates' loop → CloudTeamCollection.ReceiveAllUpdates.
• Front-end: shared testRender helper + extracted cloud sign-in dialog. Edge functions: shared _shared/paths.ts + S3 upload-verify. Launchers: shared process-tree / automation-ready helpers.

Verification: C# required filter 442/442, vitest + deno green. One item worth a look: ReceiveAllUpdates intentionally keeps its original which-books predicate (skips checked-out-here), which differs from GetUpdatesAvailableCount (excludes locked-by-anyone) — documented inline, not unified.

[greptile-apps]

Too many files changed for review. (253 files found, 100 file limit)

Bypass the limit by tagging @greptile-apps to review.

[JohnThomson]

@greptile-apps review

(Claude Code, Opus 4.8) Regenerated after merging current origin/master into the branch and applying the remaining deferred efficiency/refactor items. Byte-identical to cloud-collections (the regen-rebuild identity check passes).

Backend efficiency (no behavior change):

• E2 — cache the collection-scoped S3 download credentials and reuse them across books, instead of re-fetching per book (big win during a join).
• E8 — the history panel now fetches only new events via the get_changes cursor and merges, instead of re-fetching the whole log on every open.
• E9 — collection-file group download fetches a per-file manifest (get_collection_file_manifest) and downloads only the files whose content changed, each pinned to its committed S3 version — consistent snapshot, no redundant re-downloads.
• E7 — the per-poll "self-healing" rename scan builds the instanceId → local-folder index once per poll and reuses it, so it is O(missing + local) instead of O(missing × local) disk stats.
• E3 — idle polls (no new events, cursor unchanged) skip the full repo-cache Save + index rebuild; the group-file check and the self-healing download pass still run every poll.

Behavior changes (intentional, decided with John):

• Cloud login now persists (DpapiCloudTokenStore) so a real sign-in survives a Bloom restart.
• The "Updates Available (N)" count now includes books currently checked out by others (fetching their latest committed version is still useful).

Test-only refactors (no production change):

• Shared CloudTestHarness fixture builder across the cloud unit tests.
• Shared front-end hooks: useWatchApiDataWithReload and getApiDataOnce (dedup of the reload/cached-promise idioms in sharingApi/teamCollectionApi).

Verification: cloud/TC C# filter 453/453; front-end consumer vitest 38/38; pgTAP/deno green earlier this cycle; live e2e-1/e2e-2 previously passed.