@fonoster/callrecord 0.0.0-stage → 0.27.0

package/dist/CallRecordWriter.d.ts

@@ -0,0 +1,135 @@
+import { RecordIndexEntry } from "./indexEntry";
+import { KeyCustody } from "./keys";
+import { SigningKey } from "./sign";
+import { FsWorkingStore, RecordStore } from "./storage";
+import { RecordEntry, SealingVersion } from "./types";
+/** Call-record open question O1: a record is sealed within 30 s of hangup. */
+export declare const SEAL_DEADLINE_MS = 30000;
+/** Parts a retention policy or a deletion request can name (call-record "Retention"). */
+export declare const RECORD_PARTS: readonly ["recording", "transcript", "messages"];
+export type RecordPart = (typeof RECORD_PARTS)[number];
+/** A maintenance request named another workspace than the stored record's (RV-B6). */
+export declare class WorkspaceMismatchError extends Error {
+    constructor(callRef: string);
+}
+/** One audited deletion (call-record "every deletion ... produces an audit entry"). */
+export type AuditEntry = {
+    callRef: string;
+    workspaceRef: string | null;
+    action: "delete_part" | "erase";
+    part: RecordPart | "all";
+    reason: string;
+    actor: string;
+    at: string;
+    /** The version that records the deletion. */
+    version: number;
+};
+export type CallRecordWriterOptions = {
+    working: FsWorkingStore;
+    /** The region's record store. */
+    store: RecordStore;
+    /**
+     * A workspace's own bucket, if it configured one (design V2). When it fails at seal the record
+     * stays in the region store and the index says so (open question O7, interim).
+     */
+    workspaceStore?: (workspaceRef: string) => RecordStore | undefined;
+    /** A fixed key, or a custody that names the current key and signs (task 2.6). */
+    key: SigningKey | KeyCustody;
+    region: string;
+    /** Called after each sealed version: index it, send `call_record.sealed`. */
+    onSealed?: (entry: RecordIndexEntry) => void;
+    /**
+     * How often this writer marks its live calls' working records as alive (ST-5), so a writer
+     * sweeping the same directory leaves them alone. Well under the sweep's deadline.
+     */
+    heartbeatMs?: number;
+};
+/**
+ * Builds call records live and seals them at hangup (call-record "The record is built during the
+ * call and sealed at hangup"). It implements the gateway's CallRecordSink interface.
+ */
+export declare class CallRecordWriter {
+    private readonly options;
+    /** Calls appended in this process and not closed yet; the sweep leaves them alone. */
+    private readonly active;
+    private readonly sealing;
+    private readonly custody;
+    /** Names this writer in seal locks on a shared working directory. */
+    private readonly owner;
+    private heartbeat?;
+    constructor(options: CallRecordWriterOptions);
+    get region(): string;
+    append(callRef: string, entry: RecordEntry): void;
+    /** Marks every live call of this writer as alive (see `heartbeatMs`). */
+    beat(): void;
+    /** Stops the heartbeat (shutdown; a writer that dies stops it too). */
+    stop(): void;
+    /** Where the recorder writes this call's tracks (removed once the record is sealed). */
+    recordingDir(callRef: string): string;
+    /** The call ended: seal its record in the background. */
+    close(callRef: string): void;
+    /** Resolves once every seal in progress has finished (tests, shutdown). */
+    flush(): Promise<void>;
+    /** The store a workspace's records go to. */
+    storeFor(workspaceRef?: string | null): RecordStore;
+    /**
+     * The store that holds an existing record. With its indexed location (RV-B10) that is the
+     * store at that location: a record whose workspace bucket failed at seal stays in the region
+     * store, and a workspace that configured a bucket later keeps its older records where they
+     * are. Without a location, the workspace's current store.
+     */
+    storeAt(location: string | undefined, workspaceRef?: string | null): RecordStore;
+    /** Seals a working record as version 1 and returns it; idempotent while in progress. */
+    seal(callRef: string): Promise<SealingVersion>;
+    /** The sealed version 1 another writer stored, once its seal lock is gone. */
+    private sealedByOther;
+    /**
+     * Seals under a lock in the working directory, so of all the writers that share it exactly one
+     * seals a call (its hangup on the owner, or a sweep elsewhere), once (ST-5).
+     */
+    private doSeal;
+    private sealLocked;
+    private sealed;
+    /**
+     * Seals records whose calls stopped appending more than `deadlineMs` ago without a hangup (a
+     * gateway that crashed). Returns the callRefs sealed.
+     */
+    sweep(now?: number, deadlineMs?: number): Promise<string[]>;
+    /** Adds a version derived from the current one (it references its predecessor). */
+    private newVersion;
+    /**
+     * Adds to a sealed record as a new version that references its predecessor (call-record
+     * "Additions after sealing create new versions"); the previous version is unchanged.
+     */
+    addVersion(callRef: string, additions: {
+        analysis?: Record<string, unknown>[];
+    }, workspaceRef?: string, location?: string): Promise<SealingVersion>;
+    /**
+     * Deletes parts of a record (retention policy or a request) and writes a version that records
+     * each removal (call-record "Retention follows workspace policy and deletions are audited").
+     * The recording and the messages are files; the transcript lives inside the vCons, so earlier
+     * versions' contents are deleted too and only their manifests remain.
+     */
+    deleteParts(callRef: string, requested: RecordPart[], by: {
+        reason: string;
+        actor: string;
+        workspaceRef?: string | null;
+        location?: string;
+    }): Promise<{
+        sealed: SealingVersion;
+        audit: AuditEntry[];
+    }>;
+    /**
+     * Erases one call (call-record "Erasing one call"): every file and version is deleted, and a
+     * signed tombstone version states when, why and by whom. It holds no call content.
+     */
+    erase(callRef: string, by: {
+        reason: string;
+        actor: string;
+        workspaceRef?: string | null;
+        location?: string;
+    }): Promise<{
+        audit: AuditEntry[];
+        version: number;
+    }>;
+}

package/dist/CallRecordWriter.js

@@ -0,0 +1,545 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallRecordWriter = exports.WorkspaceMismatchError = exports.RECORD_PARTS = exports.SEAL_DEADLINE_MS = void 0;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const crypto_1 = require("crypto");
+const path = __importStar(require("path"));
+const logger_1 = require("@fonoster/logger");
+const indexEntry_1 = require("./indexEntry");
+const keys_1 = require("./keys");
+const recording_1 = require("./recording");
+const sign_1 = require("./sign");
+const vcon_1 = require("./vcon");
+const logger = (0, logger_1.getLogger)({ service: "callrecord", filePath: __filename });
+/** Call-record open question O1: a record is sealed within 30 s of hangup. */
+exports.SEAL_DEADLINE_MS = 30000;
+/** Parts a retention policy or a deletion request can name (call-record "Retention"). */
+exports.RECORD_PARTS = ["recording", "transcript", "messages"];
+/** A maintenance request named another workspace than the stored record's (RV-B6). */
+class WorkspaceMismatchError extends Error {
+    constructor(callRef) {
+        super(`record ${callRef} belongs to another workspace`);
+        this.name = "WorkspaceMismatchError";
+    }
+}
+exports.WorkspaceMismatchError = WorkspaceMismatchError;
+/**
+ * Refuses a change when the caller named a workspace that is not the stored record's. Callers
+ * that do not name one (in-region jobs) are not checked; maintenance requests always name one.
+ */
+function assertSameWorkspace(callRef, stored, expected) {
+    if (expected === undefined)
+        return;
+    const actual = stored ? workspaceOfVcon(stored) : null;
+    if ((actual !== null && actual !== void 0 ? actual : null) !== (expected !== null && expected !== void 0 ? expected : null))
+        throw new WorkspaceMismatchError(callRef);
+}
+/** How long a sealer waits for another writer's seal of the same call. */
+const OTHER_SEAL_WAIT_MS = 120000;
+/**
+ * Builds call records live and seals them at hangup (call-record "The record is built during the
+ * call and sealed at hangup"). It implements the gateway's CallRecordSink interface.
+ */
+class CallRecordWriter {
+    constructor(options) {
+        this.options = options;
+        /** Calls appended in this process and not closed yet; the sweep leaves them alone. */
+        this.active = new Set();
+        this.sealing = new Map();
+        /** Names this writer in seal locks on a shared working directory. */
+        this.owner = (0, crypto_1.randomUUID)();
+        this.custody = (0, keys_1.isKeyCustody)(options.key)
+            ? options.key
+            : new keys_1.StaticKeyCustody(options.key);
+    }
+    get region() {
+        return this.options.region;
+    }
+    append(callRef, entry) {
+        var _a, _b, _c, _d;
+        this.active.add(callRef);
+        this.options.working.append(callRef, entry);
+        (_a = this.heartbeat) !== null && _a !== void 0 ? _a : (this.heartbeat = setInterval(() => this.beat(), (_b = this.options.heartbeatMs) !== null && _b !== void 0 ? _b : 5000));
+        (_d = (_c = this.heartbeat).unref) === null || _d === void 0 ? void 0 : _d.call(_c);
+    }
+    /** Marks every live call of this writer as alive (see `heartbeatMs`). */
+    beat() {
+        for (const callRef of this.active)
+            this.options.working.touch(callRef);
+        if (!this.active.size && this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = undefined;
+        }
+    }
+    /** Stops the heartbeat (shutdown; a writer that dies stops it too). */
+    stop() {
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+    }
+    /** Where the recorder writes this call's tracks (removed once the record is sealed). */
+    recordingDir(callRef) {
+        return this.options.working.recordingDir(callRef);
+    }
+    /** The call ended: seal its record in the background. */
+    close(callRef) {
+        this.active.delete(callRef);
+        void this.seal(callRef).catch((e) => logger.error(`could not seal ${callRef}: ${e.message}`));
+    }
+    /** Resolves once every seal in progress has finished (tests, shutdown). */
+    flush() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield Promise.allSettled([...this.sealing.values()]);
+        });
+    }
+    /** The store a workspace's records go to. */
+    storeFor(workspaceRef) {
+        var _a, _b;
+        return ((workspaceRef && ((_b = (_a = this.options).workspaceStore) === null || _b === void 0 ? void 0 : _b.call(_a, workspaceRef))) ||
+            this.options.store);
+    }
+    /**
+     * The store that holds an existing record. With its indexed location (RV-B10) that is the
+     * store at that location: a record whose workspace bucket failed at seal stays in the region
+     * store, and a workspace that configured a bucket later keeps its older records where they
+     * are. Without a location, the workspace's current store.
+     */
+    storeAt(location, workspaceRef) {
+        var _a, _b;
+        if (!location)
+            return this.storeFor(workspaceRef);
+        const candidates = [
+            workspaceRef ? (_b = (_a = this.options).workspaceStore) === null || _b === void 0 ? void 0 : _b.call(_a, workspaceRef) : undefined,
+            this.options.store
+        ];
+        const found = candidates.find((s) => s && s.location === location);
+        if (!found)
+            throw new Error(`no record store at ${location}`);
+        return found;
+    }
+    /** Seals a working record as version 1 and returns it; idempotent while in progress. */
+    seal(callRef) {
+        const inProgress = this.sealing.get(callRef);
+        if (inProgress)
+            return inProgress;
+        const p = this.doSeal(callRef).finally(() => this.sealing.delete(callRef));
+        this.sealing.set(callRef, p);
+        return p;
+    }
+    /** The sealed version 1 another writer stored, once its seal lock is gone. */
+    sealedByOther(callRef) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { working } = this.options;
+            const end = Date.now() + OTHER_SEAL_WAIT_MS;
+            while (working.isSealLocked(callRef) && Date.now() < end)
+                yield new Promise((r) => setTimeout(r, 200));
+            const entries = working.readWorking(callRef);
+            const existing = yield this.storeFor(workspaceOf(entries)).getVersion(callRef);
+            if (!(existing === null || existing === void 0 ? void 0 : existing.signed) || !existing.redacted)
+                throw new Error(`${callRef} is being sealed by another writer`);
+            return {
+                version: existing.version,
+                signed: existing.signed,
+                redacted: existing.redacted,
+                parts: existing.manifest.parts.map((p) => (Object.assign(Object.assign({}, p), { stored: true })))
+            };
+        });
+    }
+    /**
+     * Seals under a lock in the working directory, so of all the writers that share it exactly one
+     * seals a call (its hangup on the owner, or a sweep elsewhere), once (ST-5).
+     */
+    doSeal(callRef) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { working } = this.options;
+            if (!working.lockSeal(callRef, this.owner))
+                return this.sealedByOther(callRef);
+            try {
+                return yield this.sealLocked(callRef);
+            }
+            finally {
+                working.unlockSeal(callRef, this.owner);
+            }
+        });
+    }
+    sealLocked(callRef) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { working, region } = this.options;
+            const entries = working.readWorking(callRef);
+            const workspaceRef = workspaceOf(entries);
+            let store = this.storeFor(workspaceRef);
+            const existing = yield store.getVersion(callRef);
+            if ((existing === null || existing === void 0 ? void 0 : existing.signed) && existing.redacted) {
+                working.discardWorking(callRef);
+                return {
+                    version: existing.version,
+                    signed: existing.signed,
+                    redacted: existing.redacted,
+                    parts: existing.manifest.parts.map((p) => (Object.assign(Object.assign({}, p), { stored: true })))
+                };
+            }
+            // Streamed to a file next to the tracks and uploaded from there (LO-B7); the working
+            // directory, file included, is discarded once the record is stored.
+            const recDir = working.recordingDir(callRef);
+            const rec = (0, recording_1.assembleRecordingFile)(recDir, path.join(recDir, recording_1.RECORDING_PART));
+            const built = (0, vcon_1.buildVcon)(callRef, entries, {
+                region,
+                recording: rec
+                    ? {
+                        part: {
+                            name: recording_1.RECORDING_PART,
+                            mimetype: "audio/x-wav",
+                            file: rec.file,
+                            size: rec.size,
+                            content_hash: rec.content_hash
+                        },
+                        startedAt: rec.startedAt,
+                        durationMs: rec.durationMs,
+                        beep: (spans) => (Object.assign({ name: recording_1.REDACTED_RECORDING_PART, mimetype: "audio/x-wav" }, (0, recording_1.beepRecordingFile)(rec.file, path.join(recDir, recording_1.REDACTED_RECORDING_PART), spans)))
+                    }
+                    : undefined
+            });
+            const sealed = {
+                version: 1,
+                signed: yield (0, sign_1.signVconWith)(built.vcon, this.custody),
+                redacted: yield (0, sign_1.signVconWith)(built.redacted, this.custody),
+                parts: built.parts
+            };
+            try {
+                yield store.putSealed(callRef, sealed);
+            }
+            catch (e) {
+                if (store === this.options.store)
+                    throw e;
+                logger.warn(`workspace bucket failed for ${callRef}, keeping it in the region store: ${e.message}`);
+                store = this.options.store;
+                yield store.putSealed(callRef, sealed);
+            }
+            working.discardWorking(callRef);
+            this.sealed(callRef, sealed, built.vcon, store);
+            return sealed;
+        });
+    }
+    sealed(callRef, sealed, vcon, store) {
+        var _a, _b;
+        try {
+            (_b = (_a = this.options).onSealed) === null || _b === void 0 ? void 0 : _b.call(_a, (0, indexEntry_1.indexEntry)(callRef, sealed, vcon, {
+                region: this.options.region,
+                location: store.location
+            }));
+        }
+        catch (e) {
+            logger.error(`onSealed failed for ${callRef}: ${e.message}`);
+        }
+    }
+    /**
+     * Seals records whose calls stopped appending more than `deadlineMs` ago without a hangup (a
+     * gateway that crashed). Returns the callRefs sealed.
+     */
+    sweep() {
+        return __awaiter(this, arguments, void 0, function* (now = Date.now(), deadlineMs = exports.SEAL_DEADLINE_MS) {
+            const sealed = [];
+            // Live calls of this writer first, so other writers see them alive.
+            this.beat();
+            for (const w of this.options.working.listWorking()) {
+                if (this.active.has(w.callRef) || this.sealing.has(w.callRef))
+                    continue;
+                // Quiet for the deadline: neither appended to nor kept alive by its owner's heartbeat.
+                if (now - w.lastAppendAt < deadlineMs)
+                    continue;
+                // Another writer is sealing it right now.
+                if (this.options.working.isSealLocked(w.callRef))
+                    continue;
+                try {
+                    yield this.seal(w.callRef);
+                    sealed.push(w.callRef);
+                }
+                catch (e) {
+                    logger.error(`could not seal ${w.callRef}: ${e.message}`);
+                }
+            }
+            return sealed;
+        });
+    }
+    /** Adds a version derived from the current one (it references its predecessor). */
+    newVersion(callRef_1, workspaceRef_1, change_1) {
+        return __awaiter(this, arguments, void 0, function* (callRef, workspaceRef, change, checkWorkspace = false, location) {
+            var _a;
+            const store = this.storeAt(location, workspaceRef);
+            // Without part contents: a new version shares the stored parts (no recording download).
+            const stored = yield store.getVersion(callRef);
+            if (!(stored === null || stored === void 0 ? void 0 : stored.signed) || !stored.redacted)
+                throw new Error(`no sealed record for ${callRef}`);
+            const current = {
+                version: stored.version,
+                signed: stored.signed,
+                redacted: stored.redacted,
+                parts: stored.manifest.parts.map((p) => (Object.assign(Object.assign({}, p), { stored: true })))
+            };
+            if (checkWorkspace)
+                assertSameWorkspace(callRef, (0, sign_1.decodeVcon)(current.signed), workspaceRef);
+            const next = (signed, redacted) => {
+                const prev = (0, sign_1.decodeVcon)(signed);
+                return Object.assign(Object.assign({}, change(prev, redacted)), { uuid: (0, crypto_1.randomUUID)(), updated_at: new Date().toISOString(), amended: {
+                        uuid: prev.uuid,
+                        content_hash: (0, sign_1.contentHash)(Buffer.from(JSON.stringify(prev)))
+                    } });
+            };
+            const vcon = next(current.signed, false);
+            // draft-04 4.1: `redacted` and `amended` are mutually exclusive. The original carries the
+            // version chain (amended → its predecessor); the redacted copy points at this version's
+            // original only (LO-B8).
+            const _b = next(current.redacted, true), { amended: _amended } = _b, redactedNext = __rest(_b, ["amended"]);
+            void _amended;
+            const redactedVcon = Object.assign(Object.assign({}, redactedNext), { redacted: Object.assign(Object.assign({}, ((_a = (0, sign_1.decodeVcon)(current.redacted).redacted) !== null && _a !== void 0 ? _a : {})), { uuid: vcon.uuid, content_hash: (0, sign_1.contentHash)(Buffer.from(JSON.stringify(vcon))) }) });
+            const sealed = {
+                version: current.version + 1,
+                signed: yield (0, sign_1.signVconWith)(vcon, this.custody),
+                redacted: yield (0, sign_1.signVconWith)(redactedVcon, this.custody),
+                parts: current.parts
+            };
+            yield store.putSealed(callRef, sealed);
+            this.sealed(callRef, sealed, vcon, store);
+            return { sealed, previous: current };
+        });
+    }
+    /**
+     * Adds to a sealed record as a new version that references its predecessor (call-record
+     * "Additions after sealing create new versions"); the previous version is unchanged.
+     */
+    addVersion(callRef, additions, workspaceRef, location) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { sealed } = yield this.newVersion(callRef, workspaceRef, (v, redacted) => {
+                var _a;
+                return (Object.assign(Object.assign({}, v), { analysis: [
+                        ...v.analysis,
+                        // The redacted copy gets the additions redacted too (like the sealed analysis, R-B4).
+                        // draft-04 2.3.2: an inline body needs its encoding.
+                        ...((_a = additions.analysis) !== null && _a !== void 0 ? _a : [])
+                            .map((a) => a.body !== undefined && a.body !== "" && !a.encoding
+                            ? Object.assign(Object.assign({}, a), { encoding: typeof a.body === "string" ? "none" : "json" }) : a)
+                            .map((a) => redacted ? (0, vcon_1.redactStrings)(a) : a)
+                    ] }));
+            }, false, location);
+            return sealed;
+        });
+    }
+    /**
+     * Deletes parts of a record (retention policy or a request) and writes a version that records
+     * each removal (call-record "Retention follows workspace policy and deletions are audited").
+     * The recording and the messages are files; the transcript lives inside the vCons, so earlier
+     * versions' contents are deleted too and only their manifests remain.
+     */
+    deleteParts(callRef, requested, by) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            // messages.ndjson holds every session message, the caller's and the agent's words included:
+            // deleting the transcript deletes it too (RV-B11), and the audit says so.
+            const parts = requested.includes("transcript") && !requested.includes("messages")
+                ? [...requested, "messages"]
+                : requested;
+            const store = this.storeAt(by.location, by.workspaceRef);
+            const at = new Date().toISOString();
+            const deletion = (part) => ({
+                part,
+                at,
+                reason: by.reason,
+                actor: by.actor
+            });
+            // The recording is two files when the redacted copy has a beeped one (LO-B9).
+            const fileOf = {
+                recording: [recording_1.RECORDING_PART, recording_1.REDACTED_RECORDING_PART],
+                messages: ["messages.ndjson"]
+            };
+            const { sealed, previous } = yield this.newVersion(callRef, by.workspaceRef, (v) => {
+                var _a, _b;
+                const removedFile = (entry) => {
+                    var _a;
+                    const name = String((_a = entry.url) !== null && _a !== void 0 ? _a : "").replace(/^parts\//, "");
+                    const part = parts.find((p) => { var _a; return (_a = fileOf[p]) === null || _a === void 0 ? void 0 : _a.includes(name); });
+                    if (!part)
+                        return entry;
+                    const { url: _url } = entry, rest = __rest(entry, ["url"]);
+                    void _url;
+                    return Object.assign(Object.assign({}, rest), { meta: Object.assign(Object.assign({}, rest.meta), { deleted: deletion(part) }) });
+                };
+                let dialog = v.dialog.map(removedFile);
+                let analysis = v.analysis;
+                if (parts.includes("transcript")) {
+                    dialog = dialog.filter((d) => d.type !== "text");
+                    analysis = analysis.map((a) => a.type === "turn_decisions"
+                        ? Object.assign(Object.assign({}, a), { body: [], meta: { deleted: deletion("transcript") } }) : a);
+                }
+                const f = ((_a = v.fonoster) !== null && _a !== void 0 ? _a : {});
+                return Object.assign(Object.assign({}, v), { dialog,
+                    analysis, attachments: v.attachments.map(removedFile), fonoster: Object.assign(Object.assign({}, f), { deletions: [
+                            ...((_b = f.deletions) !== null && _b !== void 0 ? _b : []),
+                            ...parts.map(deletion)
+                        ] }) });
+            }, true, by.location);
+            for (const part of parts)
+                for (const file of (_a = fileOf[part]) !== null && _a !== void 0 ? _a : [])
+                    yield store.deletePart(callRef, file);
+            if (parts.includes("transcript"))
+                for (let v = 1; v <= previous.version; v++)
+                    yield store.deleteVersionContents(callRef, v);
+            const workspaceRef = (_b = by.workspaceRef) !== null && _b !== void 0 ? _b : workspaceOfVcon((0, sign_1.decodeVcon)(sealed.signed));
+            return {
+                sealed: Object.assign(Object.assign({}, sealed), { parts: sealed.parts.filter((p) => !parts.some((part) => { var _a; return (_a = fileOf[part]) === null || _a === void 0 ? void 0 : _a.includes(p.name); })) }),
+                audit: parts.map((part) => ({
+                    callRef,
+                    workspaceRef,
+                    action: "delete_part",
+                    part,
+                    reason: by.reason,
+                    actor: by.actor,
+                    at,
+                    version: sealed.version
+                }))
+            };
+        });
+    }
+    /**
+     * Erases one call (call-record "Erasing one call"): every file and version is deleted, and a
+     * signed tombstone version states when, why and by whom. It holds no call content.
+     */
+    erase(callRef, by) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const store = this.storeAt(by.location, by.workspaceRef);
+            const current = yield store.getVersion(callRef);
+            if (!current)
+                throw new Error(`no sealed record for ${callRef}`);
+            const at = new Date().toISOString();
+            const previous = current.signed ? (0, sign_1.decodeVcon)(current.signed) : undefined;
+            assertSameWorkspace(callRef, previous, by.workspaceRef);
+            const workspaceRef = (_a = by.workspaceRef) !== null && _a !== void 0 ? _a : (previous ? workspaceOfVcon(previous) : null);
+            yield store.deleteAll(callRef);
+            const tombstone = {
+                vcon: (_b = previous === null || previous === void 0 ? void 0 : previous.vcon) !== null && _b !== void 0 ? _b : "0.4.0",
+                uuid: (0, crypto_1.randomUUID)(),
+                created_at: at,
+                updated_at: at,
+                parties: [],
+                dialog: [],
+                analysis: [],
+                attachments: [],
+                fonoster: {
+                    callRef,
+                    region: this.options.region,
+                    status: "erased",
+                    workspaceRef,
+                    erased: { at, reason: by.reason, actor: by.actor }
+                }
+            };
+            const version = current.version + 1;
+            const signed = yield (0, sign_1.signVconWith)(tombstone, this.custody);
+            const sealed = {
+                version,
+                signed,
+                redacted: signed,
+                parts: []
+            };
+            yield store.putSealed(callRef, sealed);
+            this.sealed(callRef, sealed, tombstone, store);
+            return {
+                version,
+                audit: [
+                    {
+                        callRef,
+                        workspaceRef,
+                        action: "erase",
+                        part: "all",
+                        reason: by.reason,
+                        actor: by.actor,
+                        at,
+                        version
+                    }
+                ]
+            };
+        });
+    }
+}
+exports.CallRecordWriter = CallRecordWriter;
+function workspaceOf(entries) {
+    for (const e of entries) {
+        const w = e.message.workspaceRef;
+        if (typeof w === "string" && w)
+            return w;
+    }
+    return null;
+}
+function workspaceOfVcon(vcon) {
+    var _a, _b;
+    return ((_b = ((_a = vcon.fonoster) !== null && _a !== void 0 ? _a : {}).workspaceRef) !== null && _b !== void 0 ? _b : null);
+}