@hadoku/jobplatform-worker 2.32.14 → 2.32.15

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAMN,KAAK,iBAAiB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AASzC,UAAU,UAAU;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE;QAAE,WAAW,EAAE,iBAAiB,CAAA;KAAE,CAAC;CAC9C;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,SAAqB,uCAoDrE;AAYD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,IAErC,SAAS,OAAO,EAAE,MAAM,gBAAgB,kCAChD;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAC1C,MAAM,MAAM,UAGpB;AAED,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAMN,KAAK,iBAAiB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAUzC,UAAU,UAAU;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE;QAAE,WAAW,EAAE,iBAAiB,CAAA;KAAE,CAAC;CAC9C;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,SAAqB,uCAuDrE;AAYD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,IAErC,SAAS,OAAO,EAAE,MAAM,gBAAgB,kCAChD;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAC1C,MAAM,MAAM,UAGpB;AAED,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,cAAc,cAAc,CAAC"}

package/dist/index.js

@@ -800,7 +800,7 @@ const AddProfileCompanyResponseSchema = S(
 const DeleteCompanyResponseSchema = S(
   z.object({ deleted: z.literal(true), id: z.string() })
 ).openapi("DeleteCompanyResponse");
-const app$4 = new OpenAPIHono();
+const app$5 = new OpenAPIHono();
 const healthRoute = createRoute({
   method: "get",
   path: "/health",
@@ -818,7 +818,7 @@ const healthRoute = createRoute({
     }
   }
 });
-app$4.openapi(healthRoute, (c) => {
+app$5.openapi(healthRoute, (c) => {
   const status = "healthy";
   return c.json(
     {
@@ -829,7 +829,7 @@ app$4.openapi(healthRoute, (c) => {
     200
   );
 });
-const healthRoutes = app$4;
+const healthRoutes = app$5;
 const DEFAULT_BASE_URL$1 = "https://hadoku.me/contact/api/mailfeed";
 function baseUrl$1(env) {
   return (env.MAILFEED_BASE_URL ?? DEFAULT_BASE_URL$1).replace(/\/$/, "");
@@ -1814,7 +1814,7 @@ function scheduleRankBuild(c, db, profileId, profile) {
     rebuildRank(db, profileId, profile).finally(() => building.delete(profileId))
   );
 }
-const app$3 = new OpenAPIHono();
+const app$4 = new OpenAPIHono();
 const CULL_DAYS = 60;
 const CULL_BATCH = 500;
 async function cullExpired(db) {
@@ -1864,14 +1864,14 @@ async function rankNewJobs(db) {
     await markRankBuilt(db, state.profile_id, profile, head2);
   }
 }
-app$3.use("/ingest", requireMinTier("friend"));
-app$3.use("/ingest/backfill-slugs", requireMinTier("friend"));
-app$3.use("/ingest/backfill-roles", requireMinTier("friend"));
-app$3.use("/ingest/backfill-salary", requireMinTier("friend"));
-app$3.use("/ingest/cull", requireMinTier("friend"));
-app$3.use("/ingest/rebuild-rank", requireMinTier("friend"));
-app$3.use("/ingest/reconcile-mail", requireMinTier("friend"));
-app$3.use("/directives", requireMinTier("friend"));
+app$4.use("/ingest", requireMinTier("friend"));
+app$4.use("/ingest/backfill-slugs", requireMinTier("friend"));
+app$4.use("/ingest/backfill-roles", requireMinTier("friend"));
+app$4.use("/ingest/backfill-salary", requireMinTier("friend"));
+app$4.use("/ingest/cull", requireMinTier("friend"));
+app$4.use("/ingest/rebuild-rank", requireMinTier("friend"));
+app$4.use("/ingest/reconcile-mail", requireMinTier("friend"));
+app$4.use("/directives", requireMinTier("friend"));
 function normalizeWorkplaceType(wt) {
   if (wt === "on_site") return "onsite";
   return wt;
@@ -1895,7 +1895,7 @@ const ingestRoute = createRoute({
   }
 });
 const INGEST_BATCH_CHUNK = 100;
-app$3.openapi(ingestRoute, async (c) => {
+app$4.openapi(ingestRoute, async (c) => {
   const { jobs, batch_number, is_final, source, board_slug } = c.req.valid("json");
   const db = c.env.JOB_PLATFORM_DB;
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2028,7 +2028,7 @@ const backfillRoute = createRoute({
     }
   }
 });
-app$3.openapi(backfillRoute, async (c) => {
+app$4.openapi(backfillRoute, async (c) => {
   const { limit } = c.req.valid("query");
   const db = c.env.JOB_PLATFORM_DB;
   const rows = await db.prepare("SELECT id, url FROM jobs WHERE ats IS NULL OR slug IS NULL LIMIT ?").bind(limit).all();
@@ -2080,7 +2080,7 @@ const rebuildRankRoute = createRoute({
     }
   }
 });
-app$3.openapi(rebuildRankRoute, async (c) => {
+app$4.openapi(rebuildRankRoute, async (c) => {
   const { profile_id } = c.req.valid("query");
   const db = c.env.JOB_PLATFORM_DB;
   const pending = profile_id ? [{ id: profile_id }] : (await db.prepare("SELECT id FROM profiles ORDER BY id").all()).results;
@@ -2144,7 +2144,7 @@ const backfillRolesRoute = createRoute({
     }
   }
 });
-app$3.openapi(backfillRolesRoute, async (c) => {
+app$4.openapi(backfillRolesRoute, async (c) => {
   const { limit, reclassify } = c.req.valid("query");
   const db = c.env.JOB_PLATFORM_DB;
   const all = reclassify === "true";
@@ -2196,7 +2196,7 @@ const directivesRoute = createRoute({
     }
   }
 });
-app$3.openapi(directivesRoute, async (c) => {
+app$4.openapi(directivesRoute, async (c) => {
   const db = c.env.JOB_PLATFORM_DB;
   const companyRows = await db.prepare("SELECT DISTINCT ats, slug FROM profile_companies ORDER BY ats, slug").all();
   const profileRows = await db.prepare("SELECT keywords FROM profiles").all();
@@ -2256,7 +2256,7 @@ const backfillSalaryRoute = createRoute({
     }
   }
 });
-app$3.openapi(backfillSalaryRoute, async (c) => {
+app$4.openapi(backfillSalaryRoute, async (c) => {
   const { limit, cursor } = c.req.valid("query");
   const db = c.env.JOB_PLATFORM_DB;
   const rows = await db.prepare(
@@ -2303,7 +2303,7 @@ const cullRoute = createRoute({
     }
   }
 });
-app$3.openapi(cullRoute, async (c) => {
+app$4.openapi(cullRoute, async (c) => {
   const culled = await cullExpired(c.env.JOB_PLATFORM_DB);
   const stripped = await stripStaleDescriptions(c.env.JOB_PLATFORM_DB);
   return c.json(
@@ -2372,7 +2372,7 @@ const reconcileMailRoute = createRoute({
     }
   }
 });
-app$3.openapi(reconcileMailRoute, async (c) => {
+app$4.openapi(reconcileMailRoute, async (c) => {
   const { reset, ownerName } = c.req.valid("query");
   const who = await effectiveUserId(c, ownerName);
   if (isEffectiveUserError(who)) return c.json(who.error.body, who.error.status);
@@ -2433,7 +2433,7 @@ const reconcileViewRoute = createRoute({
     }
   }
 });
-app$3.openapi(reconcileViewRoute, async (c) => {
+app$4.openapi(reconcileViewRoute, async (c) => {
   const { ownerName } = c.req.valid("query");
   const who = await effectiveUserId(c, ownerName);
   if (isEffectiveUserError(who)) return c.json(who.error.body, who.error.status);
@@ -2442,7 +2442,7 @@ app$3.openapi(reconcileViewRoute, async (c) => {
   const view = await reconcileView(c.env, who.userId);
   return c.json({ success: true, data: view }, 200);
 });
-const ingestRoutes = app$3;
+const ingestRoutes = app$4;
 const DEFAULT_PROFILE = {
   name: "Default",
   keywords: ["software engineer", "ai", "ml", "platform", "backend", "distributed systems"],
@@ -2549,11 +2549,11 @@ async function triggerSearch(env) {
     );
   }
 }
-const app$2 = new OpenAPIHono();
-app$2.use("/profiles", requireMinTier("friend"));
-app$2.use("/profiles/*", requireMinTier("friend"));
-app$2.use("/profiles", requireIdentity);
-app$2.use("/profiles/*", requireIdentity);
+const app$3 = new OpenAPIHono();
+app$3.use("/profiles", requireMinTier("friend"));
+app$3.use("/profiles/*", requireMinTier("friend"));
+app$3.use("/profiles", requireIdentity);
+app$3.use("/profiles/*", requireIdentity);
 async function requireIdentity(c, next) {
   if (!c.req.header("X-User-Id")?.trim()) {
     return c.json(
@@ -2644,7 +2644,7 @@ async function ensureDefaultProfile(db, userId) {
 async function ownedProfile(db, userId, id) {
   return db.prepare("SELECT * FROM profiles WHERE id = ? AND user_id = ?").bind(id, userId).first();
 }
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "get",
     path: "/profiles",
@@ -2668,7 +2668,7 @@ app$2.openapi(
     });
   }
 );
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "post",
     path: "/profiles",
@@ -2706,7 +2706,7 @@ app$2.openapi(
     return c.json({ success: true, data: { profile } }, 201);
   }
 );
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "put",
     path: "/profiles/{id}",
@@ -2765,7 +2765,7 @@ app$2.openapi(
     return c.json({ success: true, data: { profile } }, 200);
   }
 );
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "delete",
     path: "/profiles/{id}",
@@ -2808,7 +2808,7 @@ app$2.openapi(
     return c.json({ success: true, data: { deleted: true, id } }, 200);
   }
 );
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "get",
     path: "/profiles/{profileId}/companies",
@@ -2849,7 +2849,7 @@ app$2.openapi(
     );
   }
 );
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "post",
     path: "/profiles/{profileId}/companies",
@@ -2912,7 +2912,7 @@ app$2.openapi(
     );
   }
 );
-app$2.openapi(
+app$3.openapi(
   createRoute({
     method: "delete",
     path: "/profiles/{profileId}/companies/{companyId}",
@@ -2993,7 +2993,7 @@ function deserializeProfile(r) {
     created_at: r.created_at
   };
 }
-const profileRoutes = app$2;
+const profileRoutes = app$3;
 const LIGHT_CANDIDATE_CAP = 5e4;
 const FULL_SCORE_CAP = 800;
 const ID_CHUNK = 100;
@@ -5424,23 +5424,23 @@ function registerFillRoutes(app2) {
     );
   });
 }
+const app$2 = new OpenAPIHono();
+registerFeedRoute(app$2);
+registerPreflightRoute(app$2);
+registerPacketsRoute(app$2);
+registerDetailRoute(app$2);
+registerStateRoutes(app$2);
+registerFeedbackRoutes(app$2);
+registerTailoringRoutes(app$2);
+registerApplicationRoutes(app$2);
+registerVerificationRoutes(app$2);
+registerFillRoutes(app$2);
+registerAnswerRoutes(app$2);
+registerOwnerRoutes(app$2);
+const jobRoutes = app$2;
 const app$1 = new OpenAPIHono();
-registerFeedRoute(app$1);
-registerPreflightRoute(app$1);
-registerPacketsRoute(app$1);
-registerDetailRoute(app$1);
-registerStateRoutes(app$1);
-registerFeedbackRoutes(app$1);
-registerTailoringRoutes(app$1);
-registerApplicationRoutes(app$1);
-registerVerificationRoutes(app$1);
-registerFillRoutes(app$1);
-registerAnswerRoutes(app$1);
-registerOwnerRoutes(app$1);
-const jobRoutes = app$1;
-const app = new OpenAPIHono();
-app.use("/companies/*", requireMinTier("friend"));
-app.openapi(
+app$1.use("/companies/*", requireMinTier("friend"));
+app$1.openapi(
   createRoute({
     method: "post",
     path: "/companies/match",
@@ -5481,7 +5481,7 @@ app.openapi(
     }
   }
 );
-app.openapi(
+app$1.openapi(
   createRoute({
     method: "post",
     path: "/companies/probe",
@@ -5522,7 +5522,60 @@ app.openapi(
     }
   }
 );
-const companyRoutes = app;
+const companyRoutes = app$1;
+const ERASED_TABLES = [
+  // A profile's children first, found through the profile while it still exists.
+  {
+    table: "profile_companies",
+    sql: "DELETE FROM profile_companies WHERE profile_id IN (SELECT id FROM profiles WHERE user_id = ?1)"
+  },
+  {
+    table: "job_profile_rank",
+    sql: "DELETE FROM job_profile_rank WHERE profile_id IN (SELECT id FROM profiles WHERE user_id = ?1)"
+  },
+  {
+    table: "job_profile_rank_state",
+    sql: "DELETE FROM job_profile_rank_state WHERE profile_id IN (SELECT id FROM profiles WHERE user_id = ?1)"
+  },
+  { table: "profiles", sql: "DELETE FROM profiles WHERE user_id = ?1" },
+  { table: "profile_tombstones", sql: "DELETE FROM profile_tombstones WHERE user_id = ?1" },
+  { table: "job_states", sql: "DELETE FROM job_states WHERE user_id = ?1" },
+  { table: "job_feedback", sql: "DELETE FROM job_feedback WHERE user_id = ?1" },
+  { table: "applications", sql: "DELETE FROM applications WHERE user_id = ?1" },
+  { table: "application_answers", sql: "DELETE FROM application_answers WHERE user_id = ?1" },
+  { table: "applicant_profiles", sql: "DELETE FROM applicant_profiles WHERE user_id = ?1" },
+  { table: "mail_reconcile_state", sql: "DELETE FROM mail_reconcile_state WHERE user_id = ?1" },
+  { table: "mail_unmatched", sql: "DELETE FROM mail_unmatched WHERE user_id = ?1" },
+  { table: "owner_name_cache", sql: "DELETE FROM owner_name_cache WHERE user_id = ?1" }
+];
+async function eraseUser(db, userId) {
+  const results = await db.batch(ERASED_TABLES.map(({ sql }) => db.prepare(sql).bind(userId)));
+  const erased = {};
+  ERASED_TABLES.forEach(({ table }, i) => {
+    erased[table] = results[i].meta.changes;
+  });
+  return erased;
+}
+const app = new OpenAPIHono();
+app.post("/_account/erase", async (c) => {
+  const auth = c.get("authContext");
+  if (!tierAtLeast(auth, "member")) {
+    return c.json(
+      { success: false, error: "Unauthorized", message: "Edge seal required" },
+      401
+    );
+  }
+  const userId = auth.userId?.trim();
+  if (!userId) {
+    return c.json(
+      { success: false, error: "Unauthorized", message: "No X-User-Id to erase" },
+      401
+    );
+  }
+  const erased = await eraseUser(c.env.JOB_PLATFORM_DB, userId);
+  return c.json({ success: true, erased }, 200);
+});
+const accountRoutes = app;
 function createJobPlatformHandler(basePath = "/jobplatform/api") {
   const app2 = new OpenAPIHono({
     defaultHook: wrappedValidationHook
@@ -5543,6 +5596,7 @@ function createJobPlatformHandler(basePath = "/jobplatform/api") {
   app2.route("/", profileRoutes);
   app2.route("/", jobRoutes);
   app2.route("/", companyRoutes);
+  app2.route("/", accountRoutes);
   app2.doc(
     "/openapi.json",
     createOpenAPIDocConfig({

package/dist/routes/account.d.ts

@@ -0,0 +1,75 @@
+/**
+ * POST /_account/erase — the account-erase hook (hadoku_site IDENTITY_MODEL
+ * R12, "Erase hooks").
+ *
+ *   200 → { success: true, erased: { <table>: <rows deleted> } }
+ *   401 → no edge seal, or a sealed request that names nobody
+ *
+ * When a person deletes their account, edge-router calls this under its seal
+ * (X-Edge-Auth, X-Hadoku-Tier: member, X-User-Id) and closes the account only
+ * once every hook has answered its counts. The person is the edge-stamped
+ * X-User-Id and nothing else: never a body field, never an ownerName (R5).
+ *
+ * Only the edge can reach it. edge-router 404s every inbound path with an
+ * `_account` segment before routing, so no page can erase a signed-in visitor
+ * with one POST through the proxy. A direct hit on the workers.dev origin
+ * carries no valid seal, so createEdgeAuth degrades it to public and it is
+ * refused here.
+ *
+ * Idempotent: every statement is a DELETE by user id, so a second call
+ * matches nothing and answers zeros. The edge calls it twice by design.
+ *
+ * What is erased, and why it is the person's own (ERASED_TABLES below is the
+ * list; erase.test.ts fails if a table with a user_id column is missing from
+ * it):
+ *
+ *   profiles             Their scoring profiles. Each is theirs alone; a
+ *                        profile is never shared.
+ *   profile_companies    The companies in their profiles' slices. Deleting
+ *                        them drops those boards from GET /directives unless
+ *                        another person's profile also subscribes, which is
+ *                        exactly what a subscription means.
+ *   job_profile_rank     Derived feed ranking for their profiles. Always safe
+ *   job_profile_rank_state  to delete (the feed ranks live without it); kept
+ *                        would be rows for profiles that no longer exist.
+ *   profile_tombstones   Their "I deleted the Default profile" markers.
+ *   job_states           Their triage of each posting (and the packet slug
+ *                        they sent with an application).
+ *   job_feedback         Their up/down votes, one per (user, job).
+ *   applications         Their apply queue. The runner writes these ON THEIR
+ *                        BEHALF (ownerName), which is why the data lives here
+ *                        and not in prefs-api, but every row is the person's.
+ *                        A row handed to someone else (POST
+ *                        /applications/:id/owner) is that person's now, and
+ *                        stays.
+ *   application_answers  Their standing answers to form questions, including
+ *                        demographic ones.
+ *   applicant_profiles   Their contact facts, education and work history.
+ *   mail_reconcile_state Reconciliation of their mailbox: cursor and counts.
+ *   mail_unmatched       Subjects and senders of their ATS mail.
+ *   owner_name_cache     A STORED NAME: a cached display-name → userId
+ *                        resolution. It must go, or the name keeps resolving
+ *                        to an erased person for up to 15 minutes.
+ *
+ * Not erased: `jobs`, the shared corpus of postings, which names no person.
+ * No shared table in this app records who contributed to it, so the erase
+ * leaves no userId behind in shared state.
+ *
+ * Outside this app: the packets a variant_slug points at live in resume-api's
+ * KV, and are erased (or not) by resume-api.
+ */
+import { OpenAPIHono } from '@hono/zod-openapi';
+import type { D1Database } from '@cloudflare/workers-types';
+import type { RouteContext } from './jobs/shared.js';
+/** Each table this hook erases, with the DELETE that removes one person's rows. */
+export declare const ERASED_TABLES: readonly {
+    table: string;
+    sql: string;
+}[];
+/**
+ * Delete every row that is this person's own, in one transaction (D1 runs a
+ * batch atomically), and count what each table lost.
+ */
+export declare function eraseUser(db: D1Database, userId: string): Promise<Record<string, number>>;
+export declare const accountRoutes: OpenAPIHono<RouteContext, {}, "/">;
+//# sourceMappingURL=account.d.ts.map

package/dist/routes/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/routes/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,mFAAmF;AACnF,eAAO,MAAM,aAAa,EAAE,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAwBlE,CAAC;AAEF;;;GAGG;AACH,wBAAsB,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAO/F;AAyBD,eAAO,MAAM,aAAa,oCAAM,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadoku/jobplatform-worker",
-  "version": "2.32.14",
+  "version": "2.32.15",
   "description": "Job listings aggregation and tracking dashboard - Worker package",
   "license": "MIT",
   "type": "module",