@hiai-gg/docsmint 0.3.5 → 0.3.6

package/dist/frontend/shared-document.js

@@ -1,15 +1,15 @@
 import { t as e } from "./context-DbnW5yib.js";
-import { $ as t, D as n, H as r, M as i, N as a, S as o, T as s, _t as c, dt as l, et as u, ft as d, j as f, k as p, tt as m } from "./client-C6QQGb0e.js";
+import { $ as t, D as n, H as r, M as i, N as a, S as o, T as s, _t as c, dt as l, et as u, ft as d, j as f, k as p, lt as m, tt as h } from "./client-C6QQGb0e.js";
 //#region src/lib/components/editor/shared-document.ts
-var h = /^\/api\/attachments\/[0-9a-f-]+\/raw$/i, g = /* @__PURE__ */ new Set([
+var g = /^\/api\/attachments\/[0-9a-f-]+\/raw$/i, _ = /* @__PURE__ */ new Set([
 	"http:",
 	"https:",
 	"mailto:"
 ]);
-function _(e) {
+function v(e) {
 	return e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function v(e, t) {
+function y(e, t) {
 	switch (e.type) {
 		case "bold": return `<strong>${t}</strong>`;
 		case "italic": return `<em>${t}</em>`;
@@ -17,41 +17,41 @@ function v(e, t) {
 		case "strikethrough": return `<s>${t}</s>`;
 		case "underline": return `<u>${t}</u>`;
 		case "code": return `<code>${t}</code>`;
-		case "link": return `<a href="${_(y(e.attrs?.href ?? "#"))}" target="_blank" rel="noopener noreferrer">${t}</a>`;
-		case "highlight": return `<mark style="background-color: ${_(e.attrs?.color ?? "#fde68a")}">${t}</mark>`;
+		case "link": return `<a href="${v(b(e.attrs?.href ?? "#"))}" target="_blank" rel="noopener noreferrer">${t}</a>`;
+		case "highlight": return `<mark style="background-color: ${v(e.attrs?.color ?? "#fde68a")}">${t}</mark>`;
 		default: return t;
 	}
 }
-function y(e) {
+function b(e) {
 	if (e.startsWith("#") || e.startsWith("/") || e.startsWith("./")) return e;
 	try {
 		let t = new URL(e);
-		return g.has(t.protocol) ? e : "#";
+		return _.has(t.protocol) ? e : "#";
 	} catch {
 		return "#";
 	}
 }
-function b(e) {
+function x(e) {
 	let t = e?.textAlign;
 	return t !== "left" && t !== "center" && t !== "right" && t !== "justify" ? "" : ` style="text-align: ${t}"`;
 }
-function x(e) {
+function S(e) {
 	if (e.type === "text") {
-		let t = _(e.text ?? "");
-		for (let n of e.marks ?? []) t = v(n, t);
+		let t = v(e.text ?? "");
+		for (let n of e.marks ?? []) t = y(n, t);
 		return t;
 	}
-	return (e.content ?? []).map(x).join("");
+	return (e.content ?? []).map(S).join("");
 }
-function S(e) {
+function C(e) {
 	let t = (e) => {
-		if (e.type === "text") return x(e);
-		let n = b(e.attrs), r = (e.content ?? []).map(t).join("");
+		if (e.type === "text") return S(e);
+		let n = x(e.attrs), r = (e.content ?? []).map(t).join("");
 		switch (e.type) {
 			case "paragraph": return `<p${n}>${r}</p>`;
 			case "heading": {
 				let t = Math.min(Math.max(Number(e.attrs?.level ?? 1), 1), 6);
-				return `<h${t}${n}>${(e.content ?? []).map(x).join("")}</h${t}>`;
+				return `<h${t}${n}>${(e.content ?? []).map(S).join("")}</h${t}>`;
 			}
 			case "bulletList": return `<ul${n}>${r}</ul>`;
 			case "orderedList": {
@@ -71,34 +71,34 @@ function S(e) {
 			case "tableCell": return `<td${n}>${r}</td>`;
 			case "codeBlock": {
 				let t = e.attrs?.language ?? "";
-				return `<pre><code${t ? ` class="language-${_(t)}"` : ""}>${r}</code></pre>`;
+				return `<pre><code${t ? ` class="language-${v(t)}"` : ""}>${r}</code></pre>`;
 			}
 			case "horizontalRule": return "<hr />";
 			case "hardBreak": return "<br />";
 			case "image": {
 				let t = e.attrs?.src ?? "", n = e.attrs?.alt ?? "", r = Number(e.attrs?.width), i = Number(e.attrs?.height), a = `${Number.isFinite(r) && r > 0 ? ` width="${Math.round(r)}"` : ""}${Number.isFinite(i) && i > 0 ? ` height="${Math.round(i)}"` : ""}`;
-				return h.test(t) ? `<img data-shared-attachment-src="${_(t)}" alt="${_(n)}"${a} />` : `<img src="${_(t)}" alt="${_(n)}"${a} />`;
+				return g.test(t) ? `<img data-shared-attachment-src="${v(t)}" alt="${v(n)}"${a} />` : `<img src="${v(t)}" alt="${v(n)}"${a} />`;
 			}
 			default: return r;
 		}
 	};
 	return (e.content ?? []).map(t).join("");
 }
-function C(e) {
+function w(e) {
 	return e.replace(/<li>(\s*<input\b[^>]*type=["']checkbox["'][^>]*>)/gi, "<li class=\"task-list-item\">$1");
 }
-function w(e, t = "") {
+function T(e, t = "") {
 	return {
 		"x-share-token": e,
 		...t ? { "x-share-password": t } : {}
 	};
 }
-async function T(e, t, n = "") {
+async function E(e, t, n = "") {
 	let r = [], i = e.querySelectorAll("img[data-shared-attachment-src]");
 	return await Promise.all(Array.from(i, async (e) => {
 		let i = e.dataset.sharedAttachmentSrc;
 		if (i) try {
-			let a = await fetch(i, { headers: w(t, n) });
+			let a = await fetch(i, { headers: T(t, n) });
 			if (!a.ok) {
 				e.dataset.sharedAttachmentError = String(a.status);
 				return;
@@ -110,7 +110,7 @@ async function T(e, t, n = "") {
 		}
 	})), r;
 }
-async function E(e) {
+async function D(e) {
 	let t = Array.from(e.querySelectorAll("img"));
 	await Promise.all(t.map(async (e) => {
 		if (!e.complete) {
@@ -125,69 +125,104 @@ async function E(e) {
 	}));
 }
 //#endregion
+//#region src/lib/extensions/shared-document-context.ts
+var O = /* @__PURE__ */ new Set([
+	"shareToken",
+	"password",
+	"passwordHash",
+	"workspaceAssertion",
+	"authorization",
+	"cookie",
+	"signingSecret"
+]);
+function k(e) {
+	if (!e.id.trim() || !e.expiresAt.trim()) throw TypeError("Shared extension capability must include a non-empty id and expiry");
+	return Object.freeze({
+		id: e.id,
+		expiresAt: e.expiresAt
+	});
+}
+function A(e) {
+	for (let t of Object.keys(e)) if (O.has(t)) throw TypeError(`Sensitive ${t} must not be provided to a shared extension`);
+	return Object.freeze({
+		documentId: e.documentId,
+		title: e.title,
+		content: e.content,
+		...e.contentJson === void 0 ? {} : { contentJson: e.contentJson },
+		role: e.role,
+		capability: k(e.capability),
+		permissions: Object.freeze({
+			read: !0,
+			annotate: e.permissions.annotate,
+			edit: e.permissions.edit,
+			export: e.permissions.export
+		})
+	});
+}
+//#endregion
 //#region src/lib/hosts/DocsmintSharedDocumentHost.svelte
-var D = a("<div data-docsmint-shared-document-host=\"\"><div data-extension-zone=\"shared-header-actions\"></div> <!> <div data-extension-zone=\"shared-document-tabs\"></div> <div data-extension-zone=\"shared-document-notes\"></div> <div data-extension-zone=\"shared-document-editor\"><!></div></div>");
-function O(a, h) {
-	d(h, !0);
-	let g = e();
-	function _(e) {
-		return e.permission === "annotate" ? h.context.permissions.annotate : h.context.permissions.edit;
+var j = a("<div data-docsmint-shared-document-host=\"\"><div data-extension-zone=\"shared-header-actions\"></div> <!> <div data-extension-zone=\"shared-document-tabs\"></div> <div data-extension-zone=\"shared-document-notes\"></div> <div data-extension-zone=\"shared-document-editor\"><!></div></div>");
+function M(a, g) {
+	d(g, !0);
+	let _ = e(), v = m(() => A(g.context));
+	function y(e) {
+		return e.permission === "annotate" ? r(v).permissions.annotate : r(v).permissions.edit;
 	}
-	function v(e) {
+	function b(e) {
 		let t = /* @__PURE__ */ new Set();
 		return e.filter((e) => {
-			if (t.has(e.id) || !_(e)) return !1;
+			if (t.has(e.id) || !y(e)) return !1;
 			t.add(e.id);
 			try {
-				return e.visible?.(h.context) ?? !0;
+				return e.visible?.(r(v)) ?? !0;
 			} catch {
 				return !1;
 			}
 		}).sort((e, t) => (e.order ?? 0) - (t.order ?? 0) || e.id.localeCompare(t.id));
 	}
-	var y = D(), b = t(y);
-	s(b, 21, () => v(g.sharedDocumentHeaderActions), (e) => e.id, (e, t) => {
+	var x = j(), S = t(x);
+	s(S, 21, () => b(_.sharedDocumentHeaderActions), (e) => e.id, (e, t) => {
 		var n = i();
 		o(u(n), () => r(t).component, (e, t) => {
 			t(e, { get context() {
-				return h.context;
+				return r(v);
 			} });
 		}), f(e, n);
-	}), c(b);
-	var x = m(b, 2);
-	p(x, () => h.children);
-	var S = m(x, 2);
-	s(S, 21, () => v(g.sharedDocumentTabs), (e) => e.id, (e, t) => {
+	}), c(S);
+	var C = h(S, 2);
+	p(C, () => g.children);
+	var w = h(C, 2);
+	s(w, 21, () => b(_.sharedDocumentTabs), (e) => e.id, (e, t) => {
 		var n = i();
 		o(u(n), () => r(t).component, (e, t) => {
 			t(e, { get context() {
-				return h.context;
+				return r(v);
 			} });
 		}), f(e, n);
-	}), c(S);
-	var C = m(S, 2);
-	s(C, 21, () => v(g.sharedDocumentNotesModes), (e) => e.id, (e, t) => {
+	}), c(w);
+	var T = h(w, 2);
+	s(T, 21, () => b(_.sharedDocumentNotesModes), (e) => e.id, (e, t) => {
 		var n = i();
 		o(u(n), () => r(t).component, (e, t) => {
 			t(e, { get context() {
-				return h.context;
+				return r(v);
 			} });
 		}), f(e, n);
-	}), c(C);
-	var w = m(C, 2), T = t(w), E = (e) => {
+	}), c(T);
+	var E = h(T, 2), D = t(E), O = (e) => {
 		var t = i();
-		s(u(t), 17, () => v(g.sharedDocumentEditorModes), (e) => e.id, (e, t) => {
+		s(u(t), 17, () => b(_.sharedDocumentEditorModes), (e) => e.id, (e, t) => {
 			var n = i();
 			o(u(n), () => r(t).component, (e, t) => {
 				t(e, { get context() {
-					return h.context;
+					return r(v);
 				} });
 			}), f(e, n);
 		}), f(e, t);
 	};
-	n(T, (e) => {
-		h.context.permissions.edit && e(E);
-	}), c(w), c(y), f(a, y), l();
+	n(D, (e) => {
+		r(v).permissions.edit && e(O);
+	}), c(E), c(x), f(a, x), l();
 }
 //#endregion
-export { O as DocsmintSharedDocumentHost, T as hydrateSharedAttachmentImages, C as markMarkdownTaskItems, S as renderSharedDocument, w as sharedAttachmentHeaders, E as waitForSharedDocumentImages };
+export { M as DocsmintSharedDocumentHost, E as hydrateSharedAttachmentImages, w as markMarkdownTaskItems, C as renderSharedDocument, T as sharedAttachmentHeaders, D as waitForSharedDocumentImages };

package/dist/lifecycle-persistent.d.ts

@@ -0,0 +1,31 @@
+import { type AssertPurgeAllowed, type LifecycleHostStep, type UserDataLifecycle, type UserDataLifecycleAdapter } from "./lifecycle";
+/**
+ * Minimal transaction boundary required by the durable lifecycle runtime.
+ * Hosts supply a request/RLS-scoped executor; SDK code never imports a global
+ * database singleton or bypasses host tenant policy.
+ */
+export type LifecycleScopedDatabaseExecutor = <T>(context: Readonly<{
+    actorUserId: string;
+    requestId: string;
+    signal?: AbortSignal;
+}>, operation: () => Promise<T>) => Promise<T>;
+/**
+ * Public persistent lifecycle composition contract.  The OSS persistence
+ * saga is supplied by the backend runtime; SaaS hosts attach their own steps
+ * and RLS executor without private imports.
+ */
+export type LifecycleRuntimeAdapters = Readonly<{
+    database: LifecycleScopedDatabaseExecutor;
+    adapter: UserDataLifecycleAdapter;
+}>;
+export type PersistentLifecycleRuntimeOptions = Readonly<{
+    runtime: LifecycleRuntimeAdapters;
+    assertPurgeAllowed: AssertPurgeAllowed;
+    hostSteps?: readonly LifecycleHostStep[];
+}>;
+/**
+ * Creates an immutable, transaction-scoped public lifecycle facade.
+ * The database executor is invoked for every OSS adapter operation so hosts
+ * can set RLS GUCs and reject a missing scope before any mutation occurs.
+ */
+export declare function createPersistentLifecycleRuntime(options: PersistentLifecycleRuntimeOptions): UserDataLifecycle;

package/dist/lifecycle-persistent.js

@@ -0,0 +1,33 @@
+import { createUserDataLifecycle, orderLifecycleHostSteps, } from "./lifecycle";
+function immutableContext(context) {
+    return Object.freeze({ ...context });
+}
+/**
+ * Creates an immutable, transaction-scoped public lifecycle facade.
+ * The database executor is invoked for every OSS adapter operation so hosts
+ * can set RLS GUCs and reject a missing scope before any mutation occurs.
+ */
+export function createPersistentLifecycleRuntime(options) {
+    const hostSteps = orderLifecycleHostSteps(options.hostSteps ?? []);
+    const lifecycle = createUserDataLifecycle({
+        async *exportUserData(context) {
+            const immutable = immutableContext(context);
+            const records = await options.runtime.database(immutable, async () => {
+                const result = [];
+                for await (const record of options.runtime.adapter.exportUserData(immutable))
+                    result.push(record);
+                return result;
+            });
+            for (const record of records)
+                yield record;
+        },
+        async purgeUserData(context, gate) {
+            const immutable = immutableContext(context);
+            return options.runtime.database(immutable, () => options.runtime.adapter.purgeUserData(immutable, gate));
+        },
+    }, async (context) => options.assertPurgeAllowed(immutableContext(context)));
+    // Validate host-step ordering eagerly. The OSS adapter owns invocation; the
+    // public factory records the accepted contract without inventing SaaS data.
+    void hostSteps;
+    return lifecycle;
+}

package/dist/server-only-browser-entry.js

@@ -0,0 +1,3 @@
+"use strict";
+/** Browser-condition guard for every server-only public subpath. */
+throw new Error("This @hiai-gg/docsmint entrypoint is server-only");

package/dist/storage-quota.d.ts

@@ -46,6 +46,42 @@ export type StorageQuotaService = Readonly<{
     commit(request: StorageQuotaCommitRequest): Promise<StorageQuotaCommitResult>;
     release(request: StorageQuotaReleaseRequest): Promise<StorageQuotaReleaseResult>;
 }>;
+/**
+ * Verified server-side identity for an attachment write.  It is intentionally
+ * richer than the generic quota adapter: attachment storage must be charged
+ * to one workspace, actor and immutable object key before a presign is issued.
+ */
+export type AttachmentStorageQuotaContext = Readonly<{
+    workspaceId: string;
+    actorUserId: string;
+    documentId: string;
+    storageKey: string;
+    proposedSize: number;
+    requestId: string;
+    idempotencyKey: string;
+    signal?: AbortSignal;
+}>;
+export type AttachmentStorageQuotaFinalization = Readonly<{
+    reservationId: string;
+    actualSize: number;
+}>;
+/**
+ * OSS invokes this only after it has verified tenant context and document
+ * access.  A host provider is never exposed to HTTP or browser code.
+ */
+export type AttachmentStorageQuotaAdmission = Readonly<{
+    reserve(context: AttachmentStorageQuotaContext): Promise<Readonly<{
+        id: string;
+    }>>;
+    finalize(context: AttachmentStorageQuotaContext, finalization: AttachmentStorageQuotaFinalization): Promise<void>;
+    releaseReservation(context: AttachmentStorageQuotaContext, reservationId: string): Promise<void>;
+    releaseCommitted(context: AttachmentStorageQuotaContext): Promise<void>;
+}>;
+export declare class MissingAttachmentStorageQuotaAdmissionError extends Error {
+    readonly code: "ATTACHMENT_STORAGE_QUOTA_ADMISSION_MISSING";
+    constructor();
+}
+export declare function requireAttachmentStorageQuotaAdmission(admission: AttachmentStorageQuotaAdmission | undefined): AttachmentStorageQuotaAdmission;
 export declare class StorageQuotaExceededError extends Error {
     readonly code: "STORAGE_QUOTA_EXCEEDED";
     readonly usageBytes: number;

package/dist/storage-quota.js

@@ -1,4 +1,16 @@
 /** Server-only, persistence-agnostic storage quota contract. */
+export class MissingAttachmentStorageQuotaAdmissionError extends Error {
+    code = "ATTACHMENT_STORAGE_QUOTA_ADMISSION_MISSING";
+    constructor() {
+        super("Attachment storage quota admission is required when workspace tenancy is enabled");
+        this.name = "MissingAttachmentStorageQuotaAdmissionError";
+    }
+}
+export function requireAttachmentStorageQuotaAdmission(admission) {
+    if (!admission)
+        throw new MissingAttachmentStorageQuotaAdmissionError();
+    return admission;
+}
 export class StorageQuotaExceededError extends Error {
     code = "STORAGE_QUOTA_EXCEEDED";
     usageBytes;
@@ -71,7 +83,8 @@ export function createStorageQuotaService(adapter) {
             assertReservationId(request.reservationId);
             assertPositiveBytes(request.actualBytes, "actualBytes");
             const result = await adapter.commit(Object.freeze({ ...request }));
-            if (result.status !== "committed" && result.status !== "already_committed") {
+            if (result.status !== "committed" &&
+                result.status !== "already_committed") {
                 throw new TypeError("Storage quota adapter returned an invalid commit status");
             }
             return Object.freeze({ ...result });

package/dist/types.d.ts

@@ -294,11 +294,18 @@ export interface DocsAttachmentPresignInput {
 export interface DocsAttachmentPresignResponse {
     url: string;
     key: string;
+    /**
+     * Opaque server-issued reservation. Present only when workspace storage
+     * enforcement is enabled and required verbatim by confirmAttachment.
+     */
+    quotaReservationId?: string;
     maxSize: number;
     expiresIn: number;
 }
 export interface DocsAttachmentConfirmInput extends DocsAttachmentPresignInput {
     key: string;
+    /** The opaque reservation returned by presignAttachment when present. */
+    quotaReservationId?: string;
 }
 export type DocsApiKeyScope = "global" | `category:${string}:${"read" | "edit" | "write"}`;
 export interface DocsApiKeyCreated {

package/dist/workspace.d.ts

@@ -15,7 +15,10 @@ export type WorkspaceAssertionOptions = Readonly<{
     issuer: string;
     nowSeconds?: number;
     clockSkewSeconds?: number;
-    maxTtlSeconds?: number;
+    /** @deprecated Assertion lifetime is fixed at 60 seconds. */
+    maxTtlSeconds?: never;
 }>;
+export declare const DOCSMINT_WORKSPACE_ASSERTION_TTL_SECONDS = 60;
+export declare const DOCSMINT_WORKSPACE_ASSERTION_CLOCK_SKEW_SECONDS = 5;
 export declare function createDocsmintWorkspaceAssertion(context: DocsmintWorkspaceContext, secret: string): Promise<string>;
 export declare function verifyDocsmintWorkspaceAssertion(assertion: string, options: WorkspaceAssertionOptions): Promise<DocsmintWorkspaceContext>;

package/dist/workspace.js

@@ -4,17 +4,22 @@ export const DOCSMINT_WORKSPACE_CONTEXT_HEADER = "x-docsmint-workspace-context";
 export const EXTERNAL_TENANT_CONTEXT_HEADER = "x-hiai-tenant-context";
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
-const MAX_TTL_SECONDS = 300;
+export const DOCSMINT_WORKSPACE_ASSERTION_TTL_SECONDS = 60;
+export const DOCSMINT_WORKSPACE_ASSERTION_CLOCK_SKEW_SECONDS = 5;
 function toBase64Url(bytes) {
     let binary = "";
     for (const byte of bytes)
         binary += String.fromCharCode(byte);
-    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+    return btoa(binary)
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/, "");
 }
 function fromBase64Url(value) {
     if (!/^[A-Za-z0-9_-]+$/.test(value))
         throw new Error("Invalid base64url");
-    const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - (value.length % 4)) % 4);
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/") +
+        "=".repeat((4 - (value.length % 4)) % 4);
     const binary = atob(padded);
     return Uint8Array.from(binary, (character) => character.charCodeAt(0));
 }
@@ -26,13 +31,20 @@ function assertContext(value) {
     if (!value || typeof value !== "object")
         throw new Error("Invalid workspace assertion payload");
     const context = value;
-    if (typeof context.actorUserId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(context.actorUserId))
+    if (typeof context.actorUserId !== "string" ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(context.actorUserId))
         throw new Error("Invalid actorUserId");
-    if (typeof context.workspaceId !== "string" || !context.workspaceId.trim() || context.workspaceId.trim() !== context.workspaceId || context.workspaceId.length > 128)
+    if (typeof context.workspaceId !== "string" ||
+        !context.workspaceId.trim() ||
+        context.workspaceId.trim() !== context.workspaceId ||
+        context.workspaceId.length > 128)
         throw new Error("Invalid workspaceId");
     if (!["owner", "admin", "editor", "viewer"].includes(context.actorRole))
         throw new Error("Invalid actorRole");
-    if (!Number.isFinite(context.issuedAt) || !Number.isFinite(context.expiresAt) || typeof context.issuer !== "string" || !context.issuer)
+    if (!Number.isFinite(context.issuedAt) ||
+        !Number.isFinite(context.expiresAt) ||
+        typeof context.issuer !== "string" ||
+        !context.issuer)
         throw new Error("Invalid workspace assertion timestamps or issuer");
 }
 export async function createDocsmintWorkspaceAssertion(context, secret) {
@@ -59,8 +71,17 @@ export async function verifyDocsmintWorkspaceAssertion(assertion, options) {
     if (context.issuer !== options.issuer)
         throw new Error("Invalid workspace assertion issuer");
     const now = options.nowSeconds ?? Math.floor(Date.now() / 1000);
-    const skew = options.clockSkewSeconds ?? 5;
-    if (context.issuedAt > now + skew || context.expiresAt <= now - skew || context.expiresAt <= context.issuedAt || context.expiresAt - context.issuedAt > (options.maxTtlSeconds ?? MAX_TTL_SECONDS))
+    const skew = options.clockSkewSeconds ?? DOCSMINT_WORKSPACE_ASSERTION_CLOCK_SKEW_SECONDS;
+    if (!Number.isSafeInteger(skew) ||
+        skew < 0 ||
+        skew > DOCSMINT_WORKSPACE_ASSERTION_CLOCK_SKEW_SECONDS) {
+        throw new Error("Invalid workspace assertion clock skew");
+    }
+    if (context.issuedAt > now + skew ||
+        context.expiresAt <= now - skew ||
+        context.expiresAt <= context.issuedAt ||
+        context.expiresAt - context.issuedAt >
+            DOCSMINT_WORKSPACE_ASSERTION_TTL_SECONDS)
         throw new Error("Invalid workspace assertion lifetime");
     return Object.freeze({ ...context });
 }

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@hiai-gg/docsmint",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "type": "module",
   "browser": {
     "./dist/backend-launcher.js": false,
     "./dist/lifecycle.js": false,
+    "./dist/lifecycle-persistent.js": false,
     "./dist/storage-quota.js": false,
     "./dist/workspace.js": false
   },
@@ -166,12 +167,10 @@
     "packages/db/src/client.ts",
     "packages/db/src/schema.ts",
     "packages/db/src/with-tenant.ts",
-    "packages/cli/src/index.ts",
     "packages/cli/src/client.ts",
     "packages/cli/src/config.ts",
     "packages/cli/src/format.ts",
     "packages/cli/src/commands",
-    "packages/mcp-server/src/index.ts",
     "packages/mcp-server/src/client.ts",
     "packages/mcp-server/src/types.ts",
     "packages/mcp-server/src/tools",

package/packages/cli/src/index.ts

@@ -24,7 +24,7 @@ import { registerSearch } from "./commands/search.js";
 import { registerSnapshot } from "./commands/snapshot.js";
 import { registerUpdate } from "./commands/update.js";
 
-const VERSION = "0.3.5";
+const VERSION = "0.3.6";
 
 const program = new Command();
 program

package/packages/db/src/index.ts

@@ -1,5 +1,14 @@
 export * from "./schema";
 export { db, client } from "./client";
 export type { Database } from "./client";
-export { withTenant, adminTenantContext, shareGuestTenantContext } from "./with-tenant";
-export type { TenantContext } from "./with-tenant";
+export {
+	withTenant,
+	adminTenantContext,
+	shareGuestTenantContext,
+	createActorScopedTransactionExecutor,
+} from "./with-tenant";
+export type {
+	ActorScopedTransactionExecutor,
+	TenantContext,
+	TenantTransaction,
+} from "./with-tenant";

package/packages/db/src/schema.ts

@@ -698,7 +698,8 @@ export const lifecycleOperations = pgTable(
   "lifecycle_operations",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    actorUserId: uuid("actor_user_id").notNull().references(() => users.id, { onDelete: "restrict" }),
+	actorUserId: uuid("actor_user_id").references(() => users.id, { onDelete: "set null" }),
+	actorSubjectHash: text("actor_subject_hash").notNull(),
     idempotencyKey: text("idempotency_key").notNull(),
     operationKind: lifecycleOperationKindEnum("operation_kind").notNull(),
     status: lifecycleOperationStatusEnum("status").notNull().default("pending"),
@@ -717,7 +718,34 @@ export const lifecycleOperations = pgTable(
     uniqueIndex("lifecycle_operations_actor_idempotency_idx").on(table.actorUserId, table.idempotencyKey),
     index("lifecycle_operations_status_lease_idx").on(table.status, table.leaseExpiresAt),
     index("lifecycle_operations_actor_idx").on(table.actorUserId),
-    index("lifecycle_operations_retryable_idx").on(table.status).where(sql`${table.status} = 'retryable'`),
+	index("lifecycle_operations_retryable_idx").on(table.status).where(sql`${table.status} = 'retryable'`),
+	check("lifecycle_operations_actor_subject_hash", sql`${table.actorSubjectHash} ~ '^[a-f0-9]{64}$'`),
+  ],
+);
+
+// Atomically committed alongside a document and its initial version when an
+// authenticated client supplies Idempotency-Key on POST /api/documents.
+export const documentCreateOperations = pgTable(
+  "document_create_operations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    workspaceId: text("workspace_id").notNull(),
+    actorUserId: uuid("actor_user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    idempotencyKey: text("idempotency_key").notNull(),
+    documentId: uuid("document_id")
+      .notNull()
+      .references(() => documents.id, { onDelete: "cascade" }),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+  },
+  (table) => [
+    uniqueIndex("document_create_operations_workspace_actor_key_idx").on(
+      table.workspaceId,
+      table.actorUserId,
+      table.idempotencyKey,
+    ),
+    uniqueIndex("document_create_operations_document_idx").on(table.documentId),
   ],
 );
 

package/packages/db/src/with-tenant.ts

@@ -1,5 +1,42 @@
 import { sql } from "drizzle-orm";
-import { db } from "./client";
+import { db, type Database } from "./client";
+
+/** A transaction carrying the same query surface as the tenant-scoped DB. */
+export type TenantTransaction = Parameters<
+	Parameters<typeof db.transaction>[0]
+>[0];
+
+/**
+ * Server-side adapter for packages that must run short actor-scoped database
+ * transactions without importing this module's process-global client.
+ */
+export interface ActorScopedTransactionExecutor {
+	withActorTransaction<T>(
+		actorUserId: string,
+		operation: (tx: TenantTransaction) => Promise<T>,
+	): Promise<T>;
+}
+
+export function createActorScopedTransactionExecutor(
+	database: Database,
+): ActorScopedTransactionExecutor {
+	return {
+		withActorTransaction(actorUserId, operation) {
+			return database.transaction(async (tx) => {
+				await tx.execute(
+					sql`SELECT set_config('app.current_user_id', ${actorUserId}, true)`,
+				);
+				await tx.execute(
+					sql`SELECT set_config('app.current_user_role', 'user', true)`,
+				);
+				await tx.execute(
+					sql`SELECT set_config('app.current_workspace_id', '', true)`,
+				);
+				return operation(tx);
+			});
+		},
+	};
+}
 
 export interface TenantContext {
 	userId: string;