@loomwork/compliance 0.0.0-stage → 0.1.0

package/dist/eraseSubject.d.ts

@@ -0,0 +1,540 @@
+import type { EventEnvelope, ExecutionState } from "@loomwork/core";
+import { type ArchiveStore, type DestructionProof, type EventStore } from "@loomwork/event-runtime";
+import { type SubjectIndex } from "./SubjectIndex";
+/** Reserved control stream carrying deferred-erasure facts (ERASURE_PENDING). */
+export declare const ERASURE_STREAM = "__loom_erasure__";
+/**
+ * A compaction / inbox archive (ADR 0138 / 0139) erasure must reckon with. A PLAINTEXT archive
+ * (`sealsSegments` not `true`) holds the subject's moved envelopes in the clear, so a key's destruction
+ * does not reach them: erasure DELETES the subject's segments from it (`deleteExecution`). A SEALING
+ * archive (`EncryptingArchiveStore`, same KeyStore as the log) is erased by the shred itself.
+ */
+export type ErasableArchive = Pick<ArchiveStore, "headers" | "listExecutions" | "read" | "append"> & Partial<Pick<ArchiveStore, "deleteExecution" | "replaceSegments">> & {
+    readonly sealsSegments?: unknown;
+};
+/**
+ * ADR 0140 - the content store the opt-in agent claim-check offloads tool outputs to. Over a PLAINTEXT store
+ * (`sealsContent` not `true`) a key's destruction does not reach a blob, so erasure DELETES the blobs the
+ * subject's envelopes cite (those no other, non-erased execution still cites: ADR 0120 owner-set
+ * semantics) and records it (`ERASURE_CONTENT_DELETE_INTENDED` then `ERASURE_CONTENT_DELETED`). A store
+ * that seals each blob under its owning subject's key (ADR 0143) is erased by the shred itself; the erasure
+ * still journals the blobs it covered and deletes the unreadable ciphertext where the store can.
+ */
+export interface ErasableContent {
+    delete(ref: {
+        __loomContent: string;
+    }): Promise<void>;
+    /** Optional (ContentStore SPI 1.3.0): a conditional delete that spares a blob re-put since `cutoffMs`. */
+    deleteIfUntouchedSince?(ref: {
+        __loomContent: string;
+    }, cutoffMs: number): Promise<boolean>;
+    touchClock?(): Promise<number>;
+    readonly sealsContent?: unknown;
+    /**
+     * ADR 0143 D5 - the ownership proof a SEALING store offers: does the blob open under the subject of
+     * `access` (decrypt and discard)? Erasure deletes only blobs it proves the subject owns; a blob the log
+     * merely CITES (a resume payload, an input, another execution's result) is never deleted.
+     */
+    ownedBy?(ref: {
+        __loomContent: string;
+    }, access: {
+        executionId: string;
+        workflowId: string;
+    }): Promise<boolean>;
+}
+/** What an erasure removed from the content store (recorded durably as `ERASURE_CONTENT_DELETED`). */
+export interface ContentCopiesDeleted {
+    /** Blobs deleted. */
+    deleted: number;
+    /** Blobs the subject's envelopes cited that another, non-erased execution still cites (kept). */
+    retained: number;
+    /**
+     * ADR 0143: over a store that SEALS per subject, how many blobs the shred made unreadable (all the
+     * subject's cited blobs; `deleted` of them were also physically removed). Absent over a plaintext store.
+     */
+    sealed?: number;
+    /**
+     * ADR 0143 D5: over a sealing store, how many cited blobs erasure could NOT prove the subject owns (another
+     * subject's blob the log merely cites, an absent one, or one whose key was already destroyed). They are
+     * counted in `retained`, never deleted, and never reported as the subject's data.
+     */
+    foreign?: number;
+    /**
+     * ADR 0143 D5: over a sealing store, how many cited blobs ownership could not be PROVED for because the
+     * proving key is already destroyed (a re-erasure after a direct shred, or a citation added after the
+     * intent). Counted in `retained`, never deleted: the ciphertext is unreadable but this erasure cannot say
+     * it is the subject's, so it does not claim it.
+     */
+    unprovable?: number;
+}
+/** What an erasure removed from the plaintext archives (recorded durably as `ERASURE_ARCHIVE_DELETED`). */
+export interface ArchivedCopiesDeleted {
+    /** Executions whose ADR 0138 compaction segments were deleted. */
+    executions: string[];
+    /** Reserved streams (inbox, topic, registry, quarantine, late runs; ADR 0139) whose archived segments were deleted. */
+    reservedStreams: string[];
+}
+/** One archived reserved stream whose sender fields erasure redacted (ADR 0139 D12). */
+export interface SenderRedaction {
+    streamId: string;
+    /** How many archived envelopes had the erased subject's identity replaced by `{ erased: true }`. */
+    envelopes: number;
+}
+/** Does `sender` identify the erased subject? */
+export type SenderMatcher = (subjectId: string, tenant: string, sender: {
+    actor?: string;
+    tenant?: string;
+    onBehalfOf?: string;
+}) => boolean;
+/** The default: the sender's `actor` is the subject id (and, in a tenant partition, the tenant agrees). */
+export declare const defaultSenderMatches: SenderMatcher;
+/**
+ * Erasure cannot complete while a plaintext archive still holds the subject's segments and offers no
+ * way to delete them. Thrown BEFORE the key is destroyed (nothing was shredded).
+ */
+export declare class ArchivedCopiesRemainError extends Error {
+    readonly streams: readonly string[];
+    readonly retryable = false;
+    constructor(streams: readonly string[]);
+}
+/**
+ * Erasure cannot complete: a plaintext archive holds other chains' archived inbox envelopes naming the
+ * subject as their sender, and it cannot rewrite a segment atomically (`replaceSegments`, ArchiveStore SPI
+ * 1.1.0), so the identity could not be redacted. Thrown BEFORE the key is destroyed (nothing was shredded).
+ */
+export declare class SenderRedactionUnsupportedError extends Error {
+    readonly streams: readonly string[];
+    readonly retryable = false;
+    constructor(streams: readonly string[]);
+}
+/**
+ * Erasure cannot complete: the subject's logs cite claim-checked blobs (ADR 0140) in a content store that
+ * erasure cannot delete from, or cannot prove other executions do not cite. Thrown BEFORE the key is
+ * destroyed (nothing was shredded).
+ */
+export declare class ContentCopiesRemainError extends Error {
+    readonly count: number;
+    readonly retryable = false;
+    constructor(count: number, why: string);
+}
+/** Every claim-check envelope ref `value` cites (iterative, cycle-safe; the `ref` leaf is not descended). */
+export declare function claimCheckRefsOf(value: unknown, into?: Set<string>): Set<string>;
+/**
+ * ADR 0140 D11 - the claim-check refs an execution cites at a TRUSTED position: the top-level `output`
+ * of a recorded `STEP_COMPLETED` (through a taint wrapper). An envelope the opt-in preset wrote sits
+ * exactly there; one NESTED inside a tool's result is tool-authored data and may be forged, so it is not
+ * evidence that anyone cites the blob.
+ */
+export declare function trustedClaimCheckRefsOf(events: readonly {
+    eventType: string;
+    payload: unknown;
+}[], into?: Set<string>): {
+    refs: Set<string>;
+    sawStep: boolean;
+};
+/**
+ * Destroy a subject's erasure key across the given executions. Wire this to the crypto
+ * plugin's `shredSubject` (bound to the KeyStore + raw store + snapshot store). MUST be
+ * idempotent — a re-invocation for an already-erased subject must not double-tombstone.
+ * `shredSubject` is (ADR 0106): it skips every log already carrying the subject's
+ * `PAYLOAD_SHREDDED` and writes the rest. Do NOT guard on key existence — a key can be gone
+ * while a tombstone append failed, and that guard would never retry it.
+ */
+export type Shredder = (subjectId: string, executionIds: readonly string[], 
+/** The per-call operator assertion of {@link EraseSubjectOptions.force}, when given. */
+options?: {
+    force?: "key-destroyed-elsewhere";
+}) => Promise<void>;
+export interface EraseCoordinatorOptions {
+    index: SubjectIndex;
+    /**
+     * `deleteExecution` (optional) lets erasure reach the RESERVED inbox streams of the subject's
+     * finished executions (ADR 0110 follow-up): see {@link EraseCoordinator}. A store without it
+     * cannot delete a stream, and a payload still in flight in one is then erased only by the key
+     * (the crypto plugin seals inbox payloads under the owner's subject).
+     */
+    eventStore: Pick<EventStore, "read" | "append"> & Partial<Pick<EventStore, "deleteExecution" | "listExecutionsPage" | "listExecutions">>;
+    shred: Shredder;
+    /**
+     * ADR 0138 / 0139 - the archives that may hold the subject's moved envelopes (`defineConfig` wires the
+     * compaction archive, which is also the inbox archive). Over a PLAINTEXT archive erasure DELETES the
+     * subject's compaction segments and their chains' reserved-stream segments after the shred and records
+     * what it deleted; it never reports `erased` while plaintext copies remain. A sealing archive needs
+     * nothing: the key's destruction makes its segments unreadable.
+     */
+    archives?: readonly ErasableArchive[];
+    /**
+     * ADR 0140 - the content store claim-checked tool outputs were offloaded to (`defineConfig` wires
+     * `execution.claimCheck.store`). Over a PLAINTEXT store erasure collects the envelope refs the subject's
+     * executions cite (live logs, archive segments, snapshots) BEFORE the shred, then deletes each one no other
+     * non-erased execution still cites, journaling the intent first. Refused before the shred when blobs are
+     * cited and this is absent, cannot delete, or the event store cannot be enumerated.
+     */
+    content?: ErasableContent;
+    /**
+     * ADR 0139 D12 - which archived inbox envelopes name the erased subject as their SENDER (default:
+     * `sender.actor === subjectId`, and `sender.tenant === tenant` in a tenant partition). Over a PLAINTEXT
+     * archive erasure rewrites those envelopes' `payload.sender` to `{ erased: true }` in the OTHER chains'
+     * archived reserved segments (their digest masks the sender, so it stays valid) and journals
+     * `ERASURE_SENDER_REDACTED`. A SEALING archive needs nothing: the sender is sealed under the SENDER's
+     * subject (`senderSubjectOf` on the crypto stores) and the shred erases it.
+     */
+    senderMatches?: SenderMatcher;
+    /**
+     * ADR 0139 N6 - erase the subject as a message SENDER in the crypto layer (destroy the key their identity
+     * is sealed under, and the seed their handle derives from). Called after `shred`, with the subject id as
+     * the actor and the tenant partition; idempotent. `defineConfig` wires it from the crypto event store's
+     * `eraseSender`. Without it a sealed sender is erased by whatever the app's `shred` destroys.
+     */
+    eraseSender?: (subjectId: string, tenant: string) => Promise<unknown>;
+    /**
+     * ADR 0139 D22 - reinstate an erased sender in the crypto layer (a fresh seed, so a new handle). Backs
+     * {@link EraseCoordinator.reinstateSender}; `defineConfig` wires it from the crypto event store's
+     * `reinstateSender`.
+     */
+    reinstateSender?: (actor: string, tenant: string) => Promise<{
+        reinstated: boolean;
+        ref?: string;
+        epoch?: number;
+    }>;
+    /** Where a recoverable, non-fatal failure is reported (default: `console.warn`). `defineConfig` wires `onWarn`. */
+    onWarn?: (message: string) => void;
+    /**
+     * ADR 0139 N1 - told after erasure deleted or rewrote an archive key, so a runtime that remembers the
+     * key's last archived sequence (`WorkflowRuntime.invalidateInboxArchive`) forgets it. `defineConfig`
+     * wires it.
+     */
+    onArchiveKeyChanged?: (key: string) => void;
+    /**
+     * ADR 0130 D7 (round 5) - proof that the key store destroyed a subject's key
+     * (`(s) => keys.wasDestroyed(s)`). A PROOF function only: returning `true` for a key that was
+     * NOT destroyed in the authoritative store produces a FALSE erasure record, so never stub it.
+     * `defineConfig` wires it from the crypto key store's `wasDestroyed` by default. Required to
+     * resume an erasure in the ShredIncomplete window: the log proves INTENT, not destruction, so
+     * without it a retry that reads `KeyUnavailableError` is refused rather than reported as erased.
+     * For a key store that cannot prove destruction, the operator asserts it per call with
+     * {@link EraseSubjectOptions.force}.
+     */
+    destroyed?: DestructionProof;
+    /**
+     * Cancel one PARKED execution under the coordinator's own authority (a system / compliance
+     * grant, never a caller's), journaled with the given reason (`"erased"`), through the runtime's
+     * normal fenced cancel. REQUIRED for `eraseSubject(..., { parked: "shred" })`: that mode leaves
+     * no owner stuck, so every parked owner is moved to a terminal state BEFORE its subject is
+     * shredded. Resolves `true` when the cancel was performed; a rejection, or an owner that is not
+     * terminal afterwards (it woke up and is running), defers the subject exactly as `"defer"`
+     * does. `defineConfig` wires it to `runtime.cancel(id, reason, runtime.systemOptions())`.
+     */
+    cancel?: (executionId: string, reason: string) => Promise<boolean>;
+    /**
+     * A SECRET (HMAC-SHA256 key) that keeps subject ids off the reserved control stream. Every row the
+     * coordinator writes that names a subject (`ERASURE_PENDING`, and the `ERASURE_*_INTENDED` /
+     * `ERASURE_*_DELETED` / `ERASURE_SENDER_REDACTED` crash-recovery intents) then carries
+     * `subjectRef` (a keyed digest of the tenant and the subject) INSTEAD of `subjectId` and `tenant`,
+     * and recovery matches a row by recomputing the digest. Without it those rows name the subject in
+     * plaintext, permanently (the stream is append-only), so two subjects of one principal erased
+     * together sit side by side.
+     *
+     * Keep it SECRET: whoever holds it can test a candidate id against a row (it is keyed because
+     * subject ids are guessable, so a bare hash would not hide them). At least 16 bytes, else the
+     * constructor throws. Each keyed row also carries `keyId`, a fingerprint of the key that wrote it.
+     * To ROTATE, list the old key in {@link previousControlStreamKeys} until no request it wrote is
+     * open. An open intent written under a key the coordinator does not hold (rotated away, or the
+     * key removed) FAILS the erasure with {@link ControlStreamKeyError} rather than re-planning without
+     * it, because after the shred the subject's logs are unreadable and the intent is the only record
+     * of what is still to delete; a parked row under such a key is reported through `onWarn` at
+     * `loadParked`. Rows written in plaintext before the key was set are still read.
+     */
+    controlStreamKey?: string | Uint8Array;
+    /**
+     * Former {@link controlStreamKey}s, still used to RECOGNISE rows they wrote (never to write).
+     * Keep one here until no erasure it recorded is parked or interrupted.
+     */
+    previousControlStreamKeys?: ReadonlyArray<string | Uint8Array>;
+    /**
+     * ADR 0106 — where compaction checkpoints live. A compacted execution's log no longer holds
+     * its prefix (`[0]` after compacting through the tip), so folding the log alone reads a
+     * TERMINAL execution as still running and a parked erasure would wait for it forever. With
+     * this, liveness folds on the latest snapshot. Pass it whenever the log can be compacted.
+     */
+    snapshotStore?: {
+        loadLatest(executionId: string): Promise<{
+            executionId?: string;
+            sequence: number;
+            state: ExecutionState;
+        } | null>;
+        /**
+         * Optional (SnapshotStore SPI 1.1.0): the latest snapshot as stored at rest, readable after the
+         * subject's key is destroyed. Used ONLY in the destroy window (see `foldExecution`), so a
+         * sealing store (`EncryptingSnapshotStore`) does not make the erasure's retry throw
+         * `KeyUnavailableError`. Without it that retry cannot read a sealed checkpoint and rethrows.
+         */
+        loadLatestSealed?(executionId: string): Promise<{
+            executionId?: string;
+            sequence: number;
+            state: ExecutionState;
+        } | null>;
+    };
+}
+export interface EraseSubjectResult {
+    subjectId: string;
+    /** `erased` — key destroyed now; `parked` — deferred (live execution); `unknown` — no records. */
+    outcome: "erased" | "parked" | "unknown";
+    /** Executions whose data is now shredded (all of the subject's, when erased). */
+    erased: string[];
+    /**
+     * What the erasure deleted from plaintext archives (ADR 0138 / 0139); present when it deleted anything.
+     * The same fact is journaled on the control stream as `ERASURE_ARCHIVE_DELETED`.
+     */
+    archivedCopiesDeleted?: ArchivedCopiesDeleted;
+    /** Claim-checked blobs (ADR 0140) the erasure deleted from a plaintext content store; present when it deleted or kept any it found. */
+    contentDeleted?: ContentCopiesDeleted;
+    /** Archived reserved segments of OTHER chains whose sender fields naming the subject were redacted (plaintext archives). */
+    senderRedactions?: SenderRedaction[];
+    /** Live executions blocking completion (a parked request completes when these terminate). */
+    pending: string[];
+    /**
+     * `parked: "shred"` only — the executions that were PARKED (suspended, waiting for an approval, a
+     * message or a timer) when their subject was shredded. They are not finished: see
+     * {@link EraseSubjectOptions.parked} for what one experiences when it resumes.
+     */
+    parkedShredded?: string[];
+}
+export interface EraseSubjectOptions {
+    /**
+     * What to do with a subject whose executions are not all terminal.
+     *
+     * - `"defer"` (**default**): any execution that is not terminal (a `suspended` one included) is
+     *   LIVE: the request is recorded durably (`ERASURE_PENDING`) and completes when the last one
+     *   terminates. A flow parked forever (a chat agent on `receive`) therefore blocks erasure
+     *   forever; the result is an honest `parked` naming it.
+     * - `"shred"` (opt-in): shred NOW when every non-terminal execution is PARKED (`suspended`).
+     *   An execution that is `running` (or `pending`) still defers: its fold is in flight and would
+     *   read the key as it is destroyed, which is the one hard rule (R4.5). The window between the
+     *   check and the key's destruction is the shredder's to close: a parked execution that a timer,
+     *   a send or a resume wakes in it becomes a running one whose reads fail (below).
+     *
+     * Leaves NO stuck owner. Each parked (`suspended`) owner is first CANCELLED under the
+     * coordinator's own authority ({@link EraseCoordinatorOptions.cancel}, reason `"erased"`, the
+     * same fenced path a normal cancel takes), and only when every owner is terminal is the subject
+     * shredded. The owners are therefore terminal (`cancelled`) afterwards, so the terminal-head
+     * purge of the reserved inbox streams also runs for them, which removes plaintext inbox payloads
+     * written before crypto was enabled (these survive the key's destruction) too. If a cancel
+     * fails, or an owner woke up and is running by then, nothing is shredded and the subject
+     * defers as `"defer"` does (owners already cancelled stay cancelled: the request to erase
+     * them was made). Requires {@link EraseCoordinatorOptions.cancel}; without it the call throws.
+     *
+     * An owner shredded some other way (a direct `shredSubject` call) can still be cancelled:
+     * `cancel` folds the redacted view of its log. `resume` of it rejects with the typed
+     * `PayloadShreddedError` and appends nothing; so does `loadState` (the strict, authoritative
+     * read; its error carries the `redacted` events for operator tooling).
+     */
+    parked?: "defer" | "shred";
+    /**
+     * Whether a `parked` outcome is RECORDED (default `true`). When recorded, the request is journaled
+     * on the reserved control stream (`ERASURE_PENDING`, never cleared, because the stream is
+     * append-only; it names the subject in plaintext unless `controlStreamKey` is set) and the coordinator completes it automatically when the
+     * subject's last live execution terminates, across a restart.
+     *
+     * `record: false` reports `parked` (with `pending`) WITHOUT appending `ERASURE_PENDING` and
+     * WITHOUT registering the auto-completion: the subject id is not written to the control stream by
+     * a park. The caller owns the retry, and must re-call `eraseSubject` until it returns `erased`
+     * (nothing completes it otherwise; `pendingSubjects()` does not list it). Use it when the control
+     * stream must not link subject ids, e.g. a principal keyed under a pseudonymous subject and under
+     * its own id, both erased.
+     *
+     * With `parked: "shred"`, the suspended owners are cancelled BEFORE a running one defers the
+     * subject; with `record: false` nothing durable then says an erasure is owed, so a caller that
+     * stops retrying leaves them cancelled and the subject unerased.
+     *
+     * It governs the PARK only. A request already recorded by an earlier call stays recorded (and
+     * still auto-completes). The `erased` path still journals the subject on the control stream when
+     * it deletes plaintext archive copies, claim-checked content or sender copies (the crash-recovery
+     * intents); `controlStreamKey` keeps the id out of those rows.
+     */
+    record?: boolean;
+    /**
+     * ADR 0130 D7 (round 6) - OPERATOR OVERRIDE, per call (mirrors `ShredOptions.force`). Asserts
+     * that the subject's key was destroyed in the authoritative key store, for a store that cannot
+     * prove it (no `wasDestroyed`). It lets a retry in the ShredIncomplete window complete, and is
+     * passed through to the shredder. A wrong assertion writes a FALSE erasure record while the key
+     * lives on.
+     */
+    force?: "key-destroyed-elsewhere";
+}
+/**
+ * An erasure met an OPEN control-stream intent written under a `controlStreamKey` this coordinator
+ * does not hold, so it cannot tell whether the intent is this subject's. Fail closed: pass the key
+ * that wrote it in `previousControlStreamKeys` (`keyId` names it) and retry.
+ */
+export declare class ControlStreamKeyError extends Error {
+    readonly keyId: string;
+    readonly intentId: string;
+    constructor(keyId: string, intentId: string);
+}
+/**
+ * Coordinates liveness-gated subject erasure and the auto-completion of parked requests.
+ * Feed `handleEvent` the event stream (e.g. from `defineConfig`'s `onEvent`) so a parked
+ * erasure completes the moment the subject's last live execution terminates.
+ */
+export declare class EraseCoordinator {
+    private readonly options;
+    private readonly parked;
+    private readonly parkedRefs;
+    private readonly controlKeys;
+    constructor(options: EraseCoordinatorOptions);
+    /** Best-effort: repopulate the parked set from the durable control stream (restart recovery). */
+    loadParked(): Promise<void>;
+    /**
+     * ADR 0139 D22 (owner ruling 2026-10-31) - REINSTATE an erased message sender: the explicit, RECORDED
+     * operator verb that lets a sender erased by {@link eraseSubject} send again, under a NEW handle (their
+     * old messages stay erased and unlinkable to it). Without it a send from an erased sender keeps throwing
+     * `SenderErasedError`. Journaled on the control stream: `SENDER_REINSTATE_INTENDED` first, then
+     * `SENDER_REINSTATED` with the keyed non-identifying `ref`, the epoch, who (`options.by`) and when;
+     * NEVER the plaintext identity. Resolves with whether anything was reinstated (`false`: the sender is
+     * not erased, or never sent). Throws unless the coordinator was given `reinstateSender`.
+     */
+    reinstateSender(actor: string, tenant?: string, options?: {
+        by?: string;
+    }): Promise<{
+        reinstated: boolean;
+        ref?: string;
+        epoch?: number;
+    }>;
+    /** Request erasure of a subject within a tenant. Shreds now if all executions are terminal, else parks. */
+    eraseSubject(subjectId: string, tenant?: string, options?: EraseSubjectOptions): Promise<EraseSubjectResult>;
+    /** Complete a parked erasure when the subject's last live execution terminates. */
+    handleEvent(event: EventEnvelope): Promise<void>;
+    /**
+     * Close the subject's open `ERASURE_PENDING` rows (either form) now that it is erased, so a restart
+     * does not park it again. Written LAST: a crash before it leaves the request parked, and completing
+     * it again is idempotent. Names the rows, never the subject.
+     */
+    private clearPending;
+    /** Whether a request to erase the subject is parked (registered in memory or restored from either row form). */
+    private isParked;
+    private unpark;
+    /**
+     * The keyed digests a control row may name the subject by: one per held key, the current key's first
+     * (`[]` without `controlStreamKey`). Each part is length-prefixed, so no (tenant, subject) pair can
+     * be spelled as another.
+     */
+    private subjectRefs;
+    /** How a control row names the subject: the current key's digest and its id, or (no key) the plaintext id and tenant. */
+    private subjectFields;
+    /** Whether a control row names the subject, in either form (a plaintext row predates the key). */
+    private rowNames;
+    /**
+     * ADR 0139 D12 - a PLAINTEXT archive holds other chains' reserved segments naming the erased subject as
+     * the sender. Each is rewritten with the identity replaced by an erased marker (the segment digest masks
+     * the sender, so it still verifies; the segment's sender digest is recomputed in the same swap) through
+     * ONE atomic `ArchiveStore.replaceSegments` per key (ADR 0139 N1: a trim on another node that appends a
+     * segment after this read makes the swap fail, and the key is re-read and retried - never lost, never
+     * restored over). The INTENT (the keys) is journaled first (`ERASURE_SENDER_REDACTION_INTENDED`) and the
+     * completion after (`ERASURE_SENDER_REDACTED`), so a crash between the two is finished by the retry from
+     * the intent and a redaction is never unrecorded. Cost: ONE pass over the archive's reserved keys per
+     * erasure (a `listExecutions` prefix walk and a `read` of each key; not indexed - an erasure is rare).
+     * A live, not yet archived envelope keeps its sender until it is trimmed (a plaintext store has no key to
+     * shred; the sender is sealed by default in a sealing deployment, ADR 0139 N6).
+     */
+    private redactSenderCopies;
+    /** `segments` with the matching senders replaced by the erased marker, and the sender digest recomputed. */
+    private redactedSegments;
+    /** Every reserved key (inbox, quarantine, late run) the archive holds, by prefix walk. */
+    private reservedArchiveKeys;
+    /**
+     * Restore what an EARLIER build's staged rewrite left behind (a `__loom_redact__:<key>` whose original
+     * is gone is copied back; a stage whose original is whole is dropped). The current rewrite is one atomic
+     * `replaceSegments` and leaves no stage, so this is a no-op on a clean archive. Run at boot (`loadParked`)
+     * and exposed as an operator verb (`app.recoverArchiveRedactions`). Returns the keys restored.
+     */
+    recoverRedactions(): Promise<string[]>;
+    /**
+     * The open intent of `intentType` for the subject: journaled and not yet completed by a `completionType`
+     * event naming it (`intentId`). The latest one, or `undefined`.
+     */
+    private openIntent;
+    private appendIntent;
+    private appendCompletion;
+    private appendControl;
+    /** The plaintext archives (`sealsSegments` is not `true`); a sealing one is erased by the shred. */
+    private plaintextArchives;
+    /** Every archive key holding the subject's copies: its executions' compaction segments and its chains' reserved segments. */
+    private archivedKeys;
+    private assertArchivesErasable;
+    /** Does the content store seal per subject (so the shred already erased its blobs)? */
+    private sealsContent;
+    /** Every claim-check ref one execution cites: its live log, its archive segments and its snapshot. */
+    private refsOfExecution;
+    /**
+     * BEFORE the shred: collect the claim-check refs the subject's executions cite, drop every one another
+     * (non-erased) execution still cites, refuse when the remainder cannot be deleted, and journal the INTENT
+     * (`ERASURE_CONTENT_DELETE_INTENDED`: the addresses and the touch cutoff). A retry after a crash finds the
+     * open intent and finishes it. `undefined`: nothing to do (no content store sealing, no refs, no intent).
+     */
+    private planContentDeletion;
+    /** AFTER the shred: delete the planned blobs, then journal the completion naming the intent. */
+    private finishContentDeletion;
+    /**
+     * ADR 0138 / 0139 - the physical half of erasure for the ARCHIVES: delete the subject's compaction
+     * segments and its chains' reserved-stream segments from every plaintext archive. ADR 0139 N4: the
+     * INTENT (the keys) is journaled BEFORE anything is deleted (`ERASURE_ARCHIVE_DELETE_INTENDED`) and the
+     * completion after (`ERASURE_ARCHIVE_DELETED`, naming the intent), so a crash between the delete and the
+     * record is finished by the retry from the intent: a deletion is never unrecorded. Idempotent: a retry
+     * with nothing left and no open intent records nothing. Over a sealing archive the shred has already made
+     * the segments unreadable, so nothing is deleted.
+     */
+    private deleteArchivedCopies;
+    /**
+     * ADR 0110 follow-up — erasure reaches payloads still in flight in a RESERVED inbox stream.
+     *
+     * A chain's inbox (`__loom_inbox__:<chainId>`, and with per-topic streams `…#<hash>` and `…#reg`) holds undelivered messages for its owner. The
+     * runtime deletes it when the chain's head turns terminal, but a crash between a sender's append
+     * and its re-read can leave an orphan, and until it is reclaimed it holds the subject's data.
+     * Once the subject is erased (every execution of it terminal, so nothing can consume) the stream
+     * of each execution that is the HEAD of its chain (terminal and not `continued`: a continued
+     * execution's successor owns the stream) is deleted. Idempotent, and a no-op for a store that
+     * cannot delete or an execution whose stream is already gone.
+     *
+     * This is the physical half. The cryptographic half is the key: the crypto plugin seals inbox
+     * payloads under the OWNER's subject, so `shred` makes a payload unreadable even where a stream
+     * cannot be deleted (a consumer then receives the `{ $shredded: true }` marker, never the raw
+     * value).
+     */
+    private purgeInboxStreams;
+    /**
+     * The inbox streams of the chains whose HEAD is among `executions`: terminal and not `continued`
+     * (a continued execution's successor owns the chain's inbox and is judged on its own events).
+     * Folded, and each chain's registry read, while the logs are still readable, so a decrypting store
+     * has not yet lost its key.
+     */
+    private finishedChains;
+    /** The window proof for one call: the operator's per-call `force` asserts it, else the configured proof. */
+    private proofFor;
+    /** Subjects with a deferred erasure still awaiting completion (sorted, deduped across tenants). */
+    pendingSubjects(): string[];
+    /** The subset of `executions` that are not yet terminal (a live fold reading the key), with status. */
+    private liveExecutions;
+    /**
+     * The log, or — when its subject is ALREADY shredded (a direct `shredSubject`, a retry, or the
+     * window between the key's destruction and its tombstone) — the redacted view the typed error
+     * carries: status and tip are plaintext, so liveness and the
+     * chain's head can still be judged, and a re-run of the erasure stays idempotent.
+     */
+    private readErasedOk;
+    /**
+     * The latest checkpoint, or — in the destroy window — its at-rest form. A sealing snapshot store
+     * throws `KeyUnavailableError` for a sealed checkpoint whose key is destroyed while no
+     * `PAYLOAD_SHREDDED` exists yet (the crash between `keys.destroy` and the tombstones), and
+     * `PayloadShreddedError` once a shred is recorded. Both are handled exactly like the event read
+     * (`readErasedOk`) and `shredSubject` (`loadLatestSealed`): the proven shred reads sealed, the
+     * unavailable key only when the log holds this subject's erase intent AND `proof` shows the key
+     * store destroyed it. Anything else (a key merely missing, no intent) is rethrown: real key loss
+     * is never masked. `opaque` is set when the sealed state carries no plaintext status.
+     */
+    private readSnapshotErasedOk;
+    /** One execution's folded status and its first event, or `undefined` when its log is gone. */
+    private foldExecution;
+    private appendPending;
+}
+//# sourceMappingURL=eraseSubject.d.ts.map

package/dist/eraseSubject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eraseSubject.d.ts","sourceRoot":"","sources":["../src/eraseSubject.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAgBhB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAcnE,iFAAiF;AACjF,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAqBjD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC,GAChG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,GAAG,iBAAiB,CAAC,CAAC,GAAG;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,GAAG,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,0GAA0G;IAC1G,sBAAsB,CAAC,CAAC,GAAG,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,CACN,GAAG,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,EAC9B,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAClD,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,sGAAsG;AACtG,MAAM,WAAW,oBAAoB;IACnC,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2GAA2G;AAC3G,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uHAAuH;IACvH,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,CAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7D,OAAO,CAAC;AAEb,2GAA2G;AAC3G,eAAO,MAAM,oBAAoB,EAAE,aACoD,CAAC;AA6BxF;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAEtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IAD/C,QAAQ,CAAC,SAAS,SAAS;gBACN,OAAO,EAAE,SAAS,MAAM,EAAE;CAOhD;AAED;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IAE5C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IAD/C,QAAQ,CAAC,SAAS,SAAS;gBACN,OAAO,EAAE,SAAS,MAAM,EAAE;CAOhD;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAG/C,QAAQ,CAAC,KAAK,EAAE,MAAM;IAFxB,QAAQ,CAAC,SAAS,SAAS;gBAEhB,KAAK,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM;CAQd;AAED,6GAA6G;AAC7G,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAgB3F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,EAC1D,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5B;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAmBzC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE;AAC/B,wFAAwF;AACxF,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,yBAAyB,CAAA;CAAE,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;OAKG;IACH,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,GAAG,oBAAoB,GAAG,gBAAgB,CAAC,CAAC,CAAC;IACzF,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACtC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,mHAAmH;IACnH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACvC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;YAAE,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,cAAc,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACrF;;;;;WAKG;QACH,gBAAgB,CAAC,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;YAAE,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,cAAc,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KACtF,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,iFAAiF;IACjF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uIAAuI;IACvI,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,4HAA4H;IAC5H,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC,6FAA6F;IAC7F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,yBAAyB,CAAC;CACnC;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBADhB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM;CAO5B;AAQD;;;;GAIG;AACH,qBAAa,gBAAgB;IAUf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAGhD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0D;gBAEzD,OAAO,EAAE,uBAAuB;IAwB7D,iGAAiG;IAC3F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsCjC;;;;;;;;OAQG;IACG,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAuB,EAC/B,OAAO,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BjE,2GAA2G;IACrG,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAuB,EAC/B,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAwE9B,mFAAmF;IAC7E,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BtD;;;;OAIG;YACW,YAAY;IAc1B,gHAAgH;IAChH,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,MAAM;IAKd;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAOnB,yHAAyH;IACzH,OAAO,CAAC,aAAa;IAQrB,kGAAkG;IAClG,OAAO,CAAC,QAAQ;IAShB;;;;;;;;;;;;OAYG;YACW,kBAAkB;IAmEhC,4GAA4G;IAC5G,OAAO,CAAC,gBAAgB;IAiCxB,0FAA0F;YAC5E,mBAAmB;IAsBjC;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA8B5C;;;OAGG;YACW,UAAU;YAkCV,YAAY;YASZ,gBAAgB;YAchB,aAAa;IAe3B,oGAAoG;IACpG,OAAO,CAAC,iBAAiB;IAIzB,6HAA6H;YAC/G,YAAY;YAgBZ,sBAAsB;IA4BpC,uFAAuF;IACvF,OAAO,CAAC,YAAY;IAIpB,sGAAsG;YACxF,eAAe;IA+D7B;;;;;OAKG;YACW,mBAAmB;IAqMjC,gGAAgG;YAClF,qBAAqB;IA2DnC;;;;;;;;OAQG;YACW,oBAAoB;IAgDlC;;;;;;;;;;;;;;;OAeG;YACW,iBAAiB;IAgB/B;;;;;OAKG;YACW,cAAc;IA6B5B,4GAA4G;IAC5G,OAAO,CAAC,QAAQ;IAIhB,mGAAmG;IACnG,eAAe,IAAI,MAAM,EAAE;IAe3B,uGAAuG;YACzF,cAAc;IAc5B;;;;;OAKG;YACW,YAAY;IAsB1B;;;;;;;;;OASG;YACW,oBAAoB;IAwBlC,8FAA8F;YAChF,aAAa;YA0Eb,aAAa;CAY5B"}