@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/documents/persistedDocumentRemoval.d.ts

@@ -0,0 +1,44 @@
+import { type DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
+import type { DiscardDocumentToShellResult, DocumentsPersistence, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
+import { type ExecSql } from "../../data/sqlite/sqlSchema.js";
+export declare function deletePersistedDocument(input: {
+    /**
+     * Runs in the same SQLite transaction as the matched document teardown.
+     * Used to atomically pin a verified terminal purge proof.
+     */
+    beforeDeleteInTransaction?: ((transactionExecSql: ExecSql) => Promise<void>) | undefined;
+    canStartDurableMutation?: (() => boolean) | undefined;
+    documentProjectors: DocumentProjectorRegistryInput;
+    execSql: ExecSql;
+    expectedRecord?: StoredDocumentRecord | undefined;
+    localId: string;
+    /**
+     * Runs INSIDE the serialized mutation, after the deletes commit: callers
+     * invalidate their in-memory store generation here so any failure handler
+     * queued behind this mutation observes the invalidation and cannot
+     * resurrect a row the deletion just removed.
+     */
+    onDeletedInMutation?: (() => void) | undefined;
+    persistence: DocumentsPersistence;
+}): Promise<boolean>;
+export type DiscardedDocumentShellResult = DiscardDocumentToShellResult;
+/**
+ * Convert a stuck document's local state to the freshly-discovered-share
+ * shell. The persistence implementation owns the whole sequence — the
+ * eligibility checks (local-only, unlinked, or move-pending documents are
+ * refused), the row teardown, the document-kind client-projection clear, and
+ * the shell upsert — and commits it as ONE transaction, so an interruption
+ * leaves either the fully old or the fully shelled document (never, e.g., a
+ * discarded contact whose projected fields stay visible). Implementations
+ * without the full document schema do not offer the operation and refuse.
+ *
+ * Returns the reclaimable storage keys on success — the deleted rows were
+ * the only durable pointers to those bytes, so the caller reclaims them.
+ */
+export declare function discardPersistedDocumentToShell(input: {
+    documentProjectors: DocumentProjectorRegistryInput;
+    execSql: ExecSql;
+    expectedDocumentId: string;
+    localId: string;
+    persistence: DocumentsPersistence;
+}): Promise<DiscardedDocumentShellResult>;

package/workflows/documents/persistedDocumentRemoval.js

@@ -0,0 +1,70 @@
+import { DEFAULT_DOCUMENT_KIND } from "../../data/documents/documentConstants.js";
+import { resolveDocumentProjectorRegistry, } from "../../data/documents/documentKinds.js";
+import { runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
+import { ensureDocumentClientProjectionTables } from "./persistence.js";
+export async function deletePersistedDocument(input) {
+    const documentProjectors = resolveDocumentProjectorRegistry(input.documentProjectors);
+    await input.persistence.ensureSchema(input.execSql);
+    await ensureDocumentClientProjectionTables({
+        documentProjectors,
+        execSql: input.execSql,
+    });
+    let deleted = false;
+    await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {
+        // The guard runs INSIDE the claimed mutation: the pre-claim answer can go
+        // stale while the deletion waits behind another mutation (a store reset,
+        // a replacement generation's persist), and deleting on the stale answer
+        // would wipe rows the newer generation just wrote.
+        if (input.canStartDurableMutation && !input.canStartDurableMutation()) {
+            return;
+        }
+        if (input.expectedRecord) {
+            const identityMatched = await input.persistence.deleteDocumentIfMatches(lockedExecSql, input.expectedRecord, (transactionExecSql) => (async () => {
+                await documentProjectors.deleteStoredDocumentClientProjection({
+                    documentKind: input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                    execSql: transactionExecSql,
+                    localId: input.localId,
+                });
+                await input.beforeDeleteInTransaction?.(transactionExecSql);
+            })());
+            if (!identityMatched)
+                return;
+        }
+        else {
+            if (input.beforeDeleteInTransaction) {
+                throw new Error("Atomic document purge checkpointing requires an expected document record");
+            }
+            const existing = await input.persistence.loadDocument(lockedExecSql, input.localId);
+            await input.persistence.deleteDocument(lockedExecSql, input.localId);
+            await documentProjectors.deleteStoredDocumentClientProjection({
+                documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                execSql: lockedExecSql,
+                localId: input.localId,
+            });
+        }
+        input.onDeletedInMutation?.();
+        deleted = true;
+    });
+    return deleted;
+}
+/**
+ * Convert a stuck document's local state to the freshly-discovered-share
+ * shell. The persistence implementation owns the whole sequence — the
+ * eligibility checks (local-only, unlinked, or move-pending documents are
+ * refused), the row teardown, the document-kind client-projection clear, and
+ * the shell upsert — and commits it as ONE transaction, so an interruption
+ * leaves either the fully old or the fully shelled document (never, e.g., a
+ * discarded contact whose projected fields stay visible). Implementations
+ * without the full document schema do not offer the operation and refuse.
+ *
+ * Returns the reclaimable storage keys on success — the deleted rows were
+ * the only durable pointers to those bytes, so the caller reclaims them.
+ */
+export async function discardPersistedDocumentToShell(input) {
+    await input.persistence.ensureSchema(input.execSql);
+    if (!input.persistence.discardDocumentToShell) {
+        return { discarded: false };
+    }
+    return input.persistence.discardDocumentToShell(input.execSql, input.localId, input.expectedDocumentId, input.documentProjectors);
+}
+//# sourceMappingURL=persistedDocumentRemoval.js.map

package/workflows/documents/persistedDocumentRemoval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistedDocumentRemoval.js","sourceRoot":"","sources":["persistedDocumentRemoval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAM5C,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAqB7C;IACC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,oCAAoC,CAAC;QACzC,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CACrE,aAAa,EACb,KAAK,CAAC,cAAc,EACpB,CAAC,kBAAkB,EAAE,EAAE,CACrB,CAAC,KAAK,IAAI,EAAE;gBACV,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;oBAC5D,YAAY,EACV,KAAK,CAAC,cAAc,EAAE,YAAY,IAAI,qBAAqB;oBAC7D,OAAO,EAAE,kBAAkB;oBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,yBAAyB,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,CAAC,EAAE,CACP,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,OAAO;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACnD,aAAa,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACF,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;gBAC5D,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,qBAAqB;gBAC7D,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAC7C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../data/documents/documentConstants\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type {\n  DiscardDocumentToShellResult,\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport { ensureDocumentClientProjectionTables } from \"./persistence\";\n\nexport async function deletePersistedDocument(input: {\n  /**\n   * Runs in the same SQLite transaction as the matched document teardown.\n   * Used to atomically pin a verified terminal purge proof.\n   */\n  beforeDeleteInTransaction?:\n    | ((transactionExecSql: ExecSql) => Promise<void>)\n    | undefined;\n  canStartDurableMutation?: (() => boolean) | undefined;\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedRecord?: StoredDocumentRecord | undefined;\n  localId: string;\n  /**\n   * Runs INSIDE the serialized mutation, after the deletes commit: callers\n   * invalidate their in-memory store generation here so any failure handler\n   * queued behind this mutation observes the invalidation and cannot\n   * resurrect a row the deletion just removed.\n   */\n  onDeletedInMutation?: (() => void) | undefined;\n  persistence: DocumentsPersistence;\n}): Promise<boolean> {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.documentProjectors,\n  );\n  await input.persistence.ensureSchema(input.execSql);\n  await ensureDocumentClientProjectionTables({\n    documentProjectors,\n    execSql: input.execSql,\n  });\n  let deleted = false;\n  await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {\n    // The guard runs INSIDE the claimed mutation: the pre-claim answer can go\n    // stale while the deletion waits behind another mutation (a store reset,\n    // a replacement generation's persist), and deleting on the stale answer\n    // would wipe rows the newer generation just wrote.\n    if (input.canStartDurableMutation && !input.canStartDurableMutation()) {\n      return;\n    }\n    if (input.expectedRecord) {\n      const identityMatched = await input.persistence.deleteDocumentIfMatches(\n        lockedExecSql,\n        input.expectedRecord,\n        (transactionExecSql) =>\n          (async () => {\n            await documentProjectors.deleteStoredDocumentClientProjection({\n              documentKind:\n                input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n              execSql: transactionExecSql,\n              localId: input.localId,\n            });\n            await input.beforeDeleteInTransaction?.(transactionExecSql);\n          })(),\n      );\n      if (!identityMatched) return;\n    } else {\n      if (input.beforeDeleteInTransaction) {\n        throw new Error(\n          \"Atomic document purge checkpointing requires an expected document record\",\n        );\n      }\n      const existing = await input.persistence.loadDocument(\n        lockedExecSql,\n        input.localId,\n      );\n      await input.persistence.deleteDocument(lockedExecSql, input.localId);\n      await documentProjectors.deleteStoredDocumentClientProjection({\n        documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n        execSql: lockedExecSql,\n        localId: input.localId,\n      });\n    }\n    input.onDeletedInMutation?.();\n    deleted = true;\n  });\n  return deleted;\n}\n\nexport type DiscardedDocumentShellResult = DiscardDocumentToShellResult;\n\n/**\n * Convert a stuck document's local state to the freshly-discovered-share\n * shell. The persistence implementation owns the whole sequence — the\n * eligibility checks (local-only, unlinked, or move-pending documents are\n * refused), the row teardown, the document-kind client-projection clear, and\n * the shell upsert — and commits it as ONE transaction, so an interruption\n * leaves either the fully old or the fully shelled document (never, e.g., a\n * discarded contact whose projected fields stay visible). Implementations\n * without the full document schema do not offer the operation and refuse.\n *\n * Returns the reclaimable storage keys on success — the deleted rows were\n * the only durable pointers to those bytes, so the caller reclaims them.\n */\nexport async function discardPersistedDocumentToShell(input: {\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedDocumentId: string;\n  localId: string;\n  persistence: DocumentsPersistence;\n}): Promise<DiscardedDocumentShellResult> {\n  await input.persistence.ensureSchema(input.execSql);\n  if (!input.persistence.discardDocumentToShell) {\n    return { discarded: false };\n  }\n  return input.persistence.discardDocumentToShell(\n    input.execSql,\n    input.localId,\n    input.expectedDocumentId,\n    input.documentProjectors,\n  );\n}\n"]}

package/workflows/documents/persistence.d.ts

@@ -0,0 +1,23 @@
+import { type DocumentProjectorRegistry } from "../../data/documents/documentKinds.js";
+import type { DocumentsPersistence, LocalAttachmentRecord, PendingAttachmentRecord, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import { type PersistDocumentStateInput, type PersistedDocumentState } from "./documentMutationCommit.js";
+export type { AttachmentRemovalRows, AttachmentStagingRows, DocumentsPersistence, LocalAttachmentRecord, PendingAttachmentRecord, PendingAttachmentUploadIdentity, PendingUpdateInsert, PendingUpdateRecord, RelinkPersistedDocumentInput, StoredDocumentRecord as DocumentRecord, } from "../../data/persistence/documents/documentsPersistence.js";
+export { DOCUMENTS_APP_KIND, sqlDocumentsPersistence as defaultDocumentsPersistence, } from "../../data/persistence/documents/documentsPersistence.js";
+export { runSerializedSqlMutation } from "../../data/sqlite/sqlSchema.js";
+interface LoadedPersistedDocumentStoreState {
+    document: StoredDocumentRecord | null;
+    historyRestoreState: Awaited<ReturnType<DocumentsPersistence["loadHistoryRestoreState"]>>;
+    localAttachments: LocalAttachmentRecord[];
+    pendingAttachments: PendingAttachmentRecord[];
+}
+export declare function ensureDocumentClientProjectionTables(input: {
+    documentProjectors: DocumentProjectorRegistry;
+    execSql: ExecSql;
+}): Promise<void>;
+export declare function persistDocumentState(input: PersistDocumentStateInput): Promise<PersistedDocumentState | null>;
+export declare function loadPersistedDocumentStoreState(input: {
+    execSql: ExecSql;
+    localId: string;
+    persistence: DocumentsPersistence;
+}): Promise<LoadedPersistedDocumentStoreState>;

package/workflows/documents/persistence.js

@@ -0,0 +1,54 @@
+import { resolveDocumentProjectorRegistry, } from "../../data/documents/documentKinds.js";
+import { ensureSqlTables, runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
+import { commitPreparedDocumentState, } from "./documentMutationCommit.js";
+export { DOCUMENTS_APP_KIND, sqlDocumentsPersistence as defaultDocumentsPersistence, } from "../../data/persistence/documents/documentsPersistence.js";
+// Store-layer teardown-safe writers serialize their generation checks on the
+// same mutation mutex the persistence implementations use; the facade
+// re-export keeps data internals out of the stores.
+export { runSerializedSqlMutation } from "../../data/sqlite/sqlSchema.js";
+const projectionSchemaEnsuresByExecSql = new WeakMap();
+export async function ensureDocumentClientProjectionTables(input) {
+    let ensuresByProjector = projectionSchemaEnsuresByExecSql.get(input.execSql);
+    if (!ensuresByProjector) {
+        ensuresByProjector = new WeakMap();
+        projectionSchemaEnsuresByExecSql.set(input.execSql, ensuresByProjector);
+    }
+    const existingEnsure = ensuresByProjector.get(input.documentProjectors);
+    if (existingEnsure) {
+        await existingEnsure;
+        return;
+    }
+    const tables = input.documentProjectors.getClientProjectionTables();
+    if (tables.length === 0) {
+        ensuresByProjector.set(input.documentProjectors, Promise.resolve());
+        return;
+    }
+    const ensurePromise = ensureSqlTables(input.execSql, tables).catch((error) => {
+        ensuresByProjector.delete(input.documentProjectors);
+        throw error;
+    });
+    ensuresByProjector.set(input.documentProjectors, ensurePromise);
+    await ensurePromise;
+}
+export async function persistDocumentState(input) {
+    const documentProjectors = resolveDocumentProjectorRegistry(input.documentProjectors);
+    await ensureDocumentClientProjectionTables({
+        documentProjectors,
+        execSql: input.execSql,
+    });
+    if (input.canStartDurableMutation && !input.canStartDurableMutation()) {
+        return null;
+    }
+    return runSerializedSqlMutation(input.execSql, (lockedExecSql) => commitPreparedDocumentState({
+        documentProjectors,
+        lockedExecSql,
+        patch: input.patch ?? {},
+        persistInput: input,
+    }));
+}
+export async function loadPersistedDocumentStoreState(input) {
+    const { execSql, localId, persistence } = input;
+    await persistence.ensureSchema(execSql);
+    return persistence.loadDocumentStoreState(execSql, localId);
+}
+//# sourceMappingURL=persistence.js.map

package/workflows/documents/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAQ5C,OAAO,EACL,eAAe,EACf,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,2BAA2B,GAG5B,MAAM,0BAA0B,CAAC;AAclC,OAAO,EACL,kBAAkB,EAClB,uBAAuB,IAAI,2BAA2B,GACvD,MAAM,uDAAuD,CAAC;AAC/D,6EAA6E;AAC7E,sEAAsE;AACtE,oDAAoD;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,MAAM,gCAAgC,GAAG,IAAI,OAAO,EAGjD,CAAC;AAWJ,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAG1D;IACC,IAAI,kBAAkB,GAAG,gCAAgC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,IAAI,OAAO,EAAE,CAAC;QACnC,gCAAgC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,cAAc,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,yBAAyB,EAAE,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAChE,CAAC,KAAc,EAAE,EAAE;QACjB,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC,CACF,CAAC;IACF,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,oCAAoC,CAAC;QACzC,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,EAAE,CAC/D,2BAA2B,CAAC;QAC1B,kBAAkB;QAClB,aAAa;QACb,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,YAAY,EAAE,KAAK;KACpB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAChD,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  type DocumentProjectorRegistry,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type {\n  DocumentsPersistence,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  ensureSqlTables,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport {\n  commitPreparedDocumentState,\n  type PersistDocumentStateInput,\n  type PersistedDocumentState,\n} from \"./documentMutationCommit\";\n\nexport type {\n  AttachmentRemovalRows,\n  AttachmentStagingRows,\n  DocumentsPersistence,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingAttachmentUploadIdentity,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  RelinkPersistedDocumentInput,\n  StoredDocumentRecord as DocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nexport {\n  DOCUMENTS_APP_KIND,\n  sqlDocumentsPersistence as defaultDocumentsPersistence,\n} from \"../../data/persistence/documents/documentsPersistence\";\n// Store-layer teardown-safe writers serialize their generation checks on the\n// same mutation mutex the persistence implementations use; the facade\n// re-export keeps data internals out of the stores.\nexport { runSerializedSqlMutation } from \"../../data/sqlite/sqlSchema\";\n\nconst projectionSchemaEnsuresByExecSql = new WeakMap<\n  ExecSql,\n  WeakMap<DocumentProjectorRegistry, Promise<void>>\n>();\n\ninterface LoadedPersistedDocumentStoreState {\n  document: StoredDocumentRecord | null;\n  historyRestoreState: Awaited<\n    ReturnType<DocumentsPersistence[\"loadHistoryRestoreState\"]>\n  >;\n  localAttachments: LocalAttachmentRecord[];\n  pendingAttachments: PendingAttachmentRecord[];\n}\n\nexport async function ensureDocumentClientProjectionTables(input: {\n  documentProjectors: DocumentProjectorRegistry;\n  execSql: ExecSql;\n}): Promise<void> {\n  let ensuresByProjector = projectionSchemaEnsuresByExecSql.get(input.execSql);\n  if (!ensuresByProjector) {\n    ensuresByProjector = new WeakMap();\n    projectionSchemaEnsuresByExecSql.set(input.execSql, ensuresByProjector);\n  }\n\n  const existingEnsure = ensuresByProjector.get(input.documentProjectors);\n  if (existingEnsure) {\n    await existingEnsure;\n    return;\n  }\n\n  const tables = input.documentProjectors.getClientProjectionTables();\n  if (tables.length === 0) {\n    ensuresByProjector.set(input.documentProjectors, Promise.resolve());\n    return;\n  }\n\n  const ensurePromise = ensureSqlTables(input.execSql, tables).catch(\n    (error: unknown) => {\n      ensuresByProjector.delete(input.documentProjectors);\n      throw error;\n    },\n  );\n  ensuresByProjector.set(input.documentProjectors, ensurePromise);\n  await ensurePromise;\n}\n\nexport async function persistDocumentState(\n  input: PersistDocumentStateInput,\n): Promise<PersistedDocumentState | null> {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.documentProjectors,\n  );\n  await ensureDocumentClientProjectionTables({\n    documentProjectors,\n    execSql: input.execSql,\n  });\n  if (input.canStartDurableMutation && !input.canStartDurableMutation()) {\n    return null;\n  }\n  return runSerializedSqlMutation(input.execSql, (lockedExecSql) =>\n    commitPreparedDocumentState({\n      documentProjectors,\n      lockedExecSql,\n      patch: input.patch ?? {},\n      persistInput: input,\n    }),\n  );\n}\n\nexport async function loadPersistedDocumentStoreState(input: {\n  execSql: ExecSql;\n  localId: string;\n  persistence: DocumentsPersistence;\n}): Promise<LoadedPersistedDocumentStoreState> {\n  const { execSql, localId, persistence } = input;\n  await persistence.ensureSchema(execSql);\n  return persistence.loadDocumentStoreState(execSql, localId);\n}\n"]}

package/workflows/documents/projectionKeys.d.ts

@@ -0,0 +1,14 @@
+import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification.js";
+import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeStateInput } from "../runtimeInput.js";
+export type DocumentProjectionUserKeyResolver = ProjectionUserKeyResolver;
+type ProjectionKeyRuntime = Parameters<typeof createProjectionUserKeyResolver>[0];
+export interface DocumentProjectionKeyRuntime {
+    readonly auth: Pick<WorkflowRuntimeAuthInput, "isAuthenticated" | "userId">;
+    readonly crypto: WorkflowRuntimeCryptoInput;
+    readonly resolveTrustedUserIdentity: ProjectionKeyRuntime["resolveTrustedUserIdentity"];
+    readonly state: Pick<WorkflowRuntimeStateInput, "domainScope">;
+}
+export declare function createDocumentProjectionUserKeyResolver(runtime: DocumentProjectionKeyRuntime): DocumentProjectionUserKeyResolver;
+export declare function didDocumentProjectionKeyRuntimeChange(previousRuntime: DocumentProjectionKeyRuntime, nextRuntime: DocumentProjectionKeyRuntime): boolean;
+export {};

package/workflows/documents/projectionKeys.js

@@ -0,0 +1,22 @@
+import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
+export function createDocumentProjectionUserKeyResolver(runtime) {
+    return createProjectionUserKeyResolver(runtime);
+}
+export function didDocumentProjectionKeyRuntimeChange(previousRuntime, nextRuntime) {
+    // The SDK-owned resolver is stable for the lifetime of Tearleads, but reads
+    // mutable session, identity, and database dependencies. The projection
+    // resolver adds its own per-user cache, so compare that trust context rather
+    // than relying only on the resolver function reference.
+    return (previousRuntime.resolveTrustedUserIdentity !==
+        nextRuntime.resolveTrustedUserIdentity ||
+        previousRuntime.auth.isAuthenticated !== nextRuntime.auth.isAuthenticated ||
+        previousRuntime.auth.userId !== nextRuntime.auth.userId ||
+        previousRuntime.crypto.encapsulationKeyPair !==
+            nextRuntime.crypto.encapsulationKeyPair ||
+        previousRuntime.crypto.signingFingerprint !==
+            nextRuntime.crypto.signingFingerprint ||
+        previousRuntime.crypto.signingKeyPair !==
+            nextRuntime.crypto.signingKeyPair ||
+        previousRuntime.state.domainScope !== nextRuntime.state.domainScope);
+}
+//# sourceMappingURL=projectionKeys.js.map

package/workflows/documents/projectionKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionKeys.js","sourceRoot":"","sources":["projectionKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAmB1G,MAAM,UAAU,uCAAuC,CACrD,OAAqC;IAErC,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,eAA6C,EAC7C,WAAyC;IAEzC,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,wDAAwD;IACxD,OAAO,CACL,eAAe,CAAC,0BAA0B;QACxC,WAAW,CAAC,0BAA0B;QACxC,eAAe,CAAC,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,IAAI,CAAC,eAAe;QACzE,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM;QACvD,eAAe,CAAC,MAAM,CAAC,oBAAoB;YACzC,WAAW,CAAC,MAAM,CAAC,oBAAoB;QACzC,eAAe,CAAC,MAAM,CAAC,kBAAkB;YACvC,WAAW,CAAC,MAAM,CAAC,kBAAkB;QACvC,eAAe,CAAC,MAAM,CAAC,cAAc;YACnC,WAAW,CAAC,MAAM,CAAC,cAAc;QACnC,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,WAAW,CACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeStateInput,\n} from \"../runtimeInput\";\n\nexport type DocumentProjectionUserKeyResolver = ProjectionUserKeyResolver;\ntype ProjectionKeyRuntime = Parameters<\n  typeof createProjectionUserKeyResolver\n>[0];\n\nexport interface DocumentProjectionKeyRuntime {\n  readonly auth: Pick<WorkflowRuntimeAuthInput, \"isAuthenticated\" | \"userId\">;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly resolveTrustedUserIdentity: ProjectionKeyRuntime[\"resolveTrustedUserIdentity\"];\n  readonly state: Pick<WorkflowRuntimeStateInput, \"domainScope\">;\n}\n\nexport function createDocumentProjectionUserKeyResolver(\n  runtime: DocumentProjectionKeyRuntime,\n): DocumentProjectionUserKeyResolver {\n  return createProjectionUserKeyResolver(runtime);\n}\n\nexport function didDocumentProjectionKeyRuntimeChange(\n  previousRuntime: DocumentProjectionKeyRuntime,\n  nextRuntime: DocumentProjectionKeyRuntime,\n): boolean {\n  // The SDK-owned resolver is stable for the lifetime of Tearleads, but reads\n  // mutable session, identity, and database dependencies. The projection\n  // resolver adds its own per-user cache, so compare that trust context rather\n  // than relying only on the resolver function reference.\n  return (\n    previousRuntime.resolveTrustedUserIdentity !==\n      nextRuntime.resolveTrustedUserIdentity ||\n    previousRuntime.auth.isAuthenticated !== nextRuntime.auth.isAuthenticated ||\n    previousRuntime.auth.userId !== nextRuntime.auth.userId ||\n    previousRuntime.crypto.encapsulationKeyPair !==\n      nextRuntime.crypto.encapsulationKeyPair ||\n    previousRuntime.crypto.signingFingerprint !==\n      nextRuntime.crypto.signingFingerprint ||\n    previousRuntime.crypto.signingKeyPair !==\n      nextRuntime.crypto.signingKeyPair ||\n    previousRuntime.state.domainScope !== nextRuntime.state.domainScope\n  );\n}\n"]}

package/workflows/documents/purge.d.ts

@@ -0,0 +1,46 @@
+import type { DocumentPurgeRequest } from "../../internal/validators/request/index.js";
+import { type DocumentPurgeProofResponse, type DocumentPurgeResponse, type DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
+import type { DocumentCreateAuthor, DocumentSyncApi } from "../../data/documents/shared/types.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+interface DocumentPurgeApi {
+    getDocumentPurgeProof(documentId: string, options?: {
+        readonly documentCheckpointManifestHash?: string;
+    }, requestOptions?: {
+        readonly expectedPaymentRequiredOrganizationId?: string;
+    }): Promise<DocumentPurgeProofResponse | null>;
+    getDocumentWriterProjectionResult: NonNullable<DocumentSyncApi["getDocumentWriterProjectionResult"]>;
+    purgeDocument(documentId: string, request: DocumentPurgeRequest, options?: {
+        readonly expectedPaymentRequiredOrganizationId?: string;
+    }): Promise<DocumentPurgeResponse | null>;
+}
+export declare function buildDocumentPurgeRequest(input: {
+    readonly author: DocumentCreateAuthor;
+    readonly eventId?: string | undefined;
+    readonly signedAt?: string | undefined;
+    readonly writerProjection: DocumentWriterProjectionResponse;
+}): Promise<DocumentPurgeRequest>;
+export declare function createVerifiedRemoteDocumentDeletionHandler(input: {
+    readonly apiClient: Pick<DocumentSyncApi, "getDocumentPurgeProof">;
+    readonly execSql: ExecSql;
+    readonly expectedOrganizationId: string;
+    readonly onVerifiedDeletion: (input: {
+        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
+        readonly documentId: string;
+    }) => Promise<void> | void;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+}): (deleted: {
+    readonly documentId: string;
+}) => Promise<void>;
+export declare function purgeRemoteDocument(input: {
+    readonly apiClient: DocumentPurgeApi;
+    readonly author: DocumentCreateAuthor;
+    readonly documentId: string;
+    readonly execSql: ExecSql;
+    readonly onVerifiedPurge: (input: {
+        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
+    }) => Promise<void> | void;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<DocumentPurgeResponse | null>;
+export {};

package/workflows/documents/purge.js

@@ -0,0 +1,184 @@
+import { computeAccessEventBodyHash, KeyingVerificationError, signAccessEvent, } from "../../internal/crypto/index.js";
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../internal/validators/response/index.js";
+import { containerPathRefs, readLinkedContainerIdsFromDocumentManifest, } from "../../data/documents/shared/projection.js";
+import { assertDocumentManifestBundleConsistent, readManifestContainerId, } from "../../data/documents/shared/readers.js";
+import { readCanonicalJson, readCanonicalRecord, } from "../../data/keyingCanonicalJson.js";
+import { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, verifyDocumentWriterProjection, } from "../../data/keyingProjectionVerification.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { documentContainerProjections } from "../../data/keyingProjectionVerification/documentContainerProjections.js";
+const REMOTE_DOCUMENT_ALREADY_PURGED = Symbol("remoteDocumentAlreadyPurged");
+async function loadAuthenticatedDocumentPurgeProof(input) {
+    if (!input.apiClient.getDocumentPurgeProof) {
+        throw new ProjectionDependencyUnavailableError("Remote document deletion is missing a purge-proof endpoint");
+    }
+    const initialProof = await input.apiClient.getDocumentPurgeProof(input.documentId, undefined, {
+        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
+    });
+    if (!initialProof) {
+        // ApiClient returns null for transport, HTTP and response-shape failures.
+        // Even after a deletion hint, absence cannot prove signed-data tampering.
+        // Keep local data and defer deletion until an actual proof verifies.
+        return null;
+    }
+    await verifyDocumentPurgeProofBaseline({
+        execSql: input.execSql,
+        expectedDocumentId: input.documentId,
+        expectedOrganizationId: input.expectedOrganizationId,
+        proof: initialProof,
+        resolveUserKey: input.resolveProjectionUserKey,
+    });
+    // The current API returns complete history to recorded readers. Otherwise
+    // its terminal snapshot needs an exact local pin; a floor refetch cannot
+    // grant missing observation authority.
+    return initialProof;
+}
+async function resolveDocumentPurgeWriterProjection(input) {
+    const result = await input.apiClient.getDocumentWriterProjectionResult(input.documentId, { reportErrors: false });
+    if (result.ok) {
+        return result.data;
+    }
+    if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {
+        return REMOTE_DOCUMENT_ALREADY_PURGED;
+    }
+    result.report();
+    return null;
+}
+export async function buildDocumentPurgeRequest(input) {
+    const identity = await assertDocumentManifestBundleConsistent({
+        bundle: input.writerProjection.documentManifest,
+        label: "Document purge predecessor",
+    });
+    if (identity.documentId !== input.writerProjection.documentId) {
+        throw new Error("Document purge projection identity mismatch");
+    }
+    if (identity.organizationId !== input.author.organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "Document purge author organization mismatch");
+    }
+    const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
+    if (linkedContainerIds.length !== 1) {
+        throw new Error("Document purge requires exactly one linked container");
+    }
+    const [containerId] = linkedContainerIds;
+    const authorizingProjection = documentContainerProjections(input.writerProjection).find((projection) => {
+        const leaf = projection.path.at(-1);
+        return leaf && readManifestContainerId(leaf) === containerId;
+    });
+    const containerManifestHash = authorizingProjection?.path.at(-1)?.manifestHash;
+    if (!authorizingProjection || !containerId || !containerManifestHash) {
+        throw new Error("Document purge authorization path is unavailable");
+    }
+    const authorizingContainerManifestHashes = authorizingProjection.path.map((bundle) => bundle.manifestHash);
+    const body = {
+        authorizingContainerManifestHashes,
+        containerId,
+        containerManifestHash,
+        documentManifestHash: input.writerProjection.documentManifest.manifestHash,
+        eventType: "document.purge",
+    };
+    const unsignedEvent = {
+        version: 1,
+        eventId: input.eventId ?? crypto.randomUUID(),
+        eventType: "document.purge",
+        objectKind: "document",
+        objectId: input.writerProjection.documentId,
+        organizationId: input.author.organizationId,
+        previousManifestHash: input.writerProjection.documentManifest.manifestHash,
+        dependencyManifestHashes: authorizingContainerManifestHashes,
+        bodyHash: await computeAccessEventBodyHash(readCanonicalJson(body, "Document purge body")),
+        signerUserId: input.author.signerUserId,
+        signerDeviceId: input.author.signerDeviceId,
+        signerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    };
+    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
+    return {
+        authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),
+        body: readCanonicalRecord(body, "Document purge body"),
+        event: readCanonicalRecord(event, "Document purge event"),
+    };
+}
+export function createVerifiedRemoteDocumentDeletionHandler(input) {
+    return async ({ documentId }) => {
+        const proof = await loadAuthenticatedDocumentPurgeProof({
+            apiClient: input.apiClient,
+            documentId,
+            execSql: input.execSql,
+            expectedOrganizationId: input.expectedOrganizationId,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+        });
+        if (!proof) {
+            throw new ProjectionDependencyUnavailableError("Remote document deletion is missing its signed purge proof");
+        }
+        const verified = await verifyDocumentPurgeProof({
+            execSql: input.execSql,
+            expectedDocumentId: documentId,
+            expectedOrganizationId: input.expectedOrganizationId,
+            proof,
+            resolveUserKey: input.resolveProjectionUserKey,
+        });
+        await input.onVerifiedDeletion({
+            commitPurgeProof: verified.commitCheckpoints,
+            documentId,
+        });
+    };
+}
+export async function purgeRemoteDocument(input) {
+    const writerProjection = await resolveDocumentPurgeWriterProjection({
+        apiClient: input.apiClient,
+        documentId: input.documentId,
+    });
+    if (!writerProjection) {
+        return null;
+    }
+    if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {
+        const proof = await loadAuthenticatedDocumentPurgeProof({
+            apiClient: input.apiClient,
+            documentId: input.documentId,
+            execSql: input.execSql,
+            expectedOrganizationId: input.author.organizationId,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+        });
+        if (!proof) {
+            throw new ProjectionDependencyUnavailableError("Purged remote document is missing its signed purge proof");
+        }
+        const verified = await verifyDocumentPurgeProof({
+            execSql: input.execSql,
+            expectedDocumentId: input.documentId,
+            expectedOrganizationId: input.author.organizationId,
+            proof,
+            resolveUserKey: input.resolveProjectionUserKey,
+        });
+        await input.onVerifiedPurge({
+            commitPurgeProof: verified.commitCheckpoints,
+        });
+        return { ...proof, reclaimedBlobStorageKeys: [] };
+    }
+    await verifyDocumentWriterProjection({
+        execSql: input.execSql,
+        projection: writerProjection,
+        resolveUserKey: input.resolveProjectionUserKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    const request = await buildDocumentPurgeRequest({
+        author: input.author,
+        writerProjection,
+    });
+    const response = await input.apiClient.purgeDocument(input.documentId, request, {
+        expectedPaymentRequiredOrganizationId: input.author.organizationId,
+    });
+    if (!response) {
+        return null;
+    }
+    const verified = await verifyDocumentPurgeProof({
+        execSql: input.execSql,
+        expectedDocumentId: input.documentId,
+        expectedOrganizationId: input.author.organizationId,
+        proof: response,
+        resolveUserKey: input.resolveProjectionUserKey,
+    });
+    await input.onVerifiedPurge({
+        commitPurgeProof: verified.commitCheckpoints,
+    });
+    return response;
+}
+//# sourceMappingURL=purge.js.map

package/workflows/documents/purge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.js","sourceRoot":"","sources":["purge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAE1B,uBAAuB,EACvB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,6BAA6B,GAI9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,0CAA0C,GAC3C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AAyBpH,MAAM,8BAA8B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAE7E,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAC9D,KAAK,CAAC,UAAU,EAChB,SAAS,EACT;QACE,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CACF,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,0EAA0E;IAC1E,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oCAAoC,CAAC,KAGnD;IAKC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,iCAAiC,CACpE,KAAK,CAAC,UAAU,EAChB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC3E,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,GAAG,kBAAkB,CAAC;IACzC,MAAM,qBAAqB,GAAG,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,MAAM,qBAAqB,GACzB,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACnD,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,kCAAkC,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAChC,CAAC;IACF,MAAM,IAAI,GAAiC;QACzC,kCAAkC;QAClC,WAAW;QACX,qBAAqB;QACrB,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,wBAAwB,EAAE,kCAAkC;QAC5D,QAAQ,EAAE,MAAM,0BAA0B,CACxC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAC/C;QACD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,4BAA4B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3E,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAS3D;IACC,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;SAC/C,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;YAC5C,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAYzC;IACC,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,KAAK,8BAA8B,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;YACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;SAC/C,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,8BAA8B,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAClD,KAAK,CAAC,UAAU,EAChB,OAAO,EACP;QACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KACnE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACnD,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computeAccessEventBodyHash,\n  type DocumentPurgeAccessEventBody,\n  KeyingVerificationError,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeRequest } from \"@tearleads/validators/request\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentPurgeProofResponse,\n  type DocumentPurgeResponse,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  containerPathRefs,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  readManifestContainerId,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentSyncApi,\n} from \"../../data/documents/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../data/keyingCanonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n  verifyDocumentWriterProjection,\n} from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\ninterface DocumentPurgeApi {\n  getDocumentPurgeProof(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjectionResult: NonNullable<\n    DocumentSyncApi[\"getDocumentWriterProjectionResult\"]\n  >;\n  purgeDocument(\n    documentId: string,\n    request: DocumentPurgeRequest,\n    options?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeResponse | null>;\n}\n\nconst REMOTE_DOCUMENT_ALREADY_PURGED = Symbol(\"remoteDocumentAlreadyPurged\");\n\nasync function loadAuthenticatedDocumentPurgeProof(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n}): Promise<DocumentPurgeProofResponse | null> {\n  if (!input.apiClient.getDocumentPurgeProof) {\n    throw new ProjectionDependencyUnavailableError(\n      \"Remote document deletion is missing a purge-proof endpoint\",\n    );\n  }\n  const initialProof = await input.apiClient.getDocumentPurgeProof(\n    input.documentId,\n    undefined,\n    {\n      expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n    },\n  );\n  if (!initialProof) {\n    // ApiClient returns null for transport, HTTP and response-shape failures.\n    // Even after a deletion hint, absence cannot prove signed-data tampering.\n    // Keep local data and defer deletion until an actual proof verifies.\n    return null;\n  }\n  await verifyDocumentPurgeProofBaseline({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.expectedOrganizationId,\n    proof: initialProof,\n    resolveUserKey: input.resolveProjectionUserKey,\n  });\n  // The current API returns complete history to recorded readers. Otherwise\n  // its terminal snapshot needs an exact local pin; a floor refetch cannot\n  // grant missing observation authority.\n  return initialProof;\n}\n\nasync function resolveDocumentPurgeWriterProjection(input: {\n  readonly apiClient: DocumentPurgeApi;\n  readonly documentId: string;\n}): Promise<\n  | DocumentWriterProjectionResponse\n  | typeof REMOTE_DOCUMENT_ALREADY_PURGED\n  | null\n> {\n  const result = await input.apiClient.getDocumentWriterProjectionResult(\n    input.documentId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {\n    return REMOTE_DOCUMENT_ALREADY_PURGED;\n  }\n  result.report();\n  return null;\n}\n\nexport async function buildDocumentPurgeRequest(input: {\n  readonly author: DocumentCreateAuthor;\n  readonly eventId?: string | undefined;\n  readonly signedAt?: string | undefined;\n  readonly writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentPurgeRequest> {\n  const identity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document purge predecessor\",\n  });\n  if (identity.documentId !== input.writerProjection.documentId) {\n    throw new Error(\"Document purge projection identity mismatch\");\n  }\n  if (identity.organizationId !== input.author.organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge author organization mismatch\",\n    );\n  }\n  const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  if (linkedContainerIds.length !== 1) {\n    throw new Error(\"Document purge requires exactly one linked container\");\n  }\n  const [containerId] = linkedContainerIds;\n  const authorizingProjection = documentContainerProjections(\n    input.writerProjection,\n  ).find((projection) => {\n    const leaf = projection.path.at(-1);\n    return leaf && readManifestContainerId(leaf) === containerId;\n  });\n  const containerManifestHash =\n    authorizingProjection?.path.at(-1)?.manifestHash;\n  if (!authorizingProjection || !containerId || !containerManifestHash) {\n    throw new Error(\"Document purge authorization path is unavailable\");\n  }\n  const authorizingContainerManifestHashes = authorizingProjection.path.map(\n    (bundle) => bundle.manifestHash,\n  );\n  const body: DocumentPurgeAccessEventBody = {\n    authorizingContainerManifestHashes,\n    containerId,\n    containerManifestHash,\n    documentManifestHash: input.writerProjection.documentManifest.manifestHash,\n    eventType: \"document.purge\",\n  };\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId ?? crypto.randomUUID(),\n    eventType: \"document.purge\",\n    objectKind: \"document\",\n    objectId: input.writerProjection.documentId,\n    organizationId: input.author.organizationId,\n    previousManifestHash: input.writerProjection.documentManifest.manifestHash,\n    dependencyManifestHashes: authorizingContainerManifestHashes,\n    bodyHash: await computeAccessEventBodyHash(\n      readCanonicalJson(body, \"Document purge body\"),\n    ),\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),\n    body: readCanonicalRecord(body, \"Document purge body\"),\n    event: readCanonicalRecord(event, \"Document purge event\"),\n  };\n}\n\nexport function createVerifiedRemoteDocumentDeletionHandler(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly onVerifiedDeletion: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n    readonly documentId: string;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n}): (deleted: { readonly documentId: string }) => Promise<void> {\n  return async ({ documentId }) => {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.expectedOrganizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Remote document deletion is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: documentId,\n      expectedOrganizationId: input.expectedOrganizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n    });\n    await input.onVerifiedDeletion({\n      commitPurgeProof: verified.commitCheckpoints,\n      documentId,\n    });\n  };\n}\n\nexport async function purgeRemoteDocument(input: {\n  readonly apiClient: DocumentPurgeApi;\n  readonly author: DocumentCreateAuthor;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly onVerifiedPurge: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeResponse | null> {\n  const writerProjection = await resolveDocumentPurgeWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n  });\n  if (!writerProjection) {\n    return null;\n  }\n  if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId: input.documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.author.organizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Purged remote document is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: input.documentId,\n      expectedOrganizationId: input.author.organizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n    });\n    await input.onVerifiedPurge({\n      commitPurgeProof: verified.commitCheckpoints,\n    });\n    return { ...proof, reclaimedBlobStorageKeys: [] };\n  }\n  await verifyDocumentWriterProjection({\n    execSql: input.execSql,\n    projection: writerProjection,\n    resolveUserKey: input.resolveProjectionUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const request = await buildDocumentPurgeRequest({\n    author: input.author,\n    writerProjection,\n  });\n  const response = await input.apiClient.purgeDocument(\n    input.documentId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: input.author.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n  const verified = await verifyDocumentPurgeProof({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.author.organizationId,\n    proof: response,\n    resolveUserKey: input.resolveProjectionUserKey,\n  });\n  await input.onVerifiedPurge({\n    commitPurgeProof: verified.commitCheckpoints,\n  });\n  return response;\n}\n"]}

package/workflows/documents/readOnlyProjectionFailure.js

@@ -0,0 +1,30 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { isDocumentSyncUpdateIsolationError } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
+import { rethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
+import { DocumentRawHistoryUnavailableError } from "./syncContentKeys.js";
+import { projectionIntegrityErrorCode } from "./syncFailureClassification.js";
+export const REFRESH_CACHED_PROJECTION = Symbol("refresh cached projection");
+export function handleReadOnlyProjectionCompletionError(error, input) {
+    if (isDocumentSyncUpdateIsolationError(error)) {
+        throw error;
+    }
+    if (error instanceof DocumentRawHistoryUnavailableError) {
+        if (input.allowCachedProjectionRefresh) {
+            return error;
+        }
+        throw error;
+    }
+    if (input.allowCachedProjectionRefresh &&
+        error instanceof KeyingVerificationError &&
+        error.code === "invalid_shape") {
+        return REFRESH_CACHED_PROJECTION;
+    }
+    // The document-store `document.sync` boundary owns durable reporting; this
+    // helper only decides whether an ordinary projection miss is retryable.
+    rethrowKeyingVerificationError(error);
+    if (projectionIntegrityErrorCode(error) || input.historyMode === "raw") {
+        throw error;
+    }
+    return null;
+}
+//# sourceMappingURL=readOnlyProjectionFailure.js.map

package/workflows/documents/readOnlyProjectionFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readOnlyProjectionFailure.js","sourceRoot":"","sources":["readOnlyProjectionFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAE7E,MAAM,UAAU,uCAAuC,CACrD,KAAc,EACd,KAGC;IAKD,IAAI,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,4BAA4B;QAClC,KAAK,YAAY,uBAAuB;QACxC,KAAK,CAAC,IAAI,KAAK,eAAe,EAC9B,CAAC;QACD,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { isDocumentSyncUpdateIsolationError } from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport { rethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport { DocumentRawHistoryUnavailableError } from \"./syncContentKeys\";\nimport { projectionIntegrityErrorCode } from \"./syncFailureClassification\";\n\nexport const REFRESH_CACHED_PROJECTION = Symbol(\"refresh cached projection\");\n\nexport function handleReadOnlyProjectionCompletionError(\n  error: unknown,\n  input: {\n    allowCachedProjectionRefresh: boolean;\n    historyMode?: \"raw\" | undefined;\n  },\n):\n  | DocumentRawHistoryUnavailableError\n  | null\n  | typeof REFRESH_CACHED_PROJECTION {\n  if (isDocumentSyncUpdateIsolationError(error)) {\n    throw error;\n  }\n  if (error instanceof DocumentRawHistoryUnavailableError) {\n    if (input.allowCachedProjectionRefresh) {\n      return error;\n    }\n    throw error;\n  }\n  if (\n    input.allowCachedProjectionRefresh &&\n    error instanceof KeyingVerificationError &&\n    error.code === \"invalid_shape\"\n  ) {\n    return REFRESH_CACHED_PROJECTION;\n  }\n  // The document-store `document.sync` boundary owns durable reporting; this\n  // helper only decides whether an ordinary projection miss is retryable.\n  rethrowKeyingVerificationError(error);\n  if (projectionIntegrityErrorCode(error) || input.historyMode === \"raw\") {\n    throw error;\n  }\n  return null;\n}\n"]}