@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/linkSet/linkSetRemote.js

@@ -0,0 +1,187 @@
+import { acknowledgeDocumentMutation } from "../../../data/documents/shared/mutationAcknowledgement.js";
+import { persistedDocumentLinkSetMutationStateFromResponse } from "../../../data/documents/shared/responses.js";
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
+import { recordDocumentAuthorAccessFailure } from "../authorAccessFailure.js";
+import { completeLinkSetMutationRequest } from "../rotationBaseline.js";
+import { buildMaterializedDocumentLinkSetMutationPlan } from "./index.js";
+import { prepareDocumentLinkBlobRewraps } from "./linkSetBlobRewraps.js";
+import { seedLinkSetWriterProjection } from "./linkSetProjectionSeed.js";
+async function submitLinkSetMutation(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const { apiClient } = input;
+    // Preserve the HTTP failure for the durable move-intent queue.
+    const resultFn = input.operation === "link"
+        ? apiClient.linkDocumentResult.bind(apiClient)
+        : apiClient.unlinkDocumentResult.bind(apiClient);
+    const result = await resultFn(input.documentId, input.request, {
+        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
+    });
+    if (result.ok) {
+        return result.data;
+    }
+    input.onFailure?.({
+        code: result.code,
+        message: result.message,
+        status: result.status,
+    });
+    return null;
+}
+// Cold-cache projection fetches must keep their HTTP status: collapsing a
+// 403 to null would leave an access-denied link/unlink routinely retriable
+// instead of parking its move for the access-restored signal (row 7).
+async function fetchLinkSetProjection(input) {
+    const result = await input.fetchProjectionResult();
+    if (result.ok) {
+        return { failure: null, projection: result.data };
+    }
+    result.report();
+    return {
+        failure: {
+            code: result.code,
+            message: result.message,
+            status: result.status,
+        },
+        projection: null,
+    };
+}
+function fetchLinkSetDocumentProjection(apiClient, documentId) {
+    return fetchLinkSetProjection({
+        fetchProjectionResult: apiClient.getDocumentWriterProjectionResult.bind(apiClient, documentId, { reportErrors: false }),
+    });
+}
+function fetchLinkSetContainerProjection(apiClient, containerId) {
+    return fetchLinkSetProjection({
+        fetchProjectionResult: apiClient.getContainerWriterProjectionResult.bind(apiClient, containerId, { reportErrors: false }),
+    });
+}
+async function completeRemoteDocumentLinkSet(input) {
+    const persistedState = persistedDocumentLinkSetMutationStateFromResponse(input.completedPlan, input.response);
+    await acknowledgeDocumentMutation({
+        execSql: input.execSql,
+        plan: input.completedPlan,
+        stillCurrent: input.stillCurrent,
+    });
+    await seedLinkSetWriterProjection({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        operation: input.operation,
+        priorProjection: input.writerProjection,
+        response: input.response,
+        targetContainerId: input.targetContainerId,
+        targetContainerProjection: input.targetContainerProjection,
+        stillCurrent: input.stillCurrent,
+    });
+    if (input.stillCurrent?.() === false)
+        return null;
+    return {
+        contentKey: input.materializedPlan.contentKey,
+        contentKeyRotated: input.materializedPlan.contentKeyRotated,
+        documentId: input.response.id,
+        linkedContainerIds: [
+            ...input.materializedPlan.plan.state.linkedContainerIds,
+        ],
+        persistedState,
+        plan: input.completedPlan,
+        response: input.response,
+    };
+}
+export async function relinkRemoteDocument(input) {
+    if (input.operation === "unlink" && !input.rotationSnapshot) {
+        throw new Error("Document unlink requires a proven full-history rotation snapshot");
+    }
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote document link-set mutation");
+    const [writerFetch, targetContainerFetch] = await Promise.all([
+        fetchLinkSetDocumentProjection(input.apiClient, input.documentId),
+        fetchLinkSetContainerProjection(input.apiClient, input.targetContainerId),
+    ]);
+    if (!writerFetch.projection || !targetContainerFetch.projection) {
+        for (const failure of orderedProjectionFailures([
+            writerFetch.failure,
+            targetContainerFetch.failure,
+        ])) {
+            input.onFailure?.(failure);
+        }
+        return null;
+    }
+    const writerProjection = writerFetch.projection;
+    const targetContainerProjection = targetContainerFetch.projection;
+    if (input.stillCurrent?.() === false)
+        return null;
+    const signedAt = input.signedAt ?? new Date().toISOString();
+    const materializedPlan = await prepareRemoteLinkSetMutation({ ...input, resolveProjectionUserKey, signedAt }, writerProjection, targetContainerProjection);
+    if (!materializedPlan)
+        return null;
+    const request = await completeLinkSetMutationRequest({
+        author: input.author,
+        materializedPlan,
+        operation: input.operation,
+        rotationSnapshot: input.rotationSnapshot,
+        signedAt,
+    });
+    const completedPlan = { ...materializedPlan.plan, request };
+    if (input.beforeSubmit && !(await input.beforeSubmit()))
+        return null;
+    const response = await submitLinkSetMutation({
+        apiClient: input.apiClient,
+        documentId: completedPlan.documentId,
+        expectedOrganizationId: completedPlan.state.organizationId,
+        onFailure: input.onFailure,
+        operation: input.operation,
+        request: completedPlan.request,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!response) {
+        return null;
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    return completeRemoteDocumentLinkSet({
+        apiClient: input.apiClient,
+        completedPlan,
+        execSql: input.execSql,
+        materializedPlan,
+        operation: input.operation,
+        response,
+        stillCurrent: input.stillCurrent,
+        targetContainerId: input.targetContainerId,
+        targetContainerProjection,
+        writerProjection,
+    });
+}
+// Every projection failure reaches the handler: the queued-move accumulator
+// classifies a vanished container from ANY coded container 404, so a document
+// fetch failure must not hide a container one (or vice versa). A 403 is
+// delivered last, so a single-slot consumer keeps the denial that parks the
+// move (row 7) while the accumulator still sees both.
+function orderedProjectionFailures(failures) {
+    const present = failures.filter((failure) => failure !== null);
+    return [
+        ...present.filter((failure) => failure.status !== 403),
+        ...present.filter((failure) => failure.status === 403),
+    ];
+}
+function prepareRemoteLinkSetMutation(input, writerProjection, targetContainerProjection) {
+    return recordDocumentAuthorAccessFailure(() => nullOnProjectionVerificationCancellation(() => buildMaterializedDocumentLinkSetMutationPlan({
+        author: input.author,
+        expectedSubtreeRoot: input.expectedSubtreeRoot,
+        prepareBlobRewraps: (targets) => prepareDocumentLinkBlobRewraps({
+            ...input,
+            targets,
+            targetContainerProjection,
+            writerProjection,
+        }),
+        contentKey: input.contentKey,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        operation: input.operation,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetContainerProjection,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        writerProjection,
+    })), input.onFailure);
+}
+//# sourceMappingURL=linkSetRemote.js.map

package/workflows/documents/linkSet/linkSetRemote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkSetRemote.js","sourceRoot":"","sources":["linkSetRemote.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,iDAAiD,EAAE,MAAM,0CAA0C,CAAC;AAU7G,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,4CAA4C,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,KAAK,UAAU,qBAAqB,CAAC,KAQpC;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,KAAK,MAAM;QACxB,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE;QAC7D,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AACtE,KAAK,UAAU,sBAAsB,CAAc,KAKlD;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;QACD,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,SAAqC,EACrC,UAAkB;IAElB,OAAO,sBAAsB,CAAC;QAC5B,qBAAqB,EAAE,SAAS,CAAC,iCAAiC,CAAC,IAAI,CACrE,SAAS,EACT,UAAU,EACV,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CACtC,SAAqC,EACrC,WAAmB;IAEnB,OAAO,sBAAsB,CAAC;QAC5B,qBAAqB,EAAE,SAAS,CAAC,kCAAkC,CAAC,IAAI,CACtE,SAAS,EACT,WAAW,EACX,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAe5C;IACC,MAAM,cAAc,GAAG,iDAAiD,CACtE,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,gBAAgB;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC7C,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,iBAAiB;QAC3D,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC7B,kBAAkB,EAAE;YAClB,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB;SACxD;QACD,cAAc;QACd,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAkB1C;IACC,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,mCAAmC,CACpC,CAAC;IACF,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;QACjE,+BAA+B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC;QAChE,KAAK,MAAM,OAAO,IAAI,yBAAyB,CAAC;YAC9C,WAAW,CAAC,OAAO;YACnB,oBAAoB,CAAC,OAAO;SAC7B,CAAC,EAAE,CAAC;YACH,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,UAAU,CAAC;IAChD,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,UAAU,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CACzD,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAChD,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,sDAAsD;AACtD,SAAS,yBAAyB,CAChC,QAA4D;IAE5D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,OAAO,EAA6C,EAAE,CAAC,OAAO,KAAK,IAAI,CACzE,CAAC;IACF,OAAO;QACL,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QACtD,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,KAGC,EACD,gBAAkD,EAClD,yBAA4D;IAE5D,OAAO,iCAAiC,CACtC,GAAG,EAAE,CACH,wCAAwC,CAAC,GAAG,EAAE,CAC5C,4CAA4C,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,OAAO;YACP,yBAAyB;YACzB,gBAAgB;SACjB,CAAC;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,yBAAyB;QACzB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;QACvC,gBAAgB;KACjB,CAAC,CACH,EACH,KAAK,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentLinkSetMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentLinkSetMutationResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { acknowledgeDocumentMutation } from \"../../../data/documents/shared/mutationAcknowledgement\";\nimport { persistedDocumentLinkSetMutationStateFromResponse } from \"../../../data/documents/shared/responses\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetFailureHandler,\n  DocumentLinkSetMutationApi,\n  DocumentLinkSetMutationFailure,\n  DocumentLinkSetMutationOperation,\n  DocumentSyncSubmitFailure,\n  RelinkRemoteDocumentResult,\n} from \"../../../data/documents/shared/types\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { recordDocumentAuthorAccessFailure } from \"../authorAccessFailure\";\nimport type { SubtreePurgeRoot } from \"../purge/subtreePurgeScope\";\nimport { completeLinkSetMutationRequest } from \"../rotationBaseline\";\nimport { buildMaterializedDocumentLinkSetMutationPlan } from \"./index\";\nimport { prepareDocumentLinkBlobRewraps } from \"./linkSetBlobRewraps\";\nimport { seedLinkSetWriterProjection } from \"./linkSetProjectionSeed\";\n\nasync function submitLinkSetMutation(input: {\n  apiClient: DocumentLinkSetMutationApi;\n  documentId: string;\n  expectedOrganizationId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  request: DocumentLinkSetMutationRequest;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<DocumentLinkSetMutationResponse | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const { apiClient } = input;\n  // Preserve the HTTP failure for the durable move-intent queue.\n  const resultFn =\n    input.operation === \"link\"\n      ? apiClient.linkDocumentResult.bind(apiClient)\n      : apiClient.unlinkDocumentResult.bind(apiClient);\n  const result = await resultFn(input.documentId, input.request, {\n    expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n  });\n  if (result.ok) {\n    return result.data;\n  }\n  input.onFailure?.({\n    code: result.code,\n    message: result.message,\n    status: result.status,\n  });\n  return null;\n}\n\ninterface LinkSetProjectionFetch<TProjection> {\n  failure: DocumentLinkSetMutationFailure | null;\n  projection: TProjection | null;\n}\n\n// Cold-cache projection fetches must keep their HTTP status: collapsing a\n// 403 to null would leave an access-denied link/unlink routinely retriable\n// instead of parking its move for the access-restored signal (row 7).\nasync function fetchLinkSetProjection<TProjection>(input: {\n  fetchProjectionResult: () => Promise<\n    | { readonly data: TProjection; readonly ok: true }\n    | DocumentSyncSubmitFailure\n  >;\n}): Promise<LinkSetProjectionFetch<TProjection>> {\n  const result = await input.fetchProjectionResult();\n  if (result.ok) {\n    return { failure: null, projection: result.data };\n  }\n  result.report();\n  return {\n    failure: {\n      code: result.code,\n      message: result.message,\n      status: result.status,\n    },\n    projection: null,\n  };\n}\n\nfunction fetchLinkSetDocumentProjection(\n  apiClient: DocumentLinkSetMutationApi,\n  documentId: string,\n): Promise<LinkSetProjectionFetch<DocumentWriterProjectionResponse>> {\n  return fetchLinkSetProjection({\n    fetchProjectionResult: apiClient.getDocumentWriterProjectionResult.bind(\n      apiClient,\n      documentId,\n      { reportErrors: false },\n    ),\n  });\n}\n\nfunction fetchLinkSetContainerProjection(\n  apiClient: DocumentLinkSetMutationApi,\n  containerId: string,\n): Promise<LinkSetProjectionFetch<ContainerWriterProjectionResponse>> {\n  return fetchLinkSetProjection({\n    fetchProjectionResult: apiClient.getContainerWriterProjectionResult.bind(\n      apiClient,\n      containerId,\n      { reportErrors: false },\n    ),\n  });\n}\n\nasync function completeRemoteDocumentLinkSet(input: {\n  completedPlan: Parameters<\n    typeof persistedDocumentLinkSetMutationStateFromResponse\n  >[0];\n  execSql: ExecSql;\n  materializedPlan: Awaited<\n    ReturnType<typeof buildMaterializedDocumentLinkSetMutationPlan>\n  >;\n  operation: DocumentLinkSetMutationOperation;\n  response: DocumentLinkSetMutationResponse;\n  stillCurrent?: (() => boolean) | undefined;\n  targetContainerId: string;\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n  apiClient: DocumentLinkSetMutationApi;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  const persistedState = persistedDocumentLinkSetMutationStateFromResponse(\n    input.completedPlan,\n    input.response,\n  );\n  await acknowledgeDocumentMutation({\n    execSql: input.execSql,\n    plan: input.completedPlan,\n    stillCurrent: input.stillCurrent,\n  });\n  await seedLinkSetWriterProjection({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    operation: input.operation,\n    priorProjection: input.writerProjection,\n    response: input.response,\n    targetContainerId: input.targetContainerId,\n    targetContainerProjection: input.targetContainerProjection,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  return {\n    contentKey: input.materializedPlan.contentKey,\n    contentKeyRotated: input.materializedPlan.contentKeyRotated,\n    documentId: input.response.id,\n    linkedContainerIds: [\n      ...input.materializedPlan.plan.state.linkedContainerIds,\n    ],\n    persistedState,\n    plan: input.completedPlan,\n    response: input.response,\n  };\n}\n\nexport async function relinkRemoteDocument(input: {\n  beforeSubmit?: (() => Promise<boolean>) | undefined;\n  apiClient: DocumentLinkSetMutationApi;\n  author: DocumentCreateAuthor;\n  contentKey?: Uint8Array | undefined;\n  documentId: string;\n  expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  operation: DocumentLinkSetMutationOperation;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rotationSnapshot?: Uint8Array | undefined;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetContainerId: string;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  if (input.operation === \"unlink\" && !input.rotationSnapshot) {\n    throw new Error(\n      \"Document unlink requires a proven full-history rotation snapshot\",\n    );\n  }\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote document link-set mutation\",\n  );\n  const [writerFetch, targetContainerFetch] = await Promise.all([\n    fetchLinkSetDocumentProjection(input.apiClient, input.documentId),\n    fetchLinkSetContainerProjection(input.apiClient, input.targetContainerId),\n  ]);\n  if (!writerFetch.projection || !targetContainerFetch.projection) {\n    for (const failure of orderedProjectionFailures([\n      writerFetch.failure,\n      targetContainerFetch.failure,\n    ])) {\n      input.onFailure?.(failure);\n    }\n    return null;\n  }\n  const writerProjection = writerFetch.projection;\n  const targetContainerProjection = targetContainerFetch.projection;\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedAt = input.signedAt ?? new Date().toISOString();\n  const materializedPlan = await prepareRemoteLinkSetMutation(\n    { ...input, resolveProjectionUserKey, signedAt },\n    writerProjection,\n    targetContainerProjection,\n  );\n  if (!materializedPlan) return null;\n  const request = await completeLinkSetMutationRequest({\n    author: input.author,\n    materializedPlan,\n    operation: input.operation,\n    rotationSnapshot: input.rotationSnapshot,\n    signedAt,\n  });\n  const completedPlan = { ...materializedPlan.plan, request };\n  if (input.beforeSubmit && !(await input.beforeSubmit())) return null;\n  const response = await submitLinkSetMutation({\n    apiClient: input.apiClient,\n    documentId: completedPlan.documentId,\n    expectedOrganizationId: completedPlan.state.organizationId,\n    onFailure: input.onFailure,\n    operation: input.operation,\n    request: completedPlan.request,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!response) {\n    return null;\n  }\n  if (input.stillCurrent?.() === false) return null;\n  return completeRemoteDocumentLinkSet({\n    apiClient: input.apiClient,\n    completedPlan,\n    execSql: input.execSql,\n    materializedPlan,\n    operation: input.operation,\n    response,\n    stillCurrent: input.stillCurrent,\n    targetContainerId: input.targetContainerId,\n    targetContainerProjection,\n    writerProjection,\n  });\n}\n\n// Every projection failure reaches the handler: the queued-move accumulator\n// classifies a vanished container from ANY coded container 404, so a document\n// fetch failure must not hide a container one (or vice versa). A 403 is\n// delivered last, so a single-slot consumer keeps the denial that parks the\n// move (row 7) while the accumulator still sees both.\nfunction orderedProjectionFailures(\n  failures: readonly (DocumentLinkSetMutationFailure | null)[],\n): DocumentLinkSetMutationFailure[] {\n  const present = failures.filter(\n    (failure): failure is DocumentLinkSetMutationFailure => failure !== null,\n  );\n  return [\n    ...present.filter((failure) => failure.status !== 403),\n    ...present.filter((failure) => failure.status === 403),\n  ];\n}\n\nfunction prepareRemoteLinkSetMutation(\n  input: Parameters<typeof relinkRemoteDocument>[0] & {\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    signedAt: string;\n  },\n  writerProjection: DocumentWriterProjectionResponse,\n  targetContainerProjection: ContainerWriterProjectionResponse,\n) {\n  return recordDocumentAuthorAccessFailure(\n    () =>\n      nullOnProjectionVerificationCancellation(() =>\n        buildMaterializedDocumentLinkSetMutationPlan({\n          author: input.author,\n          expectedSubtreeRoot: input.expectedSubtreeRoot,\n          prepareBlobRewraps: (targets) =>\n            prepareDocumentLinkBlobRewraps({\n              ...input,\n              targets,\n              targetContainerProjection,\n              writerProjection,\n            }),\n          contentKey: input.contentKey,\n          eventId: input.eventId,\n          execSql: input.execSql,\n          operation: input.operation,\n          resolveProjectionUserKey: input.resolveProjectionUserKey,\n          signedAt: input.signedAt,\n          stillCurrent: input.stillCurrent,\n          targetContainerProjection,\n          targetSecretKey: input.targetSecretKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n          writerProjection,\n        }),\n      ),\n    input.onFailure,\n  );\n}\n"]}

package/workflows/documents/purge/index.d.ts

@@ -0,0 +1,53 @@
+import type { DocumentPurgeRequest } from "../../../internal/validators/request/index.js";
+import { type DocumentPurgeProofResponse, type DocumentPurgeResponse, type DocumentWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentCreateAuthor, DocumentSyncApi } from "../../../data/documents/shared/types.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { type SubtreePurgeRoot } from "./subtreePurgeScope.js";
+interface DocumentPurgeApi {
+    getDocumentPurgeProof(documentId: string, options?: {
+        readonly documentCheckpointManifestHash?: string;
+    }, requestOptions?: {
+        readonly expectedPaymentRequiredOrganizationId?: string;
+    }): Promise<DocumentPurgeProofResponse | null>;
+    getDocumentWriterProjectionResult: NonNullable<DocumentSyncApi["getDocumentWriterProjectionResult"]>;
+    purgeDocument(documentId: string, request: DocumentPurgeRequest, options?: {
+        readonly expectedPaymentRequiredOrganizationId?: string;
+    }): Promise<DocumentPurgeResponse | null>;
+}
+export declare function buildDocumentPurgeRequest(input: {
+    readonly author: DocumentCreateAuthor;
+    readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
+    readonly eventId?: string | undefined;
+    readonly signedAt?: string | undefined;
+    readonly writerProjection: DocumentWriterProjectionResponse;
+}): Promise<DocumentPurgeRequest>;
+export declare function createVerifiedRemoteDocumentDeletionHandler(input: {
+    readonly apiClient: Pick<DocumentSyncApi, "getDocumentPurgeProof">;
+    readonly execSql: ExecSql;
+    readonly expectedOrganizationId: string;
+    readonly onVerifiedDeletion: (input: {
+        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
+        readonly documentId: string;
+    }) => Promise<void> | void;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): (deleted: {
+    readonly documentId: string;
+}) => Promise<void>;
+export declare function purgeRemoteDocument(input: {
+    readonly beforeSubmit?: (() => Promise<boolean>) | undefined;
+    readonly apiClient: DocumentPurgeApi;
+    readonly author: DocumentCreateAuthor;
+    readonly documentId: string;
+    readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
+    readonly execSql: ExecSql;
+    readonly onVerifiedPurge: (input: {
+        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
+    }) => Promise<void> | void;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<DocumentPurgeResponse | null>;
+export {};

package/workflows/documents/purge/index.js

@@ -0,0 +1,204 @@
+import { computeAccessEventBodyHash, KeyingVerificationError, signAccessEvent, } from "../../../internal/crypto/index.js";
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../../internal/validators/response/index.js";
+import { containerPathRefs, readLinkedContainerIdsFromDocumentManifest, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentManifestBundleConsistent, readManifestContainerId, } from "../../../data/documents/shared/readers.js";
+import { readCanonicalJson, readCanonicalRecord, } from "../../../data/keying/canonicalJson.js";
+import { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, verifyDocumentWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/documentContainerProjections.js";
+import { assertSubtreePurgePath, } from "./subtreePurgeScope.js";
+const REMOTE_DOCUMENT_ALREADY_PURGED = Symbol("remoteDocumentAlreadyPurged");
+async function loadAuthenticatedDocumentPurgeProof(input) {
+    if (!input.apiClient.getDocumentPurgeProof) {
+        throw new ProjectionDependencyUnavailableError("Remote document deletion is missing a purge-proof endpoint");
+    }
+    const initialProof = await input.apiClient.getDocumentPurgeProof(input.documentId, undefined, {
+        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
+    });
+    if (!initialProof) {
+        // ApiClient returns null for transport, HTTP and response-shape failures.
+        // Even after a deletion hint, absence cannot prove signed-data tampering.
+        // Keep local data and defer deletion until an actual proof verifies.
+        return null;
+    }
+    await verifyDocumentPurgeProofBaseline({
+        execSql: input.execSql,
+        expectedDocumentId: input.documentId,
+        expectedOrganizationId: input.expectedOrganizationId,
+        proof: initialProof,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    // The current API returns complete history to recorded readers. Otherwise
+    // its terminal snapshot needs an exact local pin; a floor refetch cannot
+    // grant missing observation authority.
+    return initialProof;
+}
+async function resolveDocumentPurgeWriterProjection(input) {
+    const result = await input.apiClient.getDocumentWriterProjectionResult(input.documentId, { reportErrors: false });
+    if (result.ok) {
+        return result.data;
+    }
+    if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {
+        return REMOTE_DOCUMENT_ALREADY_PURGED;
+    }
+    result.report();
+    return null;
+}
+export async function buildDocumentPurgeRequest(input) {
+    const identity = await assertDocumentManifestBundleConsistent({
+        bundle: input.writerProjection.documentManifest,
+        label: "Document purge predecessor",
+    });
+    if (identity.documentId !== input.writerProjection.documentId) {
+        throw new Error("Document purge projection identity mismatch");
+    }
+    if (identity.organizationId !== input.author.organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "Document purge author organization mismatch");
+    }
+    const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
+    if (linkedContainerIds.length !== 1) {
+        throw new Error("Document purge requires exactly one linked container");
+    }
+    const [containerId] = linkedContainerIds;
+    const authorizingProjection = documentContainerProjections(input.writerProjection).find((projection) => {
+        const leaf = projection.path.at(-1);
+        return leaf && readManifestContainerId(leaf) === containerId;
+    });
+    const containerManifestHash = authorizingProjection?.path.at(-1)?.manifestHash;
+    if (!authorizingProjection || !containerId || !containerManifestHash) {
+        throw new Error("Document purge authorization path is unavailable");
+    }
+    assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);
+    const authorizingContainerManifestHashes = authorizingProjection.path.map((bundle) => bundle.manifestHash);
+    const body = {
+        authorizingContainerManifestHashes,
+        containerId,
+        containerManifestHash,
+        documentManifestHash: input.writerProjection.documentManifest.manifestHash,
+        eventType: "document.purge",
+    };
+    const unsignedEvent = {
+        version: 1,
+        eventId: input.eventId ?? crypto.randomUUID(),
+        eventType: "document.purge",
+        objectKind: "document",
+        objectId: input.writerProjection.documentId,
+        organizationId: input.author.organizationId,
+        previousManifestHash: input.writerProjection.documentManifest.manifestHash,
+        dependencyManifestHashes: authorizingContainerManifestHashes,
+        bodyHash: await computeAccessEventBodyHash(readCanonicalJson(body, "Document purge body")),
+        signerUserId: input.author.signerUserId,
+        signerDeviceId: input.author.signerDeviceId,
+        signerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    };
+    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
+    return {
+        authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),
+        body: readCanonicalRecord(body, "Document purge body"),
+        event: readCanonicalRecord(event, "Document purge event"),
+    };
+}
+export function createVerifiedRemoteDocumentDeletionHandler(input) {
+    return async ({ documentId }) => {
+        const proof = await loadAuthenticatedDocumentPurgeProof({
+            apiClient: input.apiClient,
+            documentId,
+            execSql: input.execSql,
+            expectedOrganizationId: input.expectedOrganizationId,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        if (!proof) {
+            throw new ProjectionDependencyUnavailableError("Remote document deletion is missing its signed purge proof");
+        }
+        const verified = await verifyDocumentPurgeProof({
+            execSql: input.execSql,
+            expectedDocumentId: documentId,
+            expectedOrganizationId: input.expectedOrganizationId,
+            proof,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        await input.onVerifiedDeletion({
+            commitPurgeProof: verified.commitCheckpoints,
+            documentId,
+        });
+    };
+}
+export async function purgeRemoteDocument(input) {
+    const writerProjection = await resolveDocumentPurgeWriterProjection({
+        apiClient: input.apiClient,
+        documentId: input.documentId,
+    });
+    if (!writerProjection) {
+        return null;
+    }
+    if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {
+        const proof = await loadAuthenticatedDocumentPurgeProof({
+            apiClient: input.apiClient,
+            documentId: input.documentId,
+            execSql: input.execSql,
+            expectedOrganizationId: input.author.organizationId,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        if (!proof) {
+            throw new ProjectionDependencyUnavailableError("Purged remote document is missing its signed purge proof");
+        }
+        const verified = await verifyDocumentPurgeProof({
+            execSql: input.execSql,
+            expectedDocumentId: input.documentId,
+            expectedOrganizationId: input.author.organizationId,
+            proof,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        await input.onVerifiedPurge({
+            commitPurgeProof: verified.commitCheckpoints,
+        });
+        return { ...proof, reclaimedBlobStorageKeys: [] };
+    }
+    await verifyDocumentWriterProjection({
+        execSql: input.execSql,
+        projection: writerProjection,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    const request = await buildDocumentPurgeRequest({
+        author: input.author,
+        expectedSubtreeRoot: input.expectedSubtreeRoot,
+        writerProjection,
+    });
+    if (input.beforeSubmit && !(await input.beforeSubmit()))
+        return null;
+    if (input.stillCurrent?.() === false)
+        return null;
+    const response = await input.apiClient.purgeDocument(input.documentId, request, {
+        expectedPaymentRequiredOrganizationId: input.author.organizationId,
+    });
+    if (!response) {
+        return null;
+    }
+    const verified = await verifyDocumentPurgeProof({
+        execSql: input.execSql,
+        expectedDocumentId: input.documentId,
+        expectedOrganizationId: input.author.organizationId,
+        proof: response,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    await input.onVerifiedPurge({
+        commitPurgeProof: verified.commitCheckpoints,
+    });
+    return response;
+}
+//# sourceMappingURL=index.js.map

package/workflows/documents/purge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAE1B,uBAAuB,EACvB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,6BAA6B,GAI9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,0CAA0C,GAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAK5C,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AAEvH,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,8BAA8B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAE7E,KAAK,UAAU,mCAAmC,CAAC,KAUlD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAC9D,KAAK,CAAC,UAAU,EAChB,SAAS,EACT;QACE,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CACF,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oCAAoC,CAAC,KAGnD;IAKC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,iCAAiC,CACpE,KAAK,CAAC,UAAU,EAChB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC3E,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,GAAG,kBAAkB,CAAC;IACzC,MAAM,qBAAqB,GAAG,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,MAAM,qBAAqB,GACzB,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACnD,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,kCAAkC,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAChC,CAAC;IACF,MAAM,IAAI,GAAiC;QACzC,kCAAkC;QAClC,WAAW;QACX,qBAAqB;QACrB,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,wBAAwB,EAAE,kCAAkC;QAC5D,QAAQ,EAAE,MAAM,0BAA0B,CACxC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAC/C;QACD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,4BAA4B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3E,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAa3D;IACC,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;YAC5C,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAezC;IACC,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,KAAK,8BAA8B,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;YACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,8BAA8B,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAClD,KAAK,CAAC,UAAU,EAChB,OAAO,EACP;QACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KACnE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACnD,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computeAccessEventBodyHash,\n  type DocumentPurgeAccessEventBody,\n  KeyingVerificationError,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeRequest } from \"@tearleads/validators/request\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentPurgeProofResponse,\n  type DocumentPurgeResponse,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  containerPathRefs,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  readManifestContainerId,\n} from \"../../../data/documents/shared/readers\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentSyncApi,\n} from \"../../../data/documents/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../../data/keying/canonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n  verifyDocumentWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/documentContainerProjections\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"./subtreePurgeScope\";\n\ninterface DocumentPurgeApi {\n  getDocumentPurgeProof(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjectionResult: NonNullable<\n    DocumentSyncApi[\"getDocumentWriterProjectionResult\"]\n  >;\n  purgeDocument(\n    documentId: string,\n    request: DocumentPurgeRequest,\n    options?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeResponse | null>;\n}\n\nconst REMOTE_DOCUMENT_ALREADY_PURGED = Symbol(\"remoteDocumentAlreadyPurged\");\n\nasync function loadAuthenticatedDocumentPurgeProof(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeProofResponse | null> {\n  if (!input.apiClient.getDocumentPurgeProof) {\n    throw new ProjectionDependencyUnavailableError(\n      \"Remote document deletion is missing a purge-proof endpoint\",\n    );\n  }\n  const initialProof = await input.apiClient.getDocumentPurgeProof(\n    input.documentId,\n    undefined,\n    {\n      expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n    },\n  );\n  if (!initialProof) {\n    // ApiClient returns null for transport, HTTP and response-shape failures.\n    // Even after a deletion hint, absence cannot prove signed-data tampering.\n    // Keep local data and defer deletion until an actual proof verifies.\n    return null;\n  }\n  await verifyDocumentPurgeProofBaseline({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.expectedOrganizationId,\n    proof: initialProof,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  // The current API returns complete history to recorded readers. Otherwise\n  // its terminal snapshot needs an exact local pin; a floor refetch cannot\n  // grant missing observation authority.\n  return initialProof;\n}\n\nasync function resolveDocumentPurgeWriterProjection(input: {\n  readonly apiClient: DocumentPurgeApi;\n  readonly documentId: string;\n}): Promise<\n  | DocumentWriterProjectionResponse\n  | typeof REMOTE_DOCUMENT_ALREADY_PURGED\n  | null\n> {\n  const result = await input.apiClient.getDocumentWriterProjectionResult(\n    input.documentId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {\n    return REMOTE_DOCUMENT_ALREADY_PURGED;\n  }\n  result.report();\n  return null;\n}\n\nexport async function buildDocumentPurgeRequest(input: {\n  readonly author: DocumentCreateAuthor;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly eventId?: string | undefined;\n  readonly signedAt?: string | undefined;\n  readonly writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentPurgeRequest> {\n  const identity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document purge predecessor\",\n  });\n  if (identity.documentId !== input.writerProjection.documentId) {\n    throw new Error(\"Document purge projection identity mismatch\");\n  }\n  if (identity.organizationId !== input.author.organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge author organization mismatch\",\n    );\n  }\n  const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  if (linkedContainerIds.length !== 1) {\n    throw new Error(\"Document purge requires exactly one linked container\");\n  }\n  const [containerId] = linkedContainerIds;\n  const authorizingProjection = documentContainerProjections(\n    input.writerProjection,\n  ).find((projection) => {\n    const leaf = projection.path.at(-1);\n    return leaf && readManifestContainerId(leaf) === containerId;\n  });\n  const containerManifestHash =\n    authorizingProjection?.path.at(-1)?.manifestHash;\n  if (!authorizingProjection || !containerId || !containerManifestHash) {\n    throw new Error(\"Document purge authorization path is unavailable\");\n  }\n  assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);\n  const authorizingContainerManifestHashes = authorizingProjection.path.map(\n    (bundle) => bundle.manifestHash,\n  );\n  const body: DocumentPurgeAccessEventBody = {\n    authorizingContainerManifestHashes,\n    containerId,\n    containerManifestHash,\n    documentManifestHash: input.writerProjection.documentManifest.manifestHash,\n    eventType: \"document.purge\",\n  };\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId ?? crypto.randomUUID(),\n    eventType: \"document.purge\",\n    objectKind: \"document\",\n    objectId: input.writerProjection.documentId,\n    organizationId: input.author.organizationId,\n    previousManifestHash: input.writerProjection.documentManifest.manifestHash,\n    dependencyManifestHashes: authorizingContainerManifestHashes,\n    bodyHash: await computeAccessEventBodyHash(\n      readCanonicalJson(body, \"Document purge body\"),\n    ),\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),\n    body: readCanonicalRecord(body, \"Document purge body\"),\n    event: readCanonicalRecord(event, \"Document purge event\"),\n  };\n}\n\nexport function createVerifiedRemoteDocumentDeletionHandler(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly onVerifiedDeletion: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n    readonly documentId: string;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): (deleted: { readonly documentId: string }) => Promise<void> {\n  return async ({ documentId }) => {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.expectedOrganizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Remote document deletion is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: documentId,\n      expectedOrganizationId: input.expectedOrganizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedDeletion({\n      commitPurgeProof: verified.commitCheckpoints,\n      documentId,\n    });\n  };\n}\n\nexport async function purgeRemoteDocument(input: {\n  readonly beforeSubmit?: (() => Promise<boolean>) | undefined;\n  readonly apiClient: DocumentPurgeApi;\n  readonly author: DocumentCreateAuthor;\n  readonly documentId: string;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly execSql: ExecSql;\n  readonly onVerifiedPurge: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeResponse | null> {\n  const writerProjection = await resolveDocumentPurgeWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n  });\n  if (!writerProjection) {\n    return null;\n  }\n  if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId: input.documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.author.organizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Purged remote document is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: input.documentId,\n      expectedOrganizationId: input.author.organizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedPurge({\n      commitPurgeProof: verified.commitCheckpoints,\n    });\n    return { ...proof, reclaimedBlobStorageKeys: [] };\n  }\n  await verifyDocumentWriterProjection({\n    execSql: input.execSql,\n    projection: writerProjection,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const request = await buildDocumentPurgeRequest({\n    author: input.author,\n    expectedSubtreeRoot: input.expectedSubtreeRoot,\n    writerProjection,\n  });\n  if (input.beforeSubmit && !(await input.beforeSubmit())) return null;\n  if (input.stillCurrent?.() === false) return null;\n  const response = await input.apiClient.purgeDocument(\n    input.documentId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: input.author.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n  const verified = await verifyDocumentPurgeProof({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.author.organizationId,\n    proof: response,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  await input.onVerifiedPurge({\n    commitPurgeProof: verified.commitCheckpoints,\n  });\n  return response;\n}\n"]}

package/workflows/documents/purge/persistedDocumentRemoval.d.ts

@@ -0,0 +1,44 @@
+import { type DocumentProjectorRegistryInput } from "../../../data/documents/documentKinds.js";
+import type { DiscardDocumentToShellResult, DocumentsPersistence, StoredDocumentRecord } from "../../../data/persistence/documents/documentsPersistence.js";
+import { type ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export declare function deletePersistedDocument(input: {
+    /**
+     * Runs in the same SQLite transaction as the matched document teardown.
+     * Used to atomically pin a verified terminal purge proof.
+     */
+    beforeDeleteInTransaction?: ((transactionExecSql: ExecSql) => Promise<void>) | undefined;
+    canStartDurableMutation?: (() => boolean) | undefined;
+    documentProjectors: DocumentProjectorRegistryInput;
+    execSql: ExecSql;
+    expectedRecord?: StoredDocumentRecord | undefined;
+    localId: string;
+    /**
+     * Runs INSIDE the serialized mutation, after the deletes commit: callers
+     * invalidate their in-memory store generation here so any failure handler
+     * queued behind this mutation observes the invalidation and cannot
+     * resurrect a row the deletion just removed.
+     */
+    onDeletedInMutation?: (() => void) | undefined;
+    persistence: DocumentsPersistence;
+}): Promise<boolean>;
+export type DiscardedDocumentShellResult = DiscardDocumentToShellResult;
+/**
+ * Convert a stuck document's local state to the freshly-discovered-share
+ * shell. The persistence implementation owns the whole sequence — the
+ * eligibility checks (local-only, unlinked, or move-pending documents are
+ * refused), the row teardown, the document-kind client-projection clear, and
+ * the shell upsert — and commits it as ONE transaction, so an interruption
+ * leaves either the fully old or the fully shelled document (never, e.g., a
+ * discarded contact whose projected fields stay visible). Implementations
+ * without the full document schema do not offer the operation and refuse.
+ *
+ * Returns the reclaimable storage keys on success — the deleted rows were
+ * the only durable pointers to those bytes, so the caller reclaims them.
+ */
+export declare function discardPersistedDocumentToShell(input: {
+    documentProjectors: DocumentProjectorRegistryInput;
+    execSql: ExecSql;
+    expectedDocumentId: string;
+    localId: string;
+    persistence: DocumentsPersistence;
+}): Promise<DiscardedDocumentShellResult>;

package/workflows/documents/purge/persistedDocumentRemoval.js

@@ -0,0 +1,70 @@
+import { DEFAULT_DOCUMENT_KIND } from "../../../data/documents/documentConstants.js";
+import { resolveDocumentProjectorRegistry, } from "../../../data/documents/documentKinds.js";
+import { runSerializedSqlMutation, } from "../../../data/sqlite/sqlSchema.js";
+import { ensureDocumentClientProjectionTables } from "../persistence.js";
+export async function deletePersistedDocument(input) {
+    const documentProjectors = resolveDocumentProjectorRegistry(input.documentProjectors);
+    await input.persistence.ensureSchema(input.execSql);
+    await ensureDocumentClientProjectionTables({
+        documentProjectors,
+        execSql: input.execSql,
+    });
+    let deleted = false;
+    await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {
+        // The guard runs INSIDE the claimed mutation: the pre-claim answer can go
+        // stale while the deletion waits behind another mutation (a store reset,
+        // a replacement generation's persist), and deleting on the stale answer
+        // would wipe rows the newer generation just wrote.
+        if (input.canStartDurableMutation && !input.canStartDurableMutation()) {
+            return;
+        }
+        if (input.expectedRecord) {
+            const identityMatched = await input.persistence.deleteDocumentIfMatches(lockedExecSql, input.expectedRecord, (transactionExecSql) => (async () => {
+                await documentProjectors.deleteStoredDocumentClientProjection({
+                    documentKind: input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                    execSql: transactionExecSql,
+                    localId: input.localId,
+                });
+                await input.beforeDeleteInTransaction?.(transactionExecSql);
+            })());
+            if (!identityMatched)
+                return;
+        }
+        else {
+            if (input.beforeDeleteInTransaction) {
+                throw new Error("Atomic document purge checkpointing requires an expected document record");
+            }
+            const existing = await input.persistence.loadDocument(lockedExecSql, input.localId);
+            await input.persistence.deleteDocument(lockedExecSql, input.localId);
+            await documentProjectors.deleteStoredDocumentClientProjection({
+                documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                execSql: lockedExecSql,
+                localId: input.localId,
+            });
+        }
+        input.onDeletedInMutation?.();
+        deleted = true;
+    });
+    return deleted;
+}
+/**
+ * Convert a stuck document's local state to the freshly-discovered-share
+ * shell. The persistence implementation owns the whole sequence — the
+ * eligibility checks (local-only, unlinked, or move-pending documents are
+ * refused), the row teardown, the document-kind client-projection clear, and
+ * the shell upsert — and commits it as ONE transaction, so an interruption
+ * leaves either the fully old or the fully shelled document (never, e.g., a
+ * discarded contact whose projected fields stay visible). Implementations
+ * without the full document schema do not offer the operation and refuse.
+ *
+ * Returns the reclaimable storage keys on success — the deleted rows were
+ * the only durable pointers to those bytes, so the caller reclaims them.
+ */
+export async function discardPersistedDocumentToShell(input) {
+    await input.persistence.ensureSchema(input.execSql);
+    if (!input.persistence.discardDocumentToShell) {
+        return { discarded: false };
+    }
+    return input.persistence.discardDocumentToShell(input.execSql, input.localId, input.expectedDocumentId, input.documentProjectors);
+}
+//# sourceMappingURL=persistedDocumentRemoval.js.map