@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/persistedDocumentRemoval.js

@@ -1,70 +0,0 @@
-import { DEFAULT_DOCUMENT_KIND } from "../../data/documents/documentConstants.js";
-import { resolveDocumentProjectorRegistry, } from "../../data/documents/documentKinds.js";
-import { runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
-import { ensureDocumentClientProjectionTables } from "./persistence.js";
-export async function deletePersistedDocument(input) {
-    const documentProjectors = resolveDocumentProjectorRegistry(input.documentProjectors);
-    await input.persistence.ensureSchema(input.execSql);
-    await ensureDocumentClientProjectionTables({
-        documentProjectors,
-        execSql: input.execSql,
-    });
-    let deleted = false;
-    await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {
-        // The guard runs INSIDE the claimed mutation: the pre-claim answer can go
-        // stale while the deletion waits behind another mutation (a store reset,
-        // a replacement generation's persist), and deleting on the stale answer
-        // would wipe rows the newer generation just wrote.
-        if (input.canStartDurableMutation && !input.canStartDurableMutation()) {
-            return;
-        }
-        if (input.expectedRecord) {
-            const identityMatched = await input.persistence.deleteDocumentIfMatches(lockedExecSql, input.expectedRecord, (transactionExecSql) => (async () => {
-                await documentProjectors.deleteStoredDocumentClientProjection({
-                    documentKind: input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,
-                    execSql: transactionExecSql,
-                    localId: input.localId,
-                });
-                await input.beforeDeleteInTransaction?.(transactionExecSql);
-            })());
-            if (!identityMatched)
-                return;
-        }
-        else {
-            if (input.beforeDeleteInTransaction) {
-                throw new Error("Atomic document purge checkpointing requires an expected document record");
-            }
-            const existing = await input.persistence.loadDocument(lockedExecSql, input.localId);
-            await input.persistence.deleteDocument(lockedExecSql, input.localId);
-            await documentProjectors.deleteStoredDocumentClientProjection({
-                documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,
-                execSql: lockedExecSql,
-                localId: input.localId,
-            });
-        }
-        input.onDeletedInMutation?.();
-        deleted = true;
-    });
-    return deleted;
-}
-/**
- * Convert a stuck document's local state to the freshly-discovered-share
- * shell. The persistence implementation owns the whole sequence — the
- * eligibility checks (local-only, unlinked, or move-pending documents are
- * refused), the row teardown, the document-kind client-projection clear, and
- * the shell upsert — and commits it as ONE transaction, so an interruption
- * leaves either the fully old or the fully shelled document (never, e.g., a
- * discarded contact whose projected fields stay visible). Implementations
- * without the full document schema do not offer the operation and refuse.
- *
- * Returns the reclaimable storage keys on success — the deleted rows were
- * the only durable pointers to those bytes, so the caller reclaims them.
- */
-export async function discardPersistedDocumentToShell(input) {
-    await input.persistence.ensureSchema(input.execSql);
-    if (!input.persistence.discardDocumentToShell) {
-        return { discarded: false };
-    }
-    return input.persistence.discardDocumentToShell(input.execSql, input.localId, input.expectedDocumentId, input.documentProjectors);
-}
-//# sourceMappingURL=persistedDocumentRemoval.js.map

package/workflows/documents/persistedDocumentRemoval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"persistedDocumentRemoval.js","sourceRoot":"","sources":["persistedDocumentRemoval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAM5C,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAqB7C;IACC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,oCAAoC,CAAC;QACzC,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CACrE,aAAa,EACb,KAAK,CAAC,cAAc,EACpB,CAAC,kBAAkB,EAAE,EAAE,CACrB,CAAC,KAAK,IAAI,EAAE;gBACV,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;oBAC5D,YAAY,EACV,KAAK,CAAC,cAAc,EAAE,YAAY,IAAI,qBAAqB;oBAC7D,OAAO,EAAE,kBAAkB;oBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,yBAAyB,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,CAAC,EAAE,CACP,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,OAAO;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACnD,aAAa,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACF,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;gBAC5D,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,qBAAqB;gBAC7D,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAC7C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../data/documents/documentConstants\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type {\n  DiscardDocumentToShellResult,\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport { ensureDocumentClientProjectionTables } from \"./persistence\";\n\nexport async function deletePersistedDocument(input: {\n  /**\n   * Runs in the same SQLite transaction as the matched document teardown.\n   * Used to atomically pin a verified terminal purge proof.\n   */\n  beforeDeleteInTransaction?:\n    | ((transactionExecSql: ExecSql) => Promise<void>)\n    | undefined;\n  canStartDurableMutation?: (() => boolean) | undefined;\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedRecord?: StoredDocumentRecord | undefined;\n  localId: string;\n  /**\n   * Runs INSIDE the serialized mutation, after the deletes commit: callers\n   * invalidate their in-memory store generation here so any failure handler\n   * queued behind this mutation observes the invalidation and cannot\n   * resurrect a row the deletion just removed.\n   */\n  onDeletedInMutation?: (() => void) | undefined;\n  persistence: DocumentsPersistence;\n}): Promise<boolean> {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.documentProjectors,\n  );\n  await input.persistence.ensureSchema(input.execSql);\n  await ensureDocumentClientProjectionTables({\n    documentProjectors,\n    execSql: input.execSql,\n  });\n  let deleted = false;\n  await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {\n    // The guard runs INSIDE the claimed mutation: the pre-claim answer can go\n    // stale while the deletion waits behind another mutation (a store reset,\n    // a replacement generation's persist), and deleting on the stale answer\n    // would wipe rows the newer generation just wrote.\n    if (input.canStartDurableMutation && !input.canStartDurableMutation()) {\n      return;\n    }\n    if (input.expectedRecord) {\n      const identityMatched = await input.persistence.deleteDocumentIfMatches(\n        lockedExecSql,\n        input.expectedRecord,\n        (transactionExecSql) =>\n          (async () => {\n            await documentProjectors.deleteStoredDocumentClientProjection({\n              documentKind:\n                input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n              execSql: transactionExecSql,\n              localId: input.localId,\n            });\n            await input.beforeDeleteInTransaction?.(transactionExecSql);\n          })(),\n      );\n      if (!identityMatched) return;\n    } else {\n      if (input.beforeDeleteInTransaction) {\n        throw new Error(\n          \"Atomic document purge checkpointing requires an expected document record\",\n        );\n      }\n      const existing = await input.persistence.loadDocument(\n        lockedExecSql,\n        input.localId,\n      );\n      await input.persistence.deleteDocument(lockedExecSql, input.localId);\n      await documentProjectors.deleteStoredDocumentClientProjection({\n        documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n        execSql: lockedExecSql,\n        localId: input.localId,\n      });\n    }\n    input.onDeletedInMutation?.();\n    deleted = true;\n  });\n  return deleted;\n}\n\nexport type DiscardedDocumentShellResult = DiscardDocumentToShellResult;\n\n/**\n * Convert a stuck document's local state to the freshly-discovered-share\n * shell. The persistence implementation owns the whole sequence — the\n * eligibility checks (local-only, unlinked, or move-pending documents are\n * refused), the row teardown, the document-kind client-projection clear, and\n * the shell upsert — and commits it as ONE transaction, so an interruption\n * leaves either the fully old or the fully shelled document (never, e.g., a\n * discarded contact whose projected fields stay visible). Implementations\n * without the full document schema do not offer the operation and refuse.\n *\n * Returns the reclaimable storage keys on success — the deleted rows were\n * the only durable pointers to those bytes, so the caller reclaims them.\n */\nexport async function discardPersistedDocumentToShell(input: {\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedDocumentId: string;\n  localId: string;\n  persistence: DocumentsPersistence;\n}): Promise<DiscardedDocumentShellResult> {\n  await input.persistence.ensureSchema(input.execSql);\n  if (!input.persistence.discardDocumentToShell) {\n    return { discarded: false };\n  }\n  return input.persistence.discardDocumentToShell(\n    input.execSql,\n    input.localId,\n    input.expectedDocumentId,\n    input.documentProjectors,\n  );\n}\n"]}

package/workflows/documents/purge.d.ts

@@ -1,53 +0,0 @@
-import type { DocumentPurgeRequest } from "../../internal/validators/request/index.js";
-import { type DocumentPurgeProofResponse, type DocumentPurgeResponse, type DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { DocumentCreateAuthor, DocumentSyncApi } from "../../data/documents/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import { type SubtreePurgeRoot } from "./subtreePurgeScope.js";
-interface DocumentPurgeApi {
-    getDocumentPurgeProof(documentId: string, options?: {
-        readonly documentCheckpointManifestHash?: string;
-    }, requestOptions?: {
-        readonly expectedPaymentRequiredOrganizationId?: string;
-    }): Promise<DocumentPurgeProofResponse | null>;
-    getDocumentWriterProjectionResult: NonNullable<DocumentSyncApi["getDocumentWriterProjectionResult"]>;
-    purgeDocument(documentId: string, request: DocumentPurgeRequest, options?: {
-        readonly expectedPaymentRequiredOrganizationId?: string;
-    }): Promise<DocumentPurgeResponse | null>;
-}
-export declare function buildDocumentPurgeRequest(input: {
-    readonly author: DocumentCreateAuthor;
-    readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
-    readonly eventId?: string | undefined;
-    readonly signedAt?: string | undefined;
-    readonly writerProjection: DocumentWriterProjectionResponse;
-}): Promise<DocumentPurgeRequest>;
-export declare function createVerifiedRemoteDocumentDeletionHandler(input: {
-    readonly apiClient: Pick<DocumentSyncApi, "getDocumentPurgeProof">;
-    readonly execSql: ExecSql;
-    readonly expectedOrganizationId: string;
-    readonly onVerifiedDeletion: (input: {
-        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
-        readonly documentId: string;
-    }) => Promise<void> | void;
-    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): (deleted: {
-    readonly documentId: string;
-}) => Promise<void>;
-export declare function purgeRemoteDocument(input: {
-    readonly beforeSubmit?: (() => Promise<boolean>) | undefined;
-    readonly apiClient: DocumentPurgeApi;
-    readonly author: DocumentCreateAuthor;
-    readonly documentId: string;
-    readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
-    readonly execSql: ExecSql;
-    readonly onVerifiedPurge: (input: {
-        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
-    }) => Promise<void> | void;
-    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<DocumentPurgeResponse | null>;
-export {};

package/workflows/documents/purge.js

@@ -1,204 +0,0 @@
-import { computeAccessEventBodyHash, KeyingVerificationError, signAccessEvent, } from "../../internal/crypto/index.js";
-import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../internal/validators/response/index.js";
-import { containerPathRefs, readLinkedContainerIdsFromDocumentManifest, } from "../../data/documents/shared/projection.js";
-import { assertDocumentManifestBundleConsistent, readManifestContainerId, } from "../../data/documents/shared/readers.js";
-import { readCanonicalJson, readCanonicalRecord, } from "../../data/keying/canonicalJson.js";
-import { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, verifyDocumentWriterProjection, } from "../../data/keyingProjectionVerification/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { documentContainerProjections } from "../../data/keyingProjectionVerification/documentContainerProjections.js";
-import { assertSubtreePurgePath, } from "./subtreePurgeScope.js";
-const REMOTE_DOCUMENT_ALREADY_PURGED = Symbol("remoteDocumentAlreadyPurged");
-async function loadAuthenticatedDocumentPurgeProof(input) {
-    if (!input.apiClient.getDocumentPurgeProof) {
-        throw new ProjectionDependencyUnavailableError("Remote document deletion is missing a purge-proof endpoint");
-    }
-    const initialProof = await input.apiClient.getDocumentPurgeProof(input.documentId, undefined, {
-        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
-    });
-    if (!initialProof) {
-        // ApiClient returns null for transport, HTTP and response-shape failures.
-        // Even after a deletion hint, absence cannot prove signed-data tampering.
-        // Keep local data and defer deletion until an actual proof verifies.
-        return null;
-    }
-    await verifyDocumentPurgeProofBaseline({
-        execSql: input.execSql,
-        expectedDocumentId: input.documentId,
-        expectedOrganizationId: input.expectedOrganizationId,
-        proof: initialProof,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    // The current API returns complete history to recorded readers. Otherwise
-    // its terminal snapshot needs an exact local pin; a floor refetch cannot
-    // grant missing observation authority.
-    return initialProof;
-}
-async function resolveDocumentPurgeWriterProjection(input) {
-    const result = await input.apiClient.getDocumentWriterProjectionResult(input.documentId, { reportErrors: false });
-    if (result.ok) {
-        return result.data;
-    }
-    if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {
-        return REMOTE_DOCUMENT_ALREADY_PURGED;
-    }
-    result.report();
-    return null;
-}
-export async function buildDocumentPurgeRequest(input) {
-    const identity = await assertDocumentManifestBundleConsistent({
-        bundle: input.writerProjection.documentManifest,
-        label: "Document purge predecessor",
-    });
-    if (identity.documentId !== input.writerProjection.documentId) {
-        throw new Error("Document purge projection identity mismatch");
-    }
-    if (identity.organizationId !== input.author.organizationId) {
-        throw new KeyingVerificationError("object_mismatch", "Document purge author organization mismatch");
-    }
-    const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
-    if (linkedContainerIds.length !== 1) {
-        throw new Error("Document purge requires exactly one linked container");
-    }
-    const [containerId] = linkedContainerIds;
-    const authorizingProjection = documentContainerProjections(input.writerProjection).find((projection) => {
-        const leaf = projection.path.at(-1);
-        return leaf && readManifestContainerId(leaf) === containerId;
-    });
-    const containerManifestHash = authorizingProjection?.path.at(-1)?.manifestHash;
-    if (!authorizingProjection || !containerId || !containerManifestHash) {
-        throw new Error("Document purge authorization path is unavailable");
-    }
-    assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);
-    const authorizingContainerManifestHashes = authorizingProjection.path.map((bundle) => bundle.manifestHash);
-    const body = {
-        authorizingContainerManifestHashes,
-        containerId,
-        containerManifestHash,
-        documentManifestHash: input.writerProjection.documentManifest.manifestHash,
-        eventType: "document.purge",
-    };
-    const unsignedEvent = {
-        version: 1,
-        eventId: input.eventId ?? crypto.randomUUID(),
-        eventType: "document.purge",
-        objectKind: "document",
-        objectId: input.writerProjection.documentId,
-        organizationId: input.author.organizationId,
-        previousManifestHash: input.writerProjection.documentManifest.manifestHash,
-        dependencyManifestHashes: authorizingContainerManifestHashes,
-        bodyHash: await computeAccessEventBodyHash(readCanonicalJson(body, "Document purge body")),
-        signerUserId: input.author.signerUserId,
-        signerDeviceId: input.author.signerDeviceId,
-        signerKeyFingerprint: input.author.signerKeyFingerprint,
-        signedAt: input.signedAt ?? new Date().toISOString(),
-    };
-    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
-    return {
-        authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),
-        body: readCanonicalRecord(body, "Document purge body"),
-        event: readCanonicalRecord(event, "Document purge event"),
-    };
-}
-export function createVerifiedRemoteDocumentDeletionHandler(input) {
-    return async ({ documentId }) => {
-        const proof = await loadAuthenticatedDocumentPurgeProof({
-            apiClient: input.apiClient,
-            documentId,
-            execSql: input.execSql,
-            expectedOrganizationId: input.expectedOrganizationId,
-            resolveProjectionUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        if (!proof) {
-            throw new ProjectionDependencyUnavailableError("Remote document deletion is missing its signed purge proof");
-        }
-        const verified = await verifyDocumentPurgeProof({
-            execSql: input.execSql,
-            expectedDocumentId: documentId,
-            expectedOrganizationId: input.expectedOrganizationId,
-            proof,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        await input.onVerifiedDeletion({
-            commitPurgeProof: verified.commitCheckpoints,
-            documentId,
-        });
-    };
-}
-export async function purgeRemoteDocument(input) {
-    const writerProjection = await resolveDocumentPurgeWriterProjection({
-        apiClient: input.apiClient,
-        documentId: input.documentId,
-    });
-    if (!writerProjection) {
-        return null;
-    }
-    if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {
-        const proof = await loadAuthenticatedDocumentPurgeProof({
-            apiClient: input.apiClient,
-            documentId: input.documentId,
-            execSql: input.execSql,
-            expectedOrganizationId: input.author.organizationId,
-            resolveProjectionUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        if (!proof) {
-            throw new ProjectionDependencyUnavailableError("Purged remote document is missing its signed purge proof");
-        }
-        const verified = await verifyDocumentPurgeProof({
-            execSql: input.execSql,
-            expectedDocumentId: input.documentId,
-            expectedOrganizationId: input.author.organizationId,
-            proof,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        await input.onVerifiedPurge({
-            commitPurgeProof: verified.commitCheckpoints,
-        });
-        return { ...proof, reclaimedBlobStorageKeys: [] };
-    }
-    await verifyDocumentWriterProjection({
-        execSql: input.execSql,
-        projection: writerProjection,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const request = await buildDocumentPurgeRequest({
-        author: input.author,
-        expectedSubtreeRoot: input.expectedSubtreeRoot,
-        writerProjection,
-    });
-    if (input.beforeSubmit && !(await input.beforeSubmit()))
-        return null;
-    if (input.stillCurrent?.() === false)
-        return null;
-    const response = await input.apiClient.purgeDocument(input.documentId, request, {
-        expectedPaymentRequiredOrganizationId: input.author.organizationId,
-    });
-    if (!response) {
-        return null;
-    }
-    const verified = await verifyDocumentPurgeProof({
-        execSql: input.execSql,
-        expectedDocumentId: input.documentId,
-        expectedOrganizationId: input.author.organizationId,
-        proof: response,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    await input.onVerifiedPurge({
-        commitPurgeProof: verified.commitCheckpoints,
-    });
-    return response;
-}
-//# sourceMappingURL=purge.js.map

package/workflows/documents/purge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"purge.js","sourceRoot":"","sources":["purge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAE1B,uBAAuB,EACvB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,6BAA6B,GAI9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,0CAA0C,GAC3C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,8BAA8B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAE7E,KAAK,UAAU,mCAAmC,CAAC,KAUlD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAC9D,KAAK,CAAC,UAAU,EAChB,SAAS,EACT;QACE,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CACF,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oCAAoC,CAAC,KAGnD;IAKC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,iCAAiC,CACpE,KAAK,CAAC,UAAU,EAChB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC3E,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,GAAG,kBAAkB,CAAC;IACzC,MAAM,qBAAqB,GAAG,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,MAAM,qBAAqB,GACzB,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACnD,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,kCAAkC,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAChC,CAAC;IACF,MAAM,IAAI,GAAiC;QACzC,kCAAkC;QAClC,WAAW;QACX,qBAAqB;QACrB,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,wBAAwB,EAAE,kCAAkC;QAC5D,QAAQ,EAAE,MAAM,0BAA0B,CACxC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAC/C;QACD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,4BAA4B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3E,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAa3D;IACC,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;YAC5C,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAezC;IACC,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,KAAK,8BAA8B,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;YACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,8BAA8B,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAClD,KAAK,CAAC,UAAU,EAChB,OAAO,EACP;QACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KACnE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACnD,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computeAccessEventBodyHash,\n  type DocumentPurgeAccessEventBody,\n  KeyingVerificationError,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeRequest } from \"@tearleads/validators/request\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentPurgeProofResponse,\n  type DocumentPurgeResponse,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  containerPathRefs,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  readManifestContainerId,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentSyncApi,\n} from \"../../data/documents/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../data/keying/canonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n  verifyDocumentWriterProjection,\n} from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"./subtreePurgeScope\";\n\ninterface DocumentPurgeApi {\n  getDocumentPurgeProof(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjectionResult: NonNullable<\n    DocumentSyncApi[\"getDocumentWriterProjectionResult\"]\n  >;\n  purgeDocument(\n    documentId: string,\n    request: DocumentPurgeRequest,\n    options?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeResponse | null>;\n}\n\nconst REMOTE_DOCUMENT_ALREADY_PURGED = Symbol(\"remoteDocumentAlreadyPurged\");\n\nasync function loadAuthenticatedDocumentPurgeProof(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeProofResponse | null> {\n  if (!input.apiClient.getDocumentPurgeProof) {\n    throw new ProjectionDependencyUnavailableError(\n      \"Remote document deletion is missing a purge-proof endpoint\",\n    );\n  }\n  const initialProof = await input.apiClient.getDocumentPurgeProof(\n    input.documentId,\n    undefined,\n    {\n      expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n    },\n  );\n  if (!initialProof) {\n    // ApiClient returns null for transport, HTTP and response-shape failures.\n    // Even after a deletion hint, absence cannot prove signed-data tampering.\n    // Keep local data and defer deletion until an actual proof verifies.\n    return null;\n  }\n  await verifyDocumentPurgeProofBaseline({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.expectedOrganizationId,\n    proof: initialProof,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  // The current API returns complete history to recorded readers. Otherwise\n  // its terminal snapshot needs an exact local pin; a floor refetch cannot\n  // grant missing observation authority.\n  return initialProof;\n}\n\nasync function resolveDocumentPurgeWriterProjection(input: {\n  readonly apiClient: DocumentPurgeApi;\n  readonly documentId: string;\n}): Promise<\n  | DocumentWriterProjectionResponse\n  | typeof REMOTE_DOCUMENT_ALREADY_PURGED\n  | null\n> {\n  const result = await input.apiClient.getDocumentWriterProjectionResult(\n    input.documentId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {\n    return REMOTE_DOCUMENT_ALREADY_PURGED;\n  }\n  result.report();\n  return null;\n}\n\nexport async function buildDocumentPurgeRequest(input: {\n  readonly author: DocumentCreateAuthor;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly eventId?: string | undefined;\n  readonly signedAt?: string | undefined;\n  readonly writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentPurgeRequest> {\n  const identity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document purge predecessor\",\n  });\n  if (identity.documentId !== input.writerProjection.documentId) {\n    throw new Error(\"Document purge projection identity mismatch\");\n  }\n  if (identity.organizationId !== input.author.organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge author organization mismatch\",\n    );\n  }\n  const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  if (linkedContainerIds.length !== 1) {\n    throw new Error(\"Document purge requires exactly one linked container\");\n  }\n  const [containerId] = linkedContainerIds;\n  const authorizingProjection = documentContainerProjections(\n    input.writerProjection,\n  ).find((projection) => {\n    const leaf = projection.path.at(-1);\n    return leaf && readManifestContainerId(leaf) === containerId;\n  });\n  const containerManifestHash =\n    authorizingProjection?.path.at(-1)?.manifestHash;\n  if (!authorizingProjection || !containerId || !containerManifestHash) {\n    throw new Error(\"Document purge authorization path is unavailable\");\n  }\n  assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);\n  const authorizingContainerManifestHashes = authorizingProjection.path.map(\n    (bundle) => bundle.manifestHash,\n  );\n  const body: DocumentPurgeAccessEventBody = {\n    authorizingContainerManifestHashes,\n    containerId,\n    containerManifestHash,\n    documentManifestHash: input.writerProjection.documentManifest.manifestHash,\n    eventType: \"document.purge\",\n  };\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId ?? crypto.randomUUID(),\n    eventType: \"document.purge\",\n    objectKind: \"document\",\n    objectId: input.writerProjection.documentId,\n    organizationId: input.author.organizationId,\n    previousManifestHash: input.writerProjection.documentManifest.manifestHash,\n    dependencyManifestHashes: authorizingContainerManifestHashes,\n    bodyHash: await computeAccessEventBodyHash(\n      readCanonicalJson(body, \"Document purge body\"),\n    ),\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),\n    body: readCanonicalRecord(body, \"Document purge body\"),\n    event: readCanonicalRecord(event, \"Document purge event\"),\n  };\n}\n\nexport function createVerifiedRemoteDocumentDeletionHandler(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly onVerifiedDeletion: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n    readonly documentId: string;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): (deleted: { readonly documentId: string }) => Promise<void> {\n  return async ({ documentId }) => {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.expectedOrganizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Remote document deletion is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: documentId,\n      expectedOrganizationId: input.expectedOrganizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedDeletion({\n      commitPurgeProof: verified.commitCheckpoints,\n      documentId,\n    });\n  };\n}\n\nexport async function purgeRemoteDocument(input: {\n  readonly beforeSubmit?: (() => Promise<boolean>) | undefined;\n  readonly apiClient: DocumentPurgeApi;\n  readonly author: DocumentCreateAuthor;\n  readonly documentId: string;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly execSql: ExecSql;\n  readonly onVerifiedPurge: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeResponse | null> {\n  const writerProjection = await resolveDocumentPurgeWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n  });\n  if (!writerProjection) {\n    return null;\n  }\n  if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId: input.documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.author.organizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Purged remote document is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: input.documentId,\n      expectedOrganizationId: input.author.organizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedPurge({\n      commitPurgeProof: verified.commitCheckpoints,\n    });\n    return { ...proof, reclaimedBlobStorageKeys: [] };\n  }\n  await verifyDocumentWriterProjection({\n    execSql: input.execSql,\n    projection: writerProjection,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const request = await buildDocumentPurgeRequest({\n    author: input.author,\n    expectedSubtreeRoot: input.expectedSubtreeRoot,\n    writerProjection,\n  });\n  if (input.beforeSubmit && !(await input.beforeSubmit())) return null;\n  if (input.stillCurrent?.() === false) return null;\n  const response = await input.apiClient.purgeDocument(\n    input.documentId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: input.author.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n  const verified = await verifyDocumentPurgeProof({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.author.organizationId,\n    proof: response,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  await input.onVerifiedPurge({\n    commitPurgeProof: verified.commitCheckpoints,\n  });\n  return response;\n}\n"]}

package/workflows/documents/readOnlyProjectionFailure.js

@@ -1,30 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { isDocumentSyncUpdateIsolationError } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-import { rethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
-import { DocumentRawHistoryUnavailableError } from "./syncContentKeys.js";
-import { projectionIntegrityErrorCode } from "./syncFailureClassification.js";
-export const REFRESH_CACHED_PROJECTION = Symbol("refresh cached projection");
-export function handleReadOnlyProjectionCompletionError(error, input) {
-    if (isDocumentSyncUpdateIsolationError(error)) {
-        throw error;
-    }
-    if (error instanceof DocumentRawHistoryUnavailableError) {
-        if (input.allowCachedProjectionRefresh) {
-            return error;
-        }
-        throw error;
-    }
-    if (input.allowCachedProjectionRefresh &&
-        error instanceof KeyingVerificationError &&
-        error.code === "invalid_shape") {
-        return REFRESH_CACHED_PROJECTION;
-    }
-    // The document-store `document.sync` boundary owns durable reporting; this
-    // helper only decides whether an ordinary projection miss is retryable.
-    rethrowKeyingVerificationError(error);
-    if (projectionIntegrityErrorCode(error) || input.historyMode === "raw") {
-        throw error;
-    }
-    return null;
-}
-//# sourceMappingURL=readOnlyProjectionFailure.js.map

package/workflows/documents/readOnlyProjectionFailure.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"readOnlyProjectionFailure.js","sourceRoot":"","sources":["readOnlyProjectionFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAE7E,MAAM,UAAU,uCAAuC,CACrD,KAAc,EACd,KAGC;IAKD,IAAI,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,4BAA4B;QAClC,KAAK,YAAY,uBAAuB;QACxC,KAAK,CAAC,IAAI,KAAK,eAAe,EAC9B,CAAC;QACD,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { isDocumentSyncUpdateIsolationError } from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport { rethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport { DocumentRawHistoryUnavailableError } from \"./syncContentKeys\";\nimport { projectionIntegrityErrorCode } from \"./syncFailureClassification\";\n\nexport const REFRESH_CACHED_PROJECTION = Symbol(\"refresh cached projection\");\n\nexport function handleReadOnlyProjectionCompletionError(\n  error: unknown,\n  input: {\n    allowCachedProjectionRefresh: boolean;\n    historyMode?: \"raw\" | undefined;\n  },\n):\n  | DocumentRawHistoryUnavailableError\n  | null\n  | typeof REFRESH_CACHED_PROJECTION {\n  if (isDocumentSyncUpdateIsolationError(error)) {\n    throw error;\n  }\n  if (error instanceof DocumentRawHistoryUnavailableError) {\n    if (input.allowCachedProjectionRefresh) {\n      return error;\n    }\n    throw error;\n  }\n  if (\n    input.allowCachedProjectionRefresh &&\n    error instanceof KeyingVerificationError &&\n    error.code === \"invalid_shape\"\n  ) {\n    return REFRESH_CACHED_PROJECTION;\n  }\n  // The document-store `document.sync` boundary owns durable reporting; this\n  // helper only decides whether an ordinary projection miss is retryable.\n  rethrowKeyingVerificationError(error);\n  if (projectionIntegrityErrorCode(error) || input.historyMode === \"raw\") {\n    throw error;\n  }\n  return null;\n}\n"]}

package/workflows/documents/readOnlySync.d.ts

@@ -1,71 +0,0 @@
-import type { DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { DocumentSyncUpdateIsolationError, IncomingDocumentSyncUpdateValidator } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-import { type DocumentSyncPullContinuation } from "../../data/documents/shared/syncPagination.js";
-import type { DocumentCreateAuthor, DocumentSyncApi, DocumentWriterPublicKeyResolver, PersistedDocumentSyncState, SyncRemoteDocumentResult } from "../../data/documents/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification/index.js";
-import type { PendingUpdateRecord } from "../../data/sqlite/documentPersistence.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { DocumentSyncContainerRekeyBuilder } from "./syncAttemptState.js";
-import { type RemoteDocumentDeletionHandler, type TerminalSubmitFailureHandler } from "./syncFailureClassification.js";
-import type { RekeyPendingUpdate } from "./syncRecoveryRekey.js";
-import { type DocumentSyncTraceEmitter } from "./syncTrace.js";
-type PersistedReadOnlyDocumentSyncResult = {
-    kind: "completed";
-    result: SyncRemoteDocumentResult | null;
-} | {
-    kind: "not_completed";
-};
-export interface SyncRemoteDocumentInput {
-    apiClient: DocumentSyncApi;
-    author: DocumentCreateAuthor;
-    /**
-     * Supplies a full-history Loro snapshot of the local document so a
-     * write-bearing pass can heal a stale content-key bundle by rotating to a
-     * fresh content key anchored by a rotation baseline.
-     */
-    buildRotationSnapshot?: (() => Promise<Uint8Array | null>) | undefined;
-    /** Overrides automatic ancestor repair for each submission's current projection. */
-    buildContainerRekeys?: DocumentSyncContainerRekeyBuilder;
-    documentId: string;
-    execSql: ExecSql;
-    /** Explicit read-only recovery that bypasses rotation-baseline redirect. */
-    historyMode?: "raw" | undefined;
-    isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;
-    localVersionVector: string | null;
-    minLsn?: string | undefined;
-    pullContinuation?: DocumentSyncPullContinuation | undefined;
-    /** Atomically commits the verified purge proof with matching local teardown. */
-    onRemoteDocumentDeleted?: RemoteDocumentDeletionHandler | undefined;
-    onSyncAbandoned?: ((reason: string) => void) | undefined;
-    /** Clipboard-safe trace sink (see syncTrace.ts); never receives content. */
-    onSyncTrace?: DocumentSyncTraceEmitter | undefined;
-    /**
-     * Fires when a pass WITHOUT queued writes cannot resolve its writer
-     * projection (e.g. a coded 409 from the projection route). Read-only
-     * revalidation otherwise fails silently — one burned request and a trace
-     * line — leaving the document permanently stale with nothing durable to
-     * explain why (edge-case row 13).
-     */
-    onReadOnlyProjectionFailure?: TerminalSubmitFailureHandler | undefined;
-    /** Records a verified response update that could not be decrypted/imported. */
-    onIncomingUpdateIsolationFailure?: ((failure: DocumentSyncUpdateIsolationError) => void | Promise<void>) | undefined;
-    /** Fires immediately before a materialized outgoing batch is submitted. */
-    onOutgoingUpdatesMaterialized?: ((updateIds: readonly string[]) => void) | undefined;
-    /** Invalidates continuation state after the server rejects its snapshot. */
-    onPullContinuationInvalidated?: ((continuation: DocumentSyncPullContinuation) => void | Promise<void>) | undefined;
-    onTerminalSubmitFailure?: TerminalSubmitFailureHandler | undefined;
-    pendingUpdates?: readonly PendingUpdateRecord[] | undefined;
-    persistedState?: PersistedDocumentSyncState | null | undefined;
-    rekeyPendingUpdate?: RekeyPendingUpdate | undefined;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    resolveWriterPublicKey: DocumentWriterPublicKeyResolver;
-    signedAt?: string | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    targetSecretKey: Uint8Array;
-    /** Validates decrypted updates against scratch state before callers persist. */
-    validateIncomingUpdates: IncomingDocumentSyncUpdateValidator;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-    writerProjection?: DocumentWriterProjectionResponse | undefined;
-}
-export declare function tryPersistedReadOnlyDocumentSync(input: SyncRemoteDocumentInput, resolveProjectionUserKey: ProjectionUserKeyResolver): Promise<PersistedReadOnlyDocumentSyncResult | null>;
-export {};