@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/orphanBlobReclaims.js

@@ -1,143 +0,0 @@
-import { errorMessage } from "../../data/shared/errorMessage.js";
-import { resolveCanonicalExecSql, runOncePerConnection, runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
-import { runSerializedDocumentBlobMutation } from "./blobMutationLock.js";
-import { orphanBlobReclaimState, } from "./orphanBlobReclaimState.js";
-import { defaultDocumentsPersistence } from "./persistence.js";
-const ORPHAN_BLOB_RECLAIM_BATCH_SIZE = 16;
-const ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS = 250;
-const ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS = 30_000;
-const ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE = 3;
-const ORPHAN_BLOB_RECLAIM_YIELD_MS = 16;
-function clearExpiredDeferredStorageKeys(deferredStorageKeys, now) {
-    for (const [storageKey, retryAt] of deferredStorageKeys) {
-        if (retryAt <= now)
-            deferredStorageKeys.delete(storageKey);
-    }
-}
-function waitForMaintenanceYield() {
-    return new Promise((resolve) => {
-        setTimeout(resolve, ORPHAN_BLOB_RECLAIM_YIELD_MS);
-    });
-}
-async function sweepAgedDocumentOrphans(execSql, persistence, state) {
-    let swept = false;
-    await runOncePerConnection(execSql, state.sweepKey, async () => {
-        swept = true;
-        while (await persistence.orphanBlobs.sweep(execSql)) {
-            await waitForMaintenanceYield();
-        }
-    });
-    return swept;
-}
-async function reclaimQueuedBlobs(runtime, persistence, state) {
-    const execSql = runtime.infra.execSql;
-    await persistence.ensureSchema(execSql);
-    let shouldContinue = false;
-    const startedAt = Date.now();
-    const { deferredStorageKeys } = state;
-    const failedStorageKeys = [];
-    let warmedBlobStore = false;
-    let sweptAgedOrphans = false;
-    reclaimQueue: while (true) {
-        clearExpiredDeferredStorageKeys(deferredStorageKeys, Date.now());
-        const queuedStorageKeys = await persistence.orphanBlobs.list(execSql, ORPHAN_BLOB_RECLAIM_BATCH_SIZE + deferredStorageKeys.size);
-        const storageKeys = queuedStorageKeys
-            .filter((storageKey) => !deferredStorageKeys.has(storageKey))
-            .slice(0, ORPHAN_BLOB_RECLAIM_BATCH_SIZE);
-        if (storageKeys.length === 0) {
-            // Explicit delete paths get priority. Once their queue is drained, sweep
-            // crash residue once per connection and immediately drain what it queues.
-            if (!sweptAgedOrphans &&
-                (await sweepAgedDocumentOrphans(execSql, persistence, state))) {
-                sweptAgedOrphans = true;
-                continue;
-            }
-            break;
-        }
-        const firstStorageKey = storageKeys[0];
-        if (!warmedBlobStore && firstStorageKey) {
-            // Initialize lazy keyring/OPFS-backed stores before taking any blob-key
-            // lock. A failed preview is harmless: deletion can still reclaim the key.
-            await runtime.infra.blobStore
-                .openByteSource(firstStorageKey)
-                .catch(() => undefined);
-            warmedBlobStore = true;
-        }
-        for (const storageKey of storageKeys) {
-            await runSerializedDocumentBlobMutation(execSql, storageKey, async () => {
-                const shouldDelete = await runSerializedSqlMutation(execSql, async (lockedExecSql) => {
-                    if (await persistence.orphanBlobs.isReferenced(lockedExecSql, storageKey)) {
-                        await persistence.orphanBlobs.acknowledge(lockedExecSql, storageKey);
-                        return false;
-                    }
-                    return true;
-                });
-                if (!shouldDelete)
-                    return;
-                try {
-                    await runtime.infra.blobStore.deleteBytes(storageKey);
-                    await runSerializedSqlMutation(execSql, (lockedExecSql) => persistence.orphanBlobs.acknowledge(lockedExecSql, storageKey));
-                }
-                catch {
-                    failedStorageKeys.push(storageKey);
-                    deferredStorageKeys.set(storageKey, Date.now() + ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS);
-                }
-            });
-            if (Date.now() - startedAt >= ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS) {
-                shouldContinue = true;
-                break reclaimQueue;
-            }
-        }
-    }
-    if (failedStorageKeys.length > 0) {
-        const sample = failedStorageKeys
-            .slice(0, ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE)
-            .join(", ");
-        runtime.util.log(`Documents: orphan maintenance deferred ${failedStorageKeys.length} blob(s): ${sample}`);
-    }
-    return shouldContinue;
-}
-function runDocumentOrphanReclaims(runtime, persistence = defaultDocumentsPersistence) {
-    if (runtime.infra.dbStatus !== "ready") {
-        return Promise.resolve();
-    }
-    const state = orphanBlobReclaimState(persistence.orphanBlobs, resolveCanonicalExecSql(runtime.infra.execSql));
-    if (state.running) {
-        state.rerun = true;
-        return state.running;
-    }
-    const reclaim = (async () => {
-        try {
-            let hasMore;
-            do {
-                state.rerun = false;
-                hasMore = false;
-                try {
-                    hasMore = await reclaimQueuedBlobs(runtime, persistence, state);
-                }
-                catch (error) {
-                    const message = errorMessage(error);
-                    runtime.util.log(`Documents: orphan maintenance failed: ${message}`);
-                }
-                if (hasMore || state.rerun)
-                    await waitForMaintenanceYield();
-            } while (hasMore || state.rerun);
-        }
-        finally {
-            state.running = undefined;
-            state.rerun = false;
-        }
-    })();
-    state.running = reclaim;
-    return reclaim;
-}
-/** Await all requested batches; maintenance failures never fail committed writes. */
-export async function reclaimDocumentOrphanBlobs(runtime, persistence = defaultDocumentsPersistence) {
-    try {
-        await runDocumentOrphanReclaims(runtime, persistence);
-    }
-    catch (error) {
-        runtime.util.log(`Documents: orphan maintenance failed: ${errorMessage(error)}`);
-    }
-}
-//# sourceMappingURL=orphanBlobReclaims.js.map

package/workflows/documents/orphanBlobReclaims.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"orphanBlobReclaims.js","sourceRoot":"","sources":["orphanBlobReclaims.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAEL,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAG5D,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAC/C,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAClD,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAC9C,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAOxC,SAAS,+BAA+B,CACtC,mBAAwC,EACxC,GAAW;IAEX,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACxD,IAAI,OAAO,IAAI,GAAG;YAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAAgB,EAChB,WAAiC,EACjC,KAA6B;IAE7B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC7D,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,uBAAuB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAyC,EACzC,WAAiC,EACjC,KAA6B;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,+BAA+B,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAC1D,OAAO,EACP,8BAA8B,GAAG,mBAAmB,CAAC,IAAI,CAC1D,CAAC;QACF,MAAM,WAAW,GAAG,iBAAiB;aAClC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,yEAAyE;YACzE,0EAA0E;YAC1E,IACE,CAAC,gBAAgB;gBACjB,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,EAC7D,CAAC;gBACD,gBAAgB,GAAG,IAAI,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS;iBAC1B,cAAc,CAAC,eAAe,CAAC;iBAC/B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,iCAAiC,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;gBACtE,MAAM,YAAY,GAAG,MAAM,wBAAwB,CACjD,OAAO,EACP,KAAK,EAAE,aAAa,EAAE,EAAE;oBACtB,IACE,MAAM,WAAW,CAAC,WAAW,CAAC,YAAY,CACxC,aAAa,EACb,UAAU,CACX,EACD,CAAC;wBACD,MAAM,WAAW,CAAC,WAAW,CAAC,WAAW,CACvC,aAAa,EACb,UAAU,CACX,CAAC;wBACF,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,YAAY;oBAAE,OAAO;gBAC1B,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBACtD,MAAM,wBAAwB,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,EAAE,CACxD,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAC/D,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACnC,mBAAmB,CAAC,GAAG,CACrB,UAAU,EACV,IAAI,CAAC,GAAG,EAAE,GAAG,kCAAkC,CAChD,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,kCAAkC,EAAE,CAAC;gBACjE,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,iBAAiB;aAC7B,KAAK,CAAC,CAAC,EAAE,mCAAmC,CAAC;aAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,0CAA0C,iBAAiB,CAAC,MAAM,aAAa,MAAM,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,yBAAyB,CAChC,OAAyC,EACzC,cAAoC,2BAA2B;IAE/D,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAClC,WAAW,CAAC,WAAW,EACvB,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAC/C,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,IAAI,OAAgB,CAAC;YACrB,GAAG,CAAC;gBACF,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;gBACpB,OAAO,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,IAAI,OAAO,IAAI,KAAK,CAAC,KAAK;oBAAE,MAAM,uBAAuB,EAAE,CAAC;YAC9D,CAAC,QAAQ,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACnC,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC1B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyC,EACzC,cAAoC,2BAA2B;IAE/D,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,yCAAyC,YAAY,CAAC,KAAK,CAAC,EAAE,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { DocumentsPersistence } from \"../../data/persistence/documents/types\";\nimport { errorMessage } from \"../../data/shared/errorMessage\";\nimport {\n  type ExecSql,\n  resolveCanonicalExecSql,\n  runOncePerConnection,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport { runSerializedDocumentBlobMutation } from \"./blobMutationLock\";\nimport {\n  type OrphanBlobReclaimState,\n  orphanBlobReclaimState,\n} from \"./orphanBlobReclaimState\";\nimport { defaultDocumentsPersistence } from \"./persistence\";\nimport type { DocumentsWorkflowRuntimeGroups } from \"./runtime\";\n\nconst ORPHAN_BLOB_RECLAIM_BATCH_SIZE = 16;\nconst ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS = 250;\nconst ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS = 30_000;\nconst ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE = 3;\nconst ORPHAN_BLOB_RECLAIM_YIELD_MS = 16;\n\ntype DocumentOrphanBlobReclaimRuntime = Pick<\n  DocumentsWorkflowRuntimeGroups,\n  \"infra\" | \"util\"\n>;\n\nfunction clearExpiredDeferredStorageKeys(\n  deferredStorageKeys: Map<string, number>,\n  now: number,\n): void {\n  for (const [storageKey, retryAt] of deferredStorageKeys) {\n    if (retryAt <= now) deferredStorageKeys.delete(storageKey);\n  }\n}\n\nfunction waitForMaintenanceYield(): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ORPHAN_BLOB_RECLAIM_YIELD_MS);\n  });\n}\n\nasync function sweepAgedDocumentOrphans(\n  execSql: ExecSql,\n  persistence: DocumentsPersistence,\n  state: OrphanBlobReclaimState,\n): Promise<boolean> {\n  let swept = false;\n  await runOncePerConnection(execSql, state.sweepKey, async () => {\n    swept = true;\n    while (await persistence.orphanBlobs.sweep(execSql)) {\n      await waitForMaintenanceYield();\n    }\n  });\n  return swept;\n}\n\nasync function reclaimQueuedBlobs(\n  runtime: DocumentOrphanBlobReclaimRuntime,\n  persistence: DocumentsPersistence,\n  state: OrphanBlobReclaimState,\n): Promise<boolean> {\n  const execSql = runtime.infra.execSql;\n  await persistence.ensureSchema(execSql);\n  let shouldContinue = false;\n\n  const startedAt = Date.now();\n  const { deferredStorageKeys } = state;\n  const failedStorageKeys: string[] = [];\n  let warmedBlobStore = false;\n  let sweptAgedOrphans = false;\n\n  reclaimQueue: while (true) {\n    clearExpiredDeferredStorageKeys(deferredStorageKeys, Date.now());\n    const queuedStorageKeys = await persistence.orphanBlobs.list(\n      execSql,\n      ORPHAN_BLOB_RECLAIM_BATCH_SIZE + deferredStorageKeys.size,\n    );\n    const storageKeys = queuedStorageKeys\n      .filter((storageKey) => !deferredStorageKeys.has(storageKey))\n      .slice(0, ORPHAN_BLOB_RECLAIM_BATCH_SIZE);\n    if (storageKeys.length === 0) {\n      // Explicit delete paths get priority. Once their queue is drained, sweep\n      // crash residue once per connection and immediately drain what it queues.\n      if (\n        !sweptAgedOrphans &&\n        (await sweepAgedDocumentOrphans(execSql, persistence, state))\n      ) {\n        sweptAgedOrphans = true;\n        continue;\n      }\n      break;\n    }\n\n    const firstStorageKey = storageKeys[0];\n    if (!warmedBlobStore && firstStorageKey) {\n      // Initialize lazy keyring/OPFS-backed stores before taking any blob-key\n      // lock. A failed preview is harmless: deletion can still reclaim the key.\n      await runtime.infra.blobStore\n        .openByteSource(firstStorageKey)\n        .catch(() => undefined);\n      warmedBlobStore = true;\n    }\n\n    for (const storageKey of storageKeys) {\n      await runSerializedDocumentBlobMutation(execSql, storageKey, async () => {\n        const shouldDelete = await runSerializedSqlMutation(\n          execSql,\n          async (lockedExecSql) => {\n            if (\n              await persistence.orphanBlobs.isReferenced(\n                lockedExecSql,\n                storageKey,\n              )\n            ) {\n              await persistence.orphanBlobs.acknowledge(\n                lockedExecSql,\n                storageKey,\n              );\n              return false;\n            }\n            return true;\n          },\n        );\n        if (!shouldDelete) return;\n        try {\n          await runtime.infra.blobStore.deleteBytes(storageKey);\n          await runSerializedSqlMutation(execSql, (lockedExecSql) =>\n            persistence.orphanBlobs.acknowledge(lockedExecSql, storageKey),\n          );\n        } catch {\n          failedStorageKeys.push(storageKey);\n          deferredStorageKeys.set(\n            storageKey,\n            Date.now() + ORPHAN_BLOB_RECLAIM_RETRY_DELAY_MS,\n          );\n        }\n      });\n      if (Date.now() - startedAt >= ORPHAN_BLOB_RECLAIM_TIME_BUDGET_MS) {\n        shouldContinue = true;\n        break reclaimQueue;\n      }\n    }\n  }\n\n  if (failedStorageKeys.length > 0) {\n    const sample = failedStorageKeys\n      .slice(0, ORPHAN_BLOB_RECLAIM_LOG_SAMPLE_SIZE)\n      .join(\", \");\n    runtime.util.log(\n      `Documents: orphan maintenance deferred ${failedStorageKeys.length} blob(s): ${sample}`,\n    );\n  }\n  return shouldContinue;\n}\n\nfunction runDocumentOrphanReclaims(\n  runtime: DocumentOrphanBlobReclaimRuntime,\n  persistence: DocumentsPersistence = defaultDocumentsPersistence,\n): Promise<void> {\n  if (runtime.infra.dbStatus !== \"ready\") {\n    return Promise.resolve();\n  }\n  const state = orphanBlobReclaimState(\n    persistence.orphanBlobs,\n    resolveCanonicalExecSql(runtime.infra.execSql),\n  );\n  if (state.running) {\n    state.rerun = true;\n    return state.running;\n  }\n\n  const reclaim = (async () => {\n    try {\n      let hasMore: boolean;\n      do {\n        state.rerun = false;\n        hasMore = false;\n        try {\n          hasMore = await reclaimQueuedBlobs(runtime, persistence, state);\n        } catch (error) {\n          const message = errorMessage(error);\n          runtime.util.log(`Documents: orphan maintenance failed: ${message}`);\n        }\n        if (hasMore || state.rerun) await waitForMaintenanceYield();\n      } while (hasMore || state.rerun);\n    } finally {\n      state.running = undefined;\n      state.rerun = false;\n    }\n  })();\n  state.running = reclaim;\n  return reclaim;\n}\n\n/** Await all requested batches; maintenance failures never fail committed writes. */\nexport async function reclaimDocumentOrphanBlobs(\n  runtime: DocumentOrphanBlobReclaimRuntime,\n  persistence: DocumentsPersistence = defaultDocumentsPersistence,\n): Promise<void> {\n  try {\n    await runDocumentOrphanReclaims(runtime, persistence);\n  } catch (error) {\n    runtime.util.log(\n      `Documents: orphan maintenance failed: ${errorMessage(error)}`,\n    );\n  }\n}\n"]}

package/workflows/documents/persistedDocumentRemoval.d.ts

@@ -1,44 +0,0 @@
-import { type DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
-import type { DiscardDocumentToShellResult, DocumentsPersistence, StoredDocumentRecord } from "../../data/persistence/documents/documentsPersistence.js";
-import { type ExecSql } from "../../data/sqlite/sqlSchema.js";
-export declare function deletePersistedDocument(input: {
-    /**
-     * Runs in the same SQLite transaction as the matched document teardown.
-     * Used to atomically pin a verified terminal purge proof.
-     */
-    beforeDeleteInTransaction?: ((transactionExecSql: ExecSql) => Promise<void>) | undefined;
-    canStartDurableMutation?: (() => boolean) | undefined;
-    documentProjectors: DocumentProjectorRegistryInput;
-    execSql: ExecSql;
-    expectedRecord?: StoredDocumentRecord | undefined;
-    localId: string;
-    /**
-     * Runs INSIDE the serialized mutation, after the deletes commit: callers
-     * invalidate their in-memory store generation here so any failure handler
-     * queued behind this mutation observes the invalidation and cannot
-     * resurrect a row the deletion just removed.
-     */
-    onDeletedInMutation?: (() => void) | undefined;
-    persistence: DocumentsPersistence;
-}): Promise<boolean>;
-export type DiscardedDocumentShellResult = DiscardDocumentToShellResult;
-/**
- * Convert a stuck document's local state to the freshly-discovered-share
- * shell. The persistence implementation owns the whole sequence — the
- * eligibility checks (local-only, unlinked, or move-pending documents are
- * refused), the row teardown, the document-kind client-projection clear, and
- * the shell upsert — and commits it as ONE transaction, so an interruption
- * leaves either the fully old or the fully shelled document (never, e.g., a
- * discarded contact whose projected fields stay visible). Implementations
- * without the full document schema do not offer the operation and refuse.
- *
- * Returns the reclaimable storage keys on success — the deleted rows were
- * the only durable pointers to those bytes, so the caller reclaims them.
- */
-export declare function discardPersistedDocumentToShell(input: {
-    documentProjectors: DocumentProjectorRegistryInput;
-    execSql: ExecSql;
-    expectedDocumentId: string;
-    localId: string;
-    persistence: DocumentsPersistence;
-}): Promise<DiscardedDocumentShellResult>;

package/workflows/documents/persistedDocumentRemoval.js

@@ -1,70 +0,0 @@
-import { DEFAULT_DOCUMENT_KIND } from "../../data/documents/documentConstants.js";
-import { resolveDocumentProjectorRegistry, } from "../../data/documents/documentKinds.js";
-import { runSerializedSqlMutation, } from "../../data/sqlite/sqlSchema.js";
-import { ensureDocumentClientProjectionTables } from "./persistence.js";
-export async function deletePersistedDocument(input) {
-    const documentProjectors = resolveDocumentProjectorRegistry(input.documentProjectors);
-    await input.persistence.ensureSchema(input.execSql);
-    await ensureDocumentClientProjectionTables({
-        documentProjectors,
-        execSql: input.execSql,
-    });
-    let deleted = false;
-    await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {
-        // The guard runs INSIDE the claimed mutation: the pre-claim answer can go
-        // stale while the deletion waits behind another mutation (a store reset,
-        // a replacement generation's persist), and deleting on the stale answer
-        // would wipe rows the newer generation just wrote.
-        if (input.canStartDurableMutation && !input.canStartDurableMutation()) {
-            return;
-        }
-        if (input.expectedRecord) {
-            const identityMatched = await input.persistence.deleteDocumentIfMatches(lockedExecSql, input.expectedRecord, (transactionExecSql) => (async () => {
-                await documentProjectors.deleteStoredDocumentClientProjection({
-                    documentKind: input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,
-                    execSql: transactionExecSql,
-                    localId: input.localId,
-                });
-                await input.beforeDeleteInTransaction?.(transactionExecSql);
-            })());
-            if (!identityMatched)
-                return;
-        }
-        else {
-            if (input.beforeDeleteInTransaction) {
-                throw new Error("Atomic document purge checkpointing requires an expected document record");
-            }
-            const existing = await input.persistence.loadDocument(lockedExecSql, input.localId);
-            await input.persistence.deleteDocument(lockedExecSql, input.localId);
-            await documentProjectors.deleteStoredDocumentClientProjection({
-                documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,
-                execSql: lockedExecSql,
-                localId: input.localId,
-            });
-        }
-        input.onDeletedInMutation?.();
-        deleted = true;
-    });
-    return deleted;
-}
-/**
- * Convert a stuck document's local state to the freshly-discovered-share
- * shell. The persistence implementation owns the whole sequence — the
- * eligibility checks (local-only, unlinked, or move-pending documents are
- * refused), the row teardown, the document-kind client-projection clear, and
- * the shell upsert — and commits it as ONE transaction, so an interruption
- * leaves either the fully old or the fully shelled document (never, e.g., a
- * discarded contact whose projected fields stay visible). Implementations
- * without the full document schema do not offer the operation and refuse.
- *
- * Returns the reclaimable storage keys on success — the deleted rows were
- * the only durable pointers to those bytes, so the caller reclaims them.
- */
-export async function discardPersistedDocumentToShell(input) {
-    await input.persistence.ensureSchema(input.execSql);
-    if (!input.persistence.discardDocumentToShell) {
-        return { discarded: false };
-    }
-    return input.persistence.discardDocumentToShell(input.execSql, input.localId, input.expectedDocumentId, input.documentProjectors);
-}
-//# sourceMappingURL=persistedDocumentRemoval.js.map

package/workflows/documents/persistedDocumentRemoval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"persistedDocumentRemoval.js","sourceRoot":"","sources":["persistedDocumentRemoval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAM5C,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oCAAoC,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAqB7C;IACC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,oCAAoC,CAAC;QACzC,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CACrE,aAAa,EACb,KAAK,CAAC,cAAc,EACpB,CAAC,kBAAkB,EAAE,EAAE,CACrB,CAAC,KAAK,IAAI,EAAE;gBACV,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;oBAC5D,YAAY,EACV,KAAK,CAAC,cAAc,EAAE,YAAY,IAAI,qBAAqB;oBAC7D,OAAO,EAAE,kBAAkB;oBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,yBAAyB,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,CAAC,EAAE,CACP,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,OAAO;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACnD,aAAa,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACF,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;gBAC5D,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,qBAAqB;gBAC7D,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAC7C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../data/documents/documentConstants\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type {\n  DiscardDocumentToShellResult,\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport { ensureDocumentClientProjectionTables } from \"./persistence\";\n\nexport async function deletePersistedDocument(input: {\n  /**\n   * Runs in the same SQLite transaction as the matched document teardown.\n   * Used to atomically pin a verified terminal purge proof.\n   */\n  beforeDeleteInTransaction?:\n    | ((transactionExecSql: ExecSql) => Promise<void>)\n    | undefined;\n  canStartDurableMutation?: (() => boolean) | undefined;\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedRecord?: StoredDocumentRecord | undefined;\n  localId: string;\n  /**\n   * Runs INSIDE the serialized mutation, after the deletes commit: callers\n   * invalidate their in-memory store generation here so any failure handler\n   * queued behind this mutation observes the invalidation and cannot\n   * resurrect a row the deletion just removed.\n   */\n  onDeletedInMutation?: (() => void) | undefined;\n  persistence: DocumentsPersistence;\n}): Promise<boolean> {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.documentProjectors,\n  );\n  await input.persistence.ensureSchema(input.execSql);\n  await ensureDocumentClientProjectionTables({\n    documentProjectors,\n    execSql: input.execSql,\n  });\n  let deleted = false;\n  await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {\n    // The guard runs INSIDE the claimed mutation: the pre-claim answer can go\n    // stale while the deletion waits behind another mutation (a store reset,\n    // a replacement generation's persist), and deleting on the stale answer\n    // would wipe rows the newer generation just wrote.\n    if (input.canStartDurableMutation && !input.canStartDurableMutation()) {\n      return;\n    }\n    if (input.expectedRecord) {\n      const identityMatched = await input.persistence.deleteDocumentIfMatches(\n        lockedExecSql,\n        input.expectedRecord,\n        (transactionExecSql) =>\n          (async () => {\n            await documentProjectors.deleteStoredDocumentClientProjection({\n              documentKind:\n                input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n              execSql: transactionExecSql,\n              localId: input.localId,\n            });\n            await input.beforeDeleteInTransaction?.(transactionExecSql);\n          })(),\n      );\n      if (!identityMatched) return;\n    } else {\n      if (input.beforeDeleteInTransaction) {\n        throw new Error(\n          \"Atomic document purge checkpointing requires an expected document record\",\n        );\n      }\n      const existing = await input.persistence.loadDocument(\n        lockedExecSql,\n        input.localId,\n      );\n      await input.persistence.deleteDocument(lockedExecSql, input.localId);\n      await documentProjectors.deleteStoredDocumentClientProjection({\n        documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n        execSql: lockedExecSql,\n        localId: input.localId,\n      });\n    }\n    input.onDeletedInMutation?.();\n    deleted = true;\n  });\n  return deleted;\n}\n\nexport type DiscardedDocumentShellResult = DiscardDocumentToShellResult;\n\n/**\n * Convert a stuck document's local state to the freshly-discovered-share\n * shell. The persistence implementation owns the whole sequence — the\n * eligibility checks (local-only, unlinked, or move-pending documents are\n * refused), the row teardown, the document-kind client-projection clear, and\n * the shell upsert — and commits it as ONE transaction, so an interruption\n * leaves either the fully old or the fully shelled document (never, e.g., a\n * discarded contact whose projected fields stay visible). Implementations\n * without the full document schema do not offer the operation and refuse.\n *\n * Returns the reclaimable storage keys on success — the deleted rows were\n * the only durable pointers to those bytes, so the caller reclaims them.\n */\nexport async function discardPersistedDocumentToShell(input: {\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedDocumentId: string;\n  localId: string;\n  persistence: DocumentsPersistence;\n}): Promise<DiscardedDocumentShellResult> {\n  await input.persistence.ensureSchema(input.execSql);\n  if (!input.persistence.discardDocumentToShell) {\n    return { discarded: false };\n  }\n  return input.persistence.discardDocumentToShell(\n    input.execSql,\n    input.localId,\n    input.expectedDocumentId,\n    input.documentProjectors,\n  );\n}\n"]}

package/workflows/documents/purge.d.ts

@@ -1,53 +0,0 @@
-import type { DocumentPurgeRequest } from "../../internal/validators/request/index.js";
-import { type DocumentPurgeProofResponse, type DocumentPurgeResponse, type DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { DocumentCreateAuthor, DocumentSyncApi } from "../../data/documents/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import { type SubtreePurgeRoot } from "./subtreePurgeScope.js";
-interface DocumentPurgeApi {
-    getDocumentPurgeProof(documentId: string, options?: {
-        readonly documentCheckpointManifestHash?: string;
-    }, requestOptions?: {
-        readonly expectedPaymentRequiredOrganizationId?: string;
-    }): Promise<DocumentPurgeProofResponse | null>;
-    getDocumentWriterProjectionResult: NonNullable<DocumentSyncApi["getDocumentWriterProjectionResult"]>;
-    purgeDocument(documentId: string, request: DocumentPurgeRequest, options?: {
-        readonly expectedPaymentRequiredOrganizationId?: string;
-    }): Promise<DocumentPurgeResponse | null>;
-}
-export declare function buildDocumentPurgeRequest(input: {
-    readonly author: DocumentCreateAuthor;
-    readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
-    readonly eventId?: string | undefined;
-    readonly signedAt?: string | undefined;
-    readonly writerProjection: DocumentWriterProjectionResponse;
-}): Promise<DocumentPurgeRequest>;
-export declare function createVerifiedRemoteDocumentDeletionHandler(input: {
-    readonly apiClient: Pick<DocumentSyncApi, "getDocumentPurgeProof">;
-    readonly execSql: ExecSql;
-    readonly expectedOrganizationId: string;
-    readonly onVerifiedDeletion: (input: {
-        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
-        readonly documentId: string;
-    }) => Promise<void> | void;
-    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): (deleted: {
-    readonly documentId: string;
-}) => Promise<void>;
-export declare function purgeRemoteDocument(input: {
-    readonly beforeSubmit?: (() => Promise<boolean>) | undefined;
-    readonly apiClient: DocumentPurgeApi;
-    readonly author: DocumentCreateAuthor;
-    readonly documentId: string;
-    readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;
-    readonly execSql: ExecSql;
-    readonly onVerifiedPurge: (input: {
-        readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;
-    }) => Promise<void> | void;
-    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<DocumentPurgeResponse | null>;
-export {};

package/workflows/documents/purge.js

@@ -1,204 +0,0 @@
-import { computeAccessEventBodyHash, KeyingVerificationError, signAccessEvent, } from "../../internal/crypto/index.js";
-import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../internal/validators/response/index.js";
-import { containerPathRefs, readLinkedContainerIdsFromDocumentManifest, } from "../../data/documents/shared/projection.js";
-import { assertDocumentManifestBundleConsistent, readManifestContainerId, } from "../../data/documents/shared/readers.js";
-import { readCanonicalJson, readCanonicalRecord, } from "../../data/keying/canonicalJson.js";
-import { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, verifyDocumentWriterProjection, } from "../../data/keyingProjectionVerification/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { documentContainerProjections } from "../../data/keyingProjectionVerification/documentContainerProjections.js";
-import { assertSubtreePurgePath, } from "./subtreePurgeScope.js";
-const REMOTE_DOCUMENT_ALREADY_PURGED = Symbol("remoteDocumentAlreadyPurged");
-async function loadAuthenticatedDocumentPurgeProof(input) {
-    if (!input.apiClient.getDocumentPurgeProof) {
-        throw new ProjectionDependencyUnavailableError("Remote document deletion is missing a purge-proof endpoint");
-    }
-    const initialProof = await input.apiClient.getDocumentPurgeProof(input.documentId, undefined, {
-        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
-    });
-    if (!initialProof) {
-        // ApiClient returns null for transport, HTTP and response-shape failures.
-        // Even after a deletion hint, absence cannot prove signed-data tampering.
-        // Keep local data and defer deletion until an actual proof verifies.
-        return null;
-    }
-    await verifyDocumentPurgeProofBaseline({
-        execSql: input.execSql,
-        expectedDocumentId: input.documentId,
-        expectedOrganizationId: input.expectedOrganizationId,
-        proof: initialProof,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    // The current API returns complete history to recorded readers. Otherwise
-    // its terminal snapshot needs an exact local pin; a floor refetch cannot
-    // grant missing observation authority.
-    return initialProof;
-}
-async function resolveDocumentPurgeWriterProjection(input) {
-    const result = await input.apiClient.getDocumentWriterProjectionResult(input.documentId, { reportErrors: false });
-    if (result.ok) {
-        return result.data;
-    }
-    if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {
-        return REMOTE_DOCUMENT_ALREADY_PURGED;
-    }
-    result.report();
-    return null;
-}
-export async function buildDocumentPurgeRequest(input) {
-    const identity = await assertDocumentManifestBundleConsistent({
-        bundle: input.writerProjection.documentManifest,
-        label: "Document purge predecessor",
-    });
-    if (identity.documentId !== input.writerProjection.documentId) {
-        throw new Error("Document purge projection identity mismatch");
-    }
-    if (identity.organizationId !== input.author.organizationId) {
-        throw new KeyingVerificationError("object_mismatch", "Document purge author organization mismatch");
-    }
-    const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
-    if (linkedContainerIds.length !== 1) {
-        throw new Error("Document purge requires exactly one linked container");
-    }
-    const [containerId] = linkedContainerIds;
-    const authorizingProjection = documentContainerProjections(input.writerProjection).find((projection) => {
-        const leaf = projection.path.at(-1);
-        return leaf && readManifestContainerId(leaf) === containerId;
-    });
-    const containerManifestHash = authorizingProjection?.path.at(-1)?.manifestHash;
-    if (!authorizingProjection || !containerId || !containerManifestHash) {
-        throw new Error("Document purge authorization path is unavailable");
-    }
-    assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);
-    const authorizingContainerManifestHashes = authorizingProjection.path.map((bundle) => bundle.manifestHash);
-    const body = {
-        authorizingContainerManifestHashes,
-        containerId,
-        containerManifestHash,
-        documentManifestHash: input.writerProjection.documentManifest.manifestHash,
-        eventType: "document.purge",
-    };
-    const unsignedEvent = {
-        version: 1,
-        eventId: input.eventId ?? crypto.randomUUID(),
-        eventType: "document.purge",
-        objectKind: "document",
-        objectId: input.writerProjection.documentId,
-        organizationId: input.author.organizationId,
-        previousManifestHash: input.writerProjection.documentManifest.manifestHash,
-        dependencyManifestHashes: authorizingContainerManifestHashes,
-        bodyHash: await computeAccessEventBodyHash(readCanonicalJson(body, "Document purge body")),
-        signerUserId: input.author.signerUserId,
-        signerDeviceId: input.author.signerDeviceId,
-        signerKeyFingerprint: input.author.signerKeyFingerprint,
-        signedAt: input.signedAt ?? new Date().toISOString(),
-    };
-    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
-    return {
-        authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),
-        body: readCanonicalRecord(body, "Document purge body"),
-        event: readCanonicalRecord(event, "Document purge event"),
-    };
-}
-export function createVerifiedRemoteDocumentDeletionHandler(input) {
-    return async ({ documentId }) => {
-        const proof = await loadAuthenticatedDocumentPurgeProof({
-            apiClient: input.apiClient,
-            documentId,
-            execSql: input.execSql,
-            expectedOrganizationId: input.expectedOrganizationId,
-            resolveProjectionUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        if (!proof) {
-            throw new ProjectionDependencyUnavailableError("Remote document deletion is missing its signed purge proof");
-        }
-        const verified = await verifyDocumentPurgeProof({
-            execSql: input.execSql,
-            expectedDocumentId: documentId,
-            expectedOrganizationId: input.expectedOrganizationId,
-            proof,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        await input.onVerifiedDeletion({
-            commitPurgeProof: verified.commitCheckpoints,
-            documentId,
-        });
-    };
-}
-export async function purgeRemoteDocument(input) {
-    const writerProjection = await resolveDocumentPurgeWriterProjection({
-        apiClient: input.apiClient,
-        documentId: input.documentId,
-    });
-    if (!writerProjection) {
-        return null;
-    }
-    if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {
-        const proof = await loadAuthenticatedDocumentPurgeProof({
-            apiClient: input.apiClient,
-            documentId: input.documentId,
-            execSql: input.execSql,
-            expectedOrganizationId: input.author.organizationId,
-            resolveProjectionUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        if (!proof) {
-            throw new ProjectionDependencyUnavailableError("Purged remote document is missing its signed purge proof");
-        }
-        const verified = await verifyDocumentPurgeProof({
-            execSql: input.execSql,
-            expectedDocumentId: input.documentId,
-            expectedOrganizationId: input.author.organizationId,
-            proof,
-            resolveUserKey: input.resolveProjectionUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        await input.onVerifiedPurge({
-            commitPurgeProof: verified.commitCheckpoints,
-        });
-        return { ...proof, reclaimedBlobStorageKeys: [] };
-    }
-    await verifyDocumentWriterProjection({
-        execSql: input.execSql,
-        projection: writerProjection,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const request = await buildDocumentPurgeRequest({
-        author: input.author,
-        expectedSubtreeRoot: input.expectedSubtreeRoot,
-        writerProjection,
-    });
-    if (input.beforeSubmit && !(await input.beforeSubmit()))
-        return null;
-    if (input.stillCurrent?.() === false)
-        return null;
-    const response = await input.apiClient.purgeDocument(input.documentId, request, {
-        expectedPaymentRequiredOrganizationId: input.author.organizationId,
-    });
-    if (!response) {
-        return null;
-    }
-    const verified = await verifyDocumentPurgeProof({
-        execSql: input.execSql,
-        expectedDocumentId: input.documentId,
-        expectedOrganizationId: input.author.organizationId,
-        proof: response,
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    await input.onVerifiedPurge({
-        commitPurgeProof: verified.commitCheckpoints,
-    });
-    return response;
-}
-//# sourceMappingURL=purge.js.map

package/workflows/documents/purge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"purge.js","sourceRoot":"","sources":["purge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAE1B,uBAAuB,EACvB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,6BAA6B,GAI9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,0CAA0C,GAC3C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,8BAA8B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAE7E,KAAK,UAAU,mCAAmC,CAAC,KAUlD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAC9D,KAAK,CAAC,UAAU,EAChB,SAAS,EACT;QACE,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CACF,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oCAAoC,CAAC,KAGnD;IAKC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,iCAAiC,CACpE,KAAK,CAAC,UAAU,EAChB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC3E,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,GAAG,kBAAkB,CAAC;IACzC,MAAM,qBAAqB,GAAG,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,MAAM,qBAAqB,GACzB,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACnD,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,kCAAkC,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAChC,CAAC;IACF,MAAM,IAAI,GAAiC;QACzC,kCAAkC;QAClC,WAAW;QACX,qBAAqB;QACrB,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,wBAAwB,EAAE,kCAAkC;QAC5D,QAAQ,EAAE,MAAM,0BAA0B,CACxC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAC/C;QACD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,4BAA4B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3E,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAa3D;IACC,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;YAC5C,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAezC;IACC,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,KAAK,8BAA8B,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;YACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,8BAA8B,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAClD,KAAK,CAAC,UAAU,EAChB,OAAO,EACP;QACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KACnE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACnD,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computeAccessEventBodyHash,\n  type DocumentPurgeAccessEventBody,\n  KeyingVerificationError,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeRequest } from \"@tearleads/validators/request\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentPurgeProofResponse,\n  type DocumentPurgeResponse,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  containerPathRefs,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  readManifestContainerId,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentSyncApi,\n} from \"../../data/documents/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../data/keying/canonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n  verifyDocumentWriterProjection,\n} from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"./subtreePurgeScope\";\n\ninterface DocumentPurgeApi {\n  getDocumentPurgeProof(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjectionResult: NonNullable<\n    DocumentSyncApi[\"getDocumentWriterProjectionResult\"]\n  >;\n  purgeDocument(\n    documentId: string,\n    request: DocumentPurgeRequest,\n    options?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeResponse | null>;\n}\n\nconst REMOTE_DOCUMENT_ALREADY_PURGED = Symbol(\"remoteDocumentAlreadyPurged\");\n\nasync function loadAuthenticatedDocumentPurgeProof(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeProofResponse | null> {\n  if (!input.apiClient.getDocumentPurgeProof) {\n    throw new ProjectionDependencyUnavailableError(\n      \"Remote document deletion is missing a purge-proof endpoint\",\n    );\n  }\n  const initialProof = await input.apiClient.getDocumentPurgeProof(\n    input.documentId,\n    undefined,\n    {\n      expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n    },\n  );\n  if (!initialProof) {\n    // ApiClient returns null for transport, HTTP and response-shape failures.\n    // Even after a deletion hint, absence cannot prove signed-data tampering.\n    // Keep local data and defer deletion until an actual proof verifies.\n    return null;\n  }\n  await verifyDocumentPurgeProofBaseline({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.expectedOrganizationId,\n    proof: initialProof,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  // The current API returns complete history to recorded readers. Otherwise\n  // its terminal snapshot needs an exact local pin; a floor refetch cannot\n  // grant missing observation authority.\n  return initialProof;\n}\n\nasync function resolveDocumentPurgeWriterProjection(input: {\n  readonly apiClient: DocumentPurgeApi;\n  readonly documentId: string;\n}): Promise<\n  | DocumentWriterProjectionResponse\n  | typeof REMOTE_DOCUMENT_ALREADY_PURGED\n  | null\n> {\n  const result = await input.apiClient.getDocumentWriterProjectionResult(\n    input.documentId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {\n    return REMOTE_DOCUMENT_ALREADY_PURGED;\n  }\n  result.report();\n  return null;\n}\n\nexport async function buildDocumentPurgeRequest(input: {\n  readonly author: DocumentCreateAuthor;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly eventId?: string | undefined;\n  readonly signedAt?: string | undefined;\n  readonly writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentPurgeRequest> {\n  const identity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document purge predecessor\",\n  });\n  if (identity.documentId !== input.writerProjection.documentId) {\n    throw new Error(\"Document purge projection identity mismatch\");\n  }\n  if (identity.organizationId !== input.author.organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge author organization mismatch\",\n    );\n  }\n  const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  if (linkedContainerIds.length !== 1) {\n    throw new Error(\"Document purge requires exactly one linked container\");\n  }\n  const [containerId] = linkedContainerIds;\n  const authorizingProjection = documentContainerProjections(\n    input.writerProjection,\n  ).find((projection) => {\n    const leaf = projection.path.at(-1);\n    return leaf && readManifestContainerId(leaf) === containerId;\n  });\n  const containerManifestHash =\n    authorizingProjection?.path.at(-1)?.manifestHash;\n  if (!authorizingProjection || !containerId || !containerManifestHash) {\n    throw new Error(\"Document purge authorization path is unavailable\");\n  }\n  assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);\n  const authorizingContainerManifestHashes = authorizingProjection.path.map(\n    (bundle) => bundle.manifestHash,\n  );\n  const body: DocumentPurgeAccessEventBody = {\n    authorizingContainerManifestHashes,\n    containerId,\n    containerManifestHash,\n    documentManifestHash: input.writerProjection.documentManifest.manifestHash,\n    eventType: \"document.purge\",\n  };\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId ?? crypto.randomUUID(),\n    eventType: \"document.purge\",\n    objectKind: \"document\",\n    objectId: input.writerProjection.documentId,\n    organizationId: input.author.organizationId,\n    previousManifestHash: input.writerProjection.documentManifest.manifestHash,\n    dependencyManifestHashes: authorizingContainerManifestHashes,\n    bodyHash: await computeAccessEventBodyHash(\n      readCanonicalJson(body, \"Document purge body\"),\n    ),\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),\n    body: readCanonicalRecord(body, \"Document purge body\"),\n    event: readCanonicalRecord(event, \"Document purge event\"),\n  };\n}\n\nexport function createVerifiedRemoteDocumentDeletionHandler(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly onVerifiedDeletion: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n    readonly documentId: string;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): (deleted: { readonly documentId: string }) => Promise<void> {\n  return async ({ documentId }) => {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.expectedOrganizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Remote document deletion is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: documentId,\n      expectedOrganizationId: input.expectedOrganizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedDeletion({\n      commitPurgeProof: verified.commitCheckpoints,\n      documentId,\n    });\n  };\n}\n\nexport async function purgeRemoteDocument(input: {\n  readonly beforeSubmit?: (() => Promise<boolean>) | undefined;\n  readonly apiClient: DocumentPurgeApi;\n  readonly author: DocumentCreateAuthor;\n  readonly documentId: string;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly execSql: ExecSql;\n  readonly onVerifiedPurge: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeResponse | null> {\n  const writerProjection = await resolveDocumentPurgeWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n  });\n  if (!writerProjection) {\n    return null;\n  }\n  if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId: input.documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.author.organizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Purged remote document is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: input.documentId,\n      expectedOrganizationId: input.author.organizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedPurge({\n      commitPurgeProof: verified.commitCheckpoints,\n    });\n    return { ...proof, reclaimedBlobStorageKeys: [] };\n  }\n  await verifyDocumentWriterProjection({\n    execSql: input.execSql,\n    projection: writerProjection,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const request = await buildDocumentPurgeRequest({\n    author: input.author,\n    expectedSubtreeRoot: input.expectedSubtreeRoot,\n    writerProjection,\n  });\n  if (input.beforeSubmit && !(await input.beforeSubmit())) return null;\n  if (input.stillCurrent?.() === false) return null;\n  const response = await input.apiClient.purgeDocument(\n    input.documentId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: input.author.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n  const verified = await verifyDocumentPurgeProof({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.author.organizationId,\n    proof: response,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  await input.onVerifiedPurge({\n    commitPurgeProof: verified.commitCheckpoints,\n  });\n  return response;\n}\n"]}

package/workflows/documents/readOnlyProjectionFailure.js

@@ -1,30 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { isDocumentSyncUpdateIsolationError } from "../../data/documents/shared/documentSyncUpdateIsolation.js";
-import { rethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
-import { DocumentRawHistoryUnavailableError } from "./syncContentKeys.js";
-import { projectionIntegrityErrorCode } from "./syncFailureClassification.js";
-export const REFRESH_CACHED_PROJECTION = Symbol("refresh cached projection");
-export function handleReadOnlyProjectionCompletionError(error, input) {
-    if (isDocumentSyncUpdateIsolationError(error)) {
-        throw error;
-    }
-    if (error instanceof DocumentRawHistoryUnavailableError) {
-        if (input.allowCachedProjectionRefresh) {
-            return error;
-        }
-        throw error;
-    }
-    if (input.allowCachedProjectionRefresh &&
-        error instanceof KeyingVerificationError &&
-        error.code === "invalid_shape") {
-        return REFRESH_CACHED_PROJECTION;
-    }
-    // The document-store `document.sync` boundary owns durable reporting; this
-    // helper only decides whether an ordinary projection miss is retryable.
-    rethrowKeyingVerificationError(error);
-    if (projectionIntegrityErrorCode(error) || input.historyMode === "raw") {
-        throw error;
-    }
-    return null;
-}
-//# sourceMappingURL=readOnlyProjectionFailure.js.map