@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/documents/purge/index.js

@@ -0,0 +1,204 @@
+import { computeAccessEventBodyHash, KeyingVerificationError, signAccessEvent, } from "../../../internal/crypto/index.js";
+import { DOCUMENT_NOT_FOUND_ERROR_CODE, } from "../../../internal/validators/response/index.js";
+import { containerPathRefs, readLinkedContainerIdsFromDocumentManifest, } from "../../../data/documents/shared/projection.js";
+import { assertDocumentManifestBundleConsistent, readManifestContainerId, } from "../../../data/documents/shared/readers.js";
+import { readCanonicalJson, readCanonicalRecord, } from "../../../data/keying/canonicalJson.js";
+import { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, verifyDocumentWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/document/documentContainerProjections.js";
+import { assertSubtreePurgePath, } from "./subtreePurgeScope.js";
+const REMOTE_DOCUMENT_ALREADY_PURGED = Symbol("remoteDocumentAlreadyPurged");
+async function loadAuthenticatedDocumentPurgeProof(input) {
+    if (!input.apiClient.getDocumentPurgeProof) {
+        throw new ProjectionDependencyUnavailableError("Remote document deletion is missing a purge-proof endpoint");
+    }
+    const initialProof = await input.apiClient.getDocumentPurgeProof(input.documentId, undefined, {
+        expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,
+    });
+    if (!initialProof) {
+        // ApiClient returns null for transport, HTTP and response-shape failures.
+        // Even after a deletion hint, absence cannot prove signed-data tampering.
+        // Keep local data and defer deletion until an actual proof verifies.
+        return null;
+    }
+    await verifyDocumentPurgeProofBaseline({
+        execSql: input.execSql,
+        expectedDocumentId: input.documentId,
+        expectedOrganizationId: input.expectedOrganizationId,
+        proof: initialProof,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    // The current API returns complete history to recorded readers. Otherwise
+    // its terminal snapshot needs an exact local pin; a floor refetch cannot
+    // grant missing observation authority.
+    return initialProof;
+}
+async function resolveDocumentPurgeWriterProjection(input) {
+    const result = await input.apiClient.getDocumentWriterProjectionResult(input.documentId, { reportErrors: false });
+    if (result.ok) {
+        return result.data;
+    }
+    if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {
+        return REMOTE_DOCUMENT_ALREADY_PURGED;
+    }
+    result.report();
+    return null;
+}
+export async function buildDocumentPurgeRequest(input) {
+    const identity = await assertDocumentManifestBundleConsistent({
+        bundle: input.writerProjection.documentManifest,
+        label: "Document purge predecessor",
+    });
+    if (identity.documentId !== input.writerProjection.documentId) {
+        throw new Error("Document purge projection identity mismatch");
+    }
+    if (identity.organizationId !== input.author.organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "Document purge author organization mismatch");
+    }
+    const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(input.writerProjection);
+    if (linkedContainerIds.length !== 1) {
+        throw new Error("Document purge requires exactly one linked container");
+    }
+    const [containerId] = linkedContainerIds;
+    const authorizingProjection = documentContainerProjections(input.writerProjection).find((projection) => {
+        const leaf = projection.path.at(-1);
+        return leaf && readManifestContainerId(leaf) === containerId;
+    });
+    const containerManifestHash = authorizingProjection?.path.at(-1)?.manifestHash;
+    if (!authorizingProjection || !containerId || !containerManifestHash) {
+        throw new Error("Document purge authorization path is unavailable");
+    }
+    assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);
+    const authorizingContainerManifestHashes = authorizingProjection.path.map((bundle) => bundle.manifestHash);
+    const body = {
+        authorizingContainerManifestHashes,
+        containerId,
+        containerManifestHash,
+        documentManifestHash: input.writerProjection.documentManifest.manifestHash,
+        eventType: "document.purge",
+    };
+    const unsignedEvent = {
+        version: 1,
+        eventId: input.eventId ?? crypto.randomUUID(),
+        eventType: "document.purge",
+        objectKind: "document",
+        objectId: input.writerProjection.documentId,
+        organizationId: input.author.organizationId,
+        previousManifestHash: input.writerProjection.documentManifest.manifestHash,
+        dependencyManifestHashes: authorizingContainerManifestHashes,
+        bodyHash: await computeAccessEventBodyHash(readCanonicalJson(body, "Document purge body")),
+        signerUserId: input.author.signerUserId,
+        signerDeviceId: input.author.signerDeviceId,
+        signerKeyFingerprint: input.author.signerKeyFingerprint,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    };
+    const event = await signAccessEvent(unsignedEvent, input.author.signerPrivateKey);
+    return {
+        authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),
+        body: readCanonicalRecord(body, "Document purge body"),
+        event: readCanonicalRecord(event, "Document purge event"),
+    };
+}
+export function createVerifiedRemoteDocumentDeletionHandler(input) {
+    return async ({ documentId }) => {
+        const proof = await loadAuthenticatedDocumentPurgeProof({
+            apiClient: input.apiClient,
+            documentId,
+            execSql: input.execSql,
+            expectedOrganizationId: input.expectedOrganizationId,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        if (!proof) {
+            throw new ProjectionDependencyUnavailableError("Remote document deletion is missing its signed purge proof");
+        }
+        const verified = await verifyDocumentPurgeProof({
+            execSql: input.execSql,
+            expectedDocumentId: documentId,
+            expectedOrganizationId: input.expectedOrganizationId,
+            proof,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        await input.onVerifiedDeletion({
+            commitPurgeProof: verified.commitCheckpoints,
+            documentId,
+        });
+    };
+}
+export async function purgeRemoteDocument(input) {
+    const writerProjection = await resolveDocumentPurgeWriterProjection({
+        apiClient: input.apiClient,
+        documentId: input.documentId,
+    });
+    if (!writerProjection) {
+        return null;
+    }
+    if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {
+        const proof = await loadAuthenticatedDocumentPurgeProof({
+            apiClient: input.apiClient,
+            documentId: input.documentId,
+            execSql: input.execSql,
+            expectedOrganizationId: input.author.organizationId,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        if (!proof) {
+            throw new ProjectionDependencyUnavailableError("Purged remote document is missing its signed purge proof");
+        }
+        const verified = await verifyDocumentPurgeProof({
+            execSql: input.execSql,
+            expectedDocumentId: input.documentId,
+            expectedOrganizationId: input.author.organizationId,
+            proof,
+            resolveUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+        await input.onVerifiedPurge({
+            commitPurgeProof: verified.commitCheckpoints,
+        });
+        return { ...proof, reclaimedBlobStorageKeys: [] };
+    }
+    await verifyDocumentWriterProjection({
+        execSql: input.execSql,
+        projection: writerProjection,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    const request = await buildDocumentPurgeRequest({
+        author: input.author,
+        expectedSubtreeRoot: input.expectedSubtreeRoot,
+        writerProjection,
+    });
+    if (input.beforeSubmit && !(await input.beforeSubmit()))
+        return null;
+    if (input.stillCurrent?.() === false)
+        return null;
+    const response = await input.apiClient.purgeDocument(input.documentId, request, {
+        expectedPaymentRequiredOrganizationId: input.author.organizationId,
+    });
+    if (!response) {
+        return null;
+    }
+    const verified = await verifyDocumentPurgeProof({
+        execSql: input.execSql,
+        expectedDocumentId: input.documentId,
+        expectedOrganizationId: input.author.organizationId,
+        proof: response,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    await input.onVerifiedPurge({
+        commitPurgeProof: verified.commitCheckpoints,
+    });
+    return response;
+}
+//# sourceMappingURL=index.js.map

package/workflows/documents/purge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAE1B,uBAAuB,EACvB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,6BAA6B,GAI9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,0CAA0C,GAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAK5C,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,4BAA4B,EAAE,MAAM,kFAAkF,CAAC;AAEhI,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,8BAA8B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAE7E,KAAK,UAAU,mCAAmC,CAAC,KAUlD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAC9D,KAAK,CAAC,UAAU,EAChB,SAAS,EACT;QACE,qCAAqC,EAAE,KAAK,CAAC,sBAAsB;KACpE,CACF,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oCAAoC,CAAC,KAGnD;IAKC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,iCAAiC,CACpE,KAAK,CAAC,UAAU,EAChB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC3E,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;QAC/C,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,GAAG,kBAAkB,CAAC;IACzC,MAAM,qBAAqB,GAAG,4BAA4B,CACxD,KAAK,CAAC,gBAAgB,CACvB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,MAAM,qBAAqB,GACzB,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACnD,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,kCAAkC,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAChC,CAAC;IACF,MAAM,IAAI,GAAiC;QACzC,kCAAkC;QAClC,WAAW;QACX,qBAAqB;QACrB,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,MAAM,aAAa,GAAwB;QACzC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;QAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY;QAC1E,wBAAwB,EAAE,kCAAkC;QAC5D,QAAQ,EAAE,MAAM,0BAA0B,CACxC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAC/C;QACD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9B,CAAC;IAEF,OAAO;QACL,4BAA4B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3E,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,KAa3D;IACC,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;YAC5C,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAezC;IACC,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,KAAK,8BAA8B,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAoC,CAC5C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;YACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YACnD,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,8BAA8B,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAClD,KAAK,CAAC,UAAU,EAChB,OAAO,EACP;QACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KACnE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACnD,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computeAccessEventBodyHash,\n  type DocumentPurgeAccessEventBody,\n  KeyingVerificationError,\n  signAccessEvent,\n  type UnsignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeRequest } from \"@tearleads/validators/request\";\nimport {\n  DOCUMENT_NOT_FOUND_ERROR_CODE,\n  type DocumentPurgeProofResponse,\n  type DocumentPurgeResponse,\n  type DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  containerPathRefs,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertDocumentManifestBundleConsistent,\n  readManifestContainerId,\n} from \"../../../data/documents/shared/readers\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentSyncApi,\n} from \"../../../data/documents/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../../data/keying/canonicalJson\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n  verifyDocumentWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/document/documentContainerProjections\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  assertSubtreePurgePath,\n  type SubtreePurgeRoot,\n} from \"./subtreePurgeScope\";\n\ninterface DocumentPurgeApi {\n  getDocumentPurgeProof(\n    documentId: string,\n    options?: {\n      readonly documentCheckpointManifestHash?: string;\n    },\n    requestOptions?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeProofResponse | null>;\n  getDocumentWriterProjectionResult: NonNullable<\n    DocumentSyncApi[\"getDocumentWriterProjectionResult\"]\n  >;\n  purgeDocument(\n    documentId: string,\n    request: DocumentPurgeRequest,\n    options?: {\n      readonly expectedPaymentRequiredOrganizationId?: string;\n    },\n  ): Promise<DocumentPurgeResponse | null>;\n}\n\nconst REMOTE_DOCUMENT_ALREADY_PURGED = Symbol(\"remoteDocumentAlreadyPurged\");\n\nasync function loadAuthenticatedDocumentPurgeProof(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly documentId: string;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeProofResponse | null> {\n  if (!input.apiClient.getDocumentPurgeProof) {\n    throw new ProjectionDependencyUnavailableError(\n      \"Remote document deletion is missing a purge-proof endpoint\",\n    );\n  }\n  const initialProof = await input.apiClient.getDocumentPurgeProof(\n    input.documentId,\n    undefined,\n    {\n      expectedPaymentRequiredOrganizationId: input.expectedOrganizationId,\n    },\n  );\n  if (!initialProof) {\n    // ApiClient returns null for transport, HTTP and response-shape failures.\n    // Even after a deletion hint, absence cannot prove signed-data tampering.\n    // Keep local data and defer deletion until an actual proof verifies.\n    return null;\n  }\n  await verifyDocumentPurgeProofBaseline({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.expectedOrganizationId,\n    proof: initialProof,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  // The current API returns complete history to recorded readers. Otherwise\n  // its terminal snapshot needs an exact local pin; a floor refetch cannot\n  // grant missing observation authority.\n  return initialProof;\n}\n\nasync function resolveDocumentPurgeWriterProjection(input: {\n  readonly apiClient: DocumentPurgeApi;\n  readonly documentId: string;\n}): Promise<\n  | DocumentWriterProjectionResponse\n  | typeof REMOTE_DOCUMENT_ALREADY_PURGED\n  | null\n> {\n  const result = await input.apiClient.getDocumentWriterProjectionResult(\n    input.documentId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  if (result.status === 404 && result.code === DOCUMENT_NOT_FOUND_ERROR_CODE) {\n    return REMOTE_DOCUMENT_ALREADY_PURGED;\n  }\n  result.report();\n  return null;\n}\n\nexport async function buildDocumentPurgeRequest(input: {\n  readonly author: DocumentCreateAuthor;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly eventId?: string | undefined;\n  readonly signedAt?: string | undefined;\n  readonly writerProjection: DocumentWriterProjectionResponse;\n}): Promise<DocumentPurgeRequest> {\n  const identity = await assertDocumentManifestBundleConsistent({\n    bundle: input.writerProjection.documentManifest,\n    label: \"Document purge predecessor\",\n  });\n  if (identity.documentId !== input.writerProjection.documentId) {\n    throw new Error(\"Document purge projection identity mismatch\");\n  }\n  if (identity.organizationId !== input.author.organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge author organization mismatch\",\n    );\n  }\n  const linkedContainerIds = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  if (linkedContainerIds.length !== 1) {\n    throw new Error(\"Document purge requires exactly one linked container\");\n  }\n  const [containerId] = linkedContainerIds;\n  const authorizingProjection = documentContainerProjections(\n    input.writerProjection,\n  ).find((projection) => {\n    const leaf = projection.path.at(-1);\n    return leaf && readManifestContainerId(leaf) === containerId;\n  });\n  const containerManifestHash =\n    authorizingProjection?.path.at(-1)?.manifestHash;\n  if (!authorizingProjection || !containerId || !containerManifestHash) {\n    throw new Error(\"Document purge authorization path is unavailable\");\n  }\n  assertSubtreePurgePath(authorizingProjection.path, input.expectedSubtreeRoot);\n  const authorizingContainerManifestHashes = authorizingProjection.path.map(\n    (bundle) => bundle.manifestHash,\n  );\n  const body: DocumentPurgeAccessEventBody = {\n    authorizingContainerManifestHashes,\n    containerId,\n    containerManifestHash,\n    documentManifestHash: input.writerProjection.documentManifest.manifestHash,\n    eventType: \"document.purge\",\n  };\n  const unsignedEvent: UnsignedAccessEvent = {\n    version: 1,\n    eventId: input.eventId ?? crypto.randomUUID(),\n    eventType: \"document.purge\",\n    objectKind: \"document\",\n    objectId: input.writerProjection.documentId,\n    organizationId: input.author.organizationId,\n    previousManifestHash: input.writerProjection.documentManifest.manifestHash,\n    dependencyManifestHashes: authorizingContainerManifestHashes,\n    bodyHash: await computeAccessEventBodyHash(\n      readCanonicalJson(body, \"Document purge body\"),\n    ),\n    signerUserId: input.author.signerUserId,\n    signerDeviceId: input.author.signerDeviceId,\n    signerKeyFingerprint: input.author.signerKeyFingerprint,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  };\n  const event = await signAccessEvent(\n    unsignedEvent,\n    input.author.signerPrivateKey,\n  );\n\n  return {\n    authorizingContainerPathRefs: containerPathRefs(authorizingProjection.path),\n    body: readCanonicalRecord(body, \"Document purge body\"),\n    event: readCanonicalRecord(event, \"Document purge event\"),\n  };\n}\n\nexport function createVerifiedRemoteDocumentDeletionHandler(input: {\n  readonly apiClient: Pick<DocumentSyncApi, \"getDocumentPurgeProof\">;\n  readonly execSql: ExecSql;\n  readonly expectedOrganizationId: string;\n  readonly onVerifiedDeletion: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n    readonly documentId: string;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): (deleted: { readonly documentId: string }) => Promise<void> {\n  return async ({ documentId }) => {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.expectedOrganizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Remote document deletion is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: documentId,\n      expectedOrganizationId: input.expectedOrganizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedDeletion({\n      commitPurgeProof: verified.commitCheckpoints,\n      documentId,\n    });\n  };\n}\n\nexport async function purgeRemoteDocument(input: {\n  readonly beforeSubmit?: (() => Promise<boolean>) | undefined;\n  readonly apiClient: DocumentPurgeApi;\n  readonly author: DocumentCreateAuthor;\n  readonly documentId: string;\n  readonly expectedSubtreeRoot?: SubtreePurgeRoot | undefined;\n  readonly execSql: ExecSql;\n  readonly onVerifiedPurge: (input: {\n    readonly commitPurgeProof: (transactionExecSql: ExecSql) => Promise<void>;\n  }) => Promise<void> | void;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<DocumentPurgeResponse | null> {\n  const writerProjection = await resolveDocumentPurgeWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n  });\n  if (!writerProjection) {\n    return null;\n  }\n  if (writerProjection === REMOTE_DOCUMENT_ALREADY_PURGED) {\n    const proof = await loadAuthenticatedDocumentPurgeProof({\n      apiClient: input.apiClient,\n      documentId: input.documentId,\n      execSql: input.execSql,\n      expectedOrganizationId: input.author.organizationId,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    if (!proof) {\n      throw new ProjectionDependencyUnavailableError(\n        \"Purged remote document is missing its signed purge proof\",\n      );\n    }\n    const verified = await verifyDocumentPurgeProof({\n      execSql: input.execSql,\n      expectedDocumentId: input.documentId,\n      expectedOrganizationId: input.author.organizationId,\n      proof,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    await input.onVerifiedPurge({\n      commitPurgeProof: verified.commitCheckpoints,\n    });\n    return { ...proof, reclaimedBlobStorageKeys: [] };\n  }\n  await verifyDocumentWriterProjection({\n    execSql: input.execSql,\n    projection: writerProjection,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const request = await buildDocumentPurgeRequest({\n    author: input.author,\n    expectedSubtreeRoot: input.expectedSubtreeRoot,\n    writerProjection,\n  });\n  if (input.beforeSubmit && !(await input.beforeSubmit())) return null;\n  if (input.stillCurrent?.() === false) return null;\n  const response = await input.apiClient.purgeDocument(\n    input.documentId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId: input.author.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n  const verified = await verifyDocumentPurgeProof({\n    execSql: input.execSql,\n    expectedDocumentId: input.documentId,\n    expectedOrganizationId: input.author.organizationId,\n    proof: response,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  await input.onVerifiedPurge({\n    commitPurgeProof: verified.commitCheckpoints,\n  });\n  return response;\n}\n"]}

package/workflows/documents/purge/persistedDocumentRemoval.d.ts

@@ -0,0 +1,44 @@
+import { type DocumentProjectorRegistryInput } from "../../../data/documents/documentKinds.js";
+import type { DiscardDocumentToShellResult, DocumentsPersistence, StoredDocumentRecord } from "../../../data/persistence/documents/documentsPersistence.js";
+import { type ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export declare function deletePersistedDocument(input: {
+    /**
+     * Runs in the same SQLite transaction as the matched document teardown.
+     * Used to atomically pin a verified terminal purge proof.
+     */
+    beforeDeleteInTransaction?: ((transactionExecSql: ExecSql) => Promise<void>) | undefined;
+    canStartDurableMutation?: (() => boolean) | undefined;
+    documentProjectors: DocumentProjectorRegistryInput;
+    execSql: ExecSql;
+    expectedRecord?: StoredDocumentRecord | undefined;
+    localId: string;
+    /**
+     * Runs INSIDE the serialized mutation, after the deletes commit: callers
+     * invalidate their in-memory store generation here so any failure handler
+     * queued behind this mutation observes the invalidation and cannot
+     * resurrect a row the deletion just removed.
+     */
+    onDeletedInMutation?: (() => void) | undefined;
+    persistence: DocumentsPersistence;
+}): Promise<boolean>;
+export type DiscardedDocumentShellResult = DiscardDocumentToShellResult;
+/**
+ * Convert a stuck document's local state to the freshly-discovered-share
+ * shell. The persistence implementation owns the whole sequence — the
+ * eligibility checks (local-only, unlinked, or move-pending documents are
+ * refused), the row teardown, the document-kind client-projection clear, and
+ * the shell upsert — and commits it as ONE transaction, so an interruption
+ * leaves either the fully old or the fully shelled document (never, e.g., a
+ * discarded contact whose projected fields stay visible). Implementations
+ * without the full document schema do not offer the operation and refuse.
+ *
+ * Returns the reclaimable storage keys on success — the deleted rows were
+ * the only durable pointers to those bytes, so the caller reclaims them.
+ */
+export declare function discardPersistedDocumentToShell(input: {
+    documentProjectors: DocumentProjectorRegistryInput;
+    execSql: ExecSql;
+    expectedDocumentId: string;
+    localId: string;
+    persistence: DocumentsPersistence;
+}): Promise<DiscardedDocumentShellResult>;

package/workflows/documents/purge/persistedDocumentRemoval.js

@@ -0,0 +1,70 @@
+import { DEFAULT_DOCUMENT_KIND } from "../../../data/documents/documentConstants.js";
+import { resolveDocumentProjectorRegistry, } from "../../../data/documents/documentKinds.js";
+import { runSerializedSqlMutation, } from "../../../data/sqlite/sqlSchema.js";
+import { ensureDocumentClientProjectionTables } from "../persistence.js";
+export async function deletePersistedDocument(input) {
+    const documentProjectors = resolveDocumentProjectorRegistry(input.documentProjectors);
+    await input.persistence.ensureSchema(input.execSql);
+    await ensureDocumentClientProjectionTables({
+        documentProjectors,
+        execSql: input.execSql,
+    });
+    let deleted = false;
+    await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {
+        // The guard runs INSIDE the claimed mutation: the pre-claim answer can go
+        // stale while the deletion waits behind another mutation (a store reset,
+        // a replacement generation's persist), and deleting on the stale answer
+        // would wipe rows the newer generation just wrote.
+        if (input.canStartDurableMutation && !input.canStartDurableMutation()) {
+            return;
+        }
+        if (input.expectedRecord) {
+            const identityMatched = await input.persistence.deleteDocumentIfMatches(lockedExecSql, input.expectedRecord, (transactionExecSql) => (async () => {
+                await documentProjectors.deleteStoredDocumentClientProjection({
+                    documentKind: input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                    execSql: transactionExecSql,
+                    localId: input.localId,
+                });
+                await input.beforeDeleteInTransaction?.(transactionExecSql);
+            })());
+            if (!identityMatched)
+                return;
+        }
+        else {
+            if (input.beforeDeleteInTransaction) {
+                throw new Error("Atomic document purge checkpointing requires an expected document record");
+            }
+            const existing = await input.persistence.loadDocument(lockedExecSql, input.localId);
+            await input.persistence.deleteDocument(lockedExecSql, input.localId);
+            await documentProjectors.deleteStoredDocumentClientProjection({
+                documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,
+                execSql: lockedExecSql,
+                localId: input.localId,
+            });
+        }
+        input.onDeletedInMutation?.();
+        deleted = true;
+    });
+    return deleted;
+}
+/**
+ * Convert a stuck document's local state to the freshly-discovered-share
+ * shell. The persistence implementation owns the whole sequence — the
+ * eligibility checks (local-only, unlinked, or move-pending documents are
+ * refused), the row teardown, the document-kind client-projection clear, and
+ * the shell upsert — and commits it as ONE transaction, so an interruption
+ * leaves either the fully old or the fully shelled document (never, e.g., a
+ * discarded contact whose projected fields stay visible). Implementations
+ * without the full document schema do not offer the operation and refuse.
+ *
+ * Returns the reclaimable storage keys on success — the deleted rows were
+ * the only durable pointers to those bytes, so the caller reclaims them.
+ */
+export async function discardPersistedDocumentToShell(input) {
+    await input.persistence.ensureSchema(input.execSql);
+    if (!input.persistence.discardDocumentToShell) {
+        return { discarded: false };
+    }
+    return input.persistence.discardDocumentToShell(input.execSql, input.localId, input.expectedDocumentId, input.documentProjectors);
+}
+//# sourceMappingURL=persistedDocumentRemoval.js.map

package/workflows/documents/purge/persistedDocumentRemoval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistedDocumentRemoval.js","sourceRoot":"","sources":["persistedDocumentRemoval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAEL,gCAAgC,GACjC,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAEL,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAqB7C;IACC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,oCAAoC,CAAC;QACzC,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CACrE,aAAa,EACb,KAAK,CAAC,cAAc,EACpB,CAAC,kBAAkB,EAAE,EAAE,CACrB,CAAC,KAAK,IAAI,EAAE;gBACV,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;oBAC5D,YAAY,EACV,KAAK,CAAC,cAAc,EAAE,YAAY,IAAI,qBAAqB;oBAC7D,OAAO,EAAE,kBAAkB;oBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,yBAAyB,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,CAAC,EAAE,CACP,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,OAAO;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CACnD,aAAa,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACF,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,kBAAkB,CAAC,oCAAoC,CAAC;gBAC5D,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,qBAAqB;gBAC7D,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAC7C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../../data/documents/documentConstants\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../../data/documents/documentKinds\";\nimport type {\n  DiscardDocumentToShellResult,\n  DocumentsPersistence,\n  StoredDocumentRecord,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../../data/sqlite/sqlSchema\";\nimport { ensureDocumentClientProjectionTables } from \"../persistence\";\n\nexport async function deletePersistedDocument(input: {\n  /**\n   * Runs in the same SQLite transaction as the matched document teardown.\n   * Used to atomically pin a verified terminal purge proof.\n   */\n  beforeDeleteInTransaction?:\n    | ((transactionExecSql: ExecSql) => Promise<void>)\n    | undefined;\n  canStartDurableMutation?: (() => boolean) | undefined;\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedRecord?: StoredDocumentRecord | undefined;\n  localId: string;\n  /**\n   * Runs INSIDE the serialized mutation, after the deletes commit: callers\n   * invalidate their in-memory store generation here so any failure handler\n   * queued behind this mutation observes the invalidation and cannot\n   * resurrect a row the deletion just removed.\n   */\n  onDeletedInMutation?: (() => void) | undefined;\n  persistence: DocumentsPersistence;\n}): Promise<boolean> {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.documentProjectors,\n  );\n  await input.persistence.ensureSchema(input.execSql);\n  await ensureDocumentClientProjectionTables({\n    documentProjectors,\n    execSql: input.execSql,\n  });\n  let deleted = false;\n  await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {\n    // The guard runs INSIDE the claimed mutation: the pre-claim answer can go\n    // stale while the deletion waits behind another mutation (a store reset,\n    // a replacement generation's persist), and deleting on the stale answer\n    // would wipe rows the newer generation just wrote.\n    if (input.canStartDurableMutation && !input.canStartDurableMutation()) {\n      return;\n    }\n    if (input.expectedRecord) {\n      const identityMatched = await input.persistence.deleteDocumentIfMatches(\n        lockedExecSql,\n        input.expectedRecord,\n        (transactionExecSql) =>\n          (async () => {\n            await documentProjectors.deleteStoredDocumentClientProjection({\n              documentKind:\n                input.expectedRecord?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n              execSql: transactionExecSql,\n              localId: input.localId,\n            });\n            await input.beforeDeleteInTransaction?.(transactionExecSql);\n          })(),\n      );\n      if (!identityMatched) return;\n    } else {\n      if (input.beforeDeleteInTransaction) {\n        throw new Error(\n          \"Atomic document purge checkpointing requires an expected document record\",\n        );\n      }\n      const existing = await input.persistence.loadDocument(\n        lockedExecSql,\n        input.localId,\n      );\n      await input.persistence.deleteDocument(lockedExecSql, input.localId);\n      await documentProjectors.deleteStoredDocumentClientProjection({\n        documentKind: existing?.documentKind ?? DEFAULT_DOCUMENT_KIND,\n        execSql: lockedExecSql,\n        localId: input.localId,\n      });\n    }\n    input.onDeletedInMutation?.();\n    deleted = true;\n  });\n  return deleted;\n}\n\nexport type DiscardedDocumentShellResult = DiscardDocumentToShellResult;\n\n/**\n * Convert a stuck document's local state to the freshly-discovered-share\n * shell. The persistence implementation owns the whole sequence — the\n * eligibility checks (local-only, unlinked, or move-pending documents are\n * refused), the row teardown, the document-kind client-projection clear, and\n * the shell upsert — and commits it as ONE transaction, so an interruption\n * leaves either the fully old or the fully shelled document (never, e.g., a\n * discarded contact whose projected fields stay visible). Implementations\n * without the full document schema do not offer the operation and refuse.\n *\n * Returns the reclaimable storage keys on success — the deleted rows were\n * the only durable pointers to those bytes, so the caller reclaims them.\n */\nexport async function discardPersistedDocumentToShell(input: {\n  documentProjectors: DocumentProjectorRegistryInput;\n  execSql: ExecSql;\n  expectedDocumentId: string;\n  localId: string;\n  persistence: DocumentsPersistence;\n}): Promise<DiscardedDocumentShellResult> {\n  await input.persistence.ensureSchema(input.execSql);\n  if (!input.persistence.discardDocumentToShell) {\n    return { discarded: false };\n  }\n  return input.persistence.discardDocumentToShell(\n    input.execSql,\n    input.localId,\n    input.expectedDocumentId,\n    input.documentProjectors,\n  );\n}\n"]}

package/workflows/documents/purge/subtreePurgeScope.d.ts

@@ -0,0 +1,8 @@
+import type { AccessManifestBundleWireResponse } from "../../../internal/validators/response/index.js";
+/** The selected purge root and the parent the user selected it under. */
+export interface SubtreePurgeRoot {
+    readonly id: string;
+    readonly parentId: string | null;
+}
+/** Check the exact verified path that the destructive request will cite. */
+export declare function assertSubtreePurgePath(path: readonly AccessManifestBundleWireResponse[], root: SubtreePurgeRoot | undefined): void;

package/workflows/documents/purge/subtreePurgeScope.js

@@ -0,0 +1,18 @@
+import { isPlainObject } from "../../../internal/validators/isPlainObject.js";
+import { readManifestContainerId } from "../../../data/documents/shared/readers.js";
+function readSignedParentContainerId(bundle) {
+    return isPlainObject(bundle.state)
+        ? Reflect.get(bundle.state, "parentContainerId")
+        : undefined;
+}
+/** Check the exact verified path that the destructive request will cite. */
+export function assertSubtreePurgePath(path, root) {
+    if (root === undefined)
+        return;
+    const rootBundle = path.find((bundle) => readManifestContainerId(bundle) === root.id);
+    // A valid move out of the selected subtree, or a settled restore of the
+    // selected root itself, is ordinary concurrent work.
+    if (!rootBundle || readSignedParentContainerId(rootBundle) !== root.parentId)
+        throw new Error("Document placement is outside the requested purge subtree");
+}
+//# sourceMappingURL=subtreePurgeScope.js.map

package/workflows/documents/purge/subtreePurgeScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subtreePurgeScope.js","sourceRoot":"","sources":["subtreePurgeScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAQjF,SAAS,2BAA2B,CAClC,MAAwC;IAExC,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAAC;QAChD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,IAAiD,EACjD,IAAkC;IAElC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CACxD,CAAC;IACF,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,CAAC,UAAU,IAAI,2BAA2B,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ;QAC1E,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;AACN,CAAC","sourcesContent":["import { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { readManifestContainerId } from \"../../../data/documents/shared/readers\";\n\n/** The selected purge root and the parent the user selected it under. */\nexport interface SubtreePurgeRoot {\n  readonly id: string;\n  readonly parentId: string | null;\n}\n\nfunction readSignedParentContainerId(\n  bundle: AccessManifestBundleWireResponse,\n): unknown {\n  return isPlainObject(bundle.state)\n    ? Reflect.get(bundle.state, \"parentContainerId\")\n    : undefined;\n}\n\n/** Check the exact verified path that the destructive request will cite. */\nexport function assertSubtreePurgePath(\n  path: readonly AccessManifestBundleWireResponse[],\n  root: SubtreePurgeRoot | undefined,\n): void {\n  if (root === undefined) return;\n  const rootBundle = path.find(\n    (bundle) => readManifestContainerId(bundle) === root.id,\n  );\n  // A valid move out of the selected subtree, or a settled restore of the\n  // selected root itself, is ordinary concurrent work.\n  if (!rootBundle || readSignedParentContainerId(rootBundle) !== root.parentId)\n    throw new Error(\n      \"Document placement is outside the requested purge subtree\",\n    );\n}\n"]}

package/workflows/documents/rotationBaseline.js

@@ -2,7 +2,7 @@ import { emptyVersionVector, getImportBlobMetadata, versionVectorsEqual, } from
 import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
 import { importContentKeyMaterial } from "../../data/documents/shared/contentRecordKeys.js";
 import { encryptDocumentPendingUpdate } from "../../data/documents/shared/crypto.js";
-import { signDocumentOutgoingUpdate } from "./syncPlanIdentity.js";
+import { signDocumentOutgoingUpdate } from "./syncPlan/syncPlanIdentity.js";
 // A zero-span snapshot (empty document) yields no baseline; the unlink is
 // sent without one and the server verifies the committed frontier is empty.
 export async function completeLinkSetMutationRequest(input) {

package/workflows/documents/rotationBaseline.js.map

@@ -1 +1 @@
-{"version":3,"file":"rotationBaseline.js","sourceRoot":"","sources":["rotationBaseline.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAMlF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,MAAM,gBAAgB,GACpB,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB;QACpD,CAAC,CAAC,MAAM,6BAA6B,CAAC;YAClC,4BAA4B,EAC1B,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B;YAClE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe;YAC5D,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU;YAClD,2BAA2B,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY;YACrE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU;YAC1D,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;YAChE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;SACjC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE;QAC9D,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAWnD;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,IACE,QAAQ,CAAC,IAAI,KAAK,UAAU;QAC5B,CAAC,mBAAmB,CAClB,QAAQ,CAAC,yBAAyB,EAClC,kBAAkB,EAAE,CACrB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAC7C,KAAK,CAAC,QAAQ,EACd,QAAQ,CAAC,uBAAuB,CACjC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,GAAG;QACpB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,aAAa;KACjB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC;QACpE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;QAChC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE;YACN,cAAc,EAAE,iBAAiB;YACjC,qBAAqB,EAAE,uBAAuB;YAC9C,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,uBAAuB,EAAE,aAAa,CAAC,uBAAuB;YAC9D,yBAAyB,EAAE,aAAa,CAAC,yBAAyB;YAClE,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,mBAAmB,EAAE,QAAQ,CAAC,uBAAuB;SACtD;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  emptyVersionVector,\n  getImportBlobMetadata,\n  versionVectorsEqual,\n} from \"@tearleads/loro\";\nimport type {\n  ContainerManifestRef,\n  DocumentOutgoingUpdate,\n} from \"@tearleads/validators/request\";\nimport { createPendingUpdateFields } from \"../../data/documents/documentSync\";\nimport { importContentKeyMaterial } from \"../../data/documents/shared/contentRecordKeys\";\nimport { encryptDocumentPendingUpdate } from \"../../data/documents/shared/crypto\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetMutationOperation,\n  MaterializedDocumentLinkSetMutationPlan,\n} from \"../../data/documents/shared/types\";\nimport { signDocumentOutgoingUpdate } from \"./syncPlanIdentity\";\n\n// A zero-span snapshot (empty document) yields no baseline; the unlink is\n// sent without one and the server verifies the committed frontier is empty.\nexport async function completeLinkSetMutationRequest(input: {\n  author: DocumentCreateAuthor;\n  materializedPlan: MaterializedDocumentLinkSetMutationPlan;\n  operation: DocumentLinkSetMutationOperation;\n  rotationSnapshot: Uint8Array | undefined;\n  signedAt: string;\n}) {\n  const rotationBaseline =\n    input.operation === \"unlink\" && input.rotationSnapshot\n      ? await buildDocumentRotationBaseline({\n          authorizingContainerPathRefs:\n            input.materializedPlan.plan.request.authorizingContainerPathRefs,\n          author: input.author,\n          contentKey: input.materializedPlan.contentKey,\n          contentKeyEpoch: input.materializedPlan.plan.contentKeyEpoch,\n          documentId: input.materializedPlan.plan.documentId,\n          expectedLinkSetManifestHash: input.materializedPlan.plan.manifestHash,\n          expectedTargetHash: input.materializedPlan.plan.targetHash,\n          organizationId: input.materializedPlan.plan.state.organizationId,\n          signedAt: input.signedAt,\n          snapshot: input.rotationSnapshot,\n        })\n      : null;\n  return rotationBaseline\n    ? { ...input.materializedPlan.plan.request, rotationBaseline }\n    : input.materializedPlan.plan.request;\n}\n\nexport async function buildDocumentRotationBaseline(input: {\n  readonly authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n  readonly author: DocumentCreateAuthor;\n  readonly contentKey: Uint8Array;\n  readonly contentKeyEpoch: number;\n  readonly documentId: string;\n  readonly expectedLinkSetManifestHash: string;\n  readonly expectedTargetHash: string;\n  readonly organizationId: string;\n  readonly signedAt: string;\n  readonly snapshot: Uint8Array;\n}): Promise<DocumentOutgoingUpdate | null> {\n  const metadata = getImportBlobMetadata(input.snapshot);\n  if (\n    metadata.mode !== \"snapshot\" ||\n    !versionVectorsEqual(\n      metadata.partialStartVersionVector,\n      emptyVersionVector(),\n    )\n  ) {\n    throw new Error(\n      \"Document unlink requires a full-history rotation snapshot\",\n    );\n  }\n  const pendingFields = createPendingUpdateFields(\n    input.snapshot,\n    metadata.partialEndVersionVector,\n  );\n  if (!pendingFields) {\n    // A document with no history serializes to a zero-span full-history\n    // snapshot. There is nothing for a rotation baseline to cover, so the\n    // unlink is submitted without one; the server independently proves the\n    // committed frontier is empty before accepting it.\n    return null;\n  }\n  const pendingUpdate = {\n    id: crypto.randomUUID(),\n    ...pendingFields,\n  };\n  const encrypted = await encryptDocumentPendingUpdate({\n    contentKeyMaterial: await importContentKeyMaterial(input.contentKey),\n    contentKeyEpoch: input.contentKeyEpoch,\n    documentId: input.documentId,\n    organizationId: input.organizationId,\n    update: pendingUpdate,\n  });\n\n  return signDocumentOutgoingUpdate({\n    authorizingContainerPathRefs: input.authorizingContainerPathRefs,\n    author: input.author,\n    contentKeyEpoch: input.contentKeyEpoch,\n    documentId: input.documentId,\n    expectedLinkSetManifestHash: input.expectedLinkSetManifestHash,\n    expectedTargetHash: input.expectedTargetHash,\n    organizationId: input.organizationId,\n    signedAt: input.signedAt,\n    update: {\n      checkpointKind: \"rotate_baseline\",\n      checkpointPayloadKind: \"full_history_snapshot\",\n      ciphertextHash: encrypted.ciphertextHash,\n      contentRecordId: encrypted.contentRecordId,\n      encryptedData: encrypted.encryptedData,\n      id: pendingUpdate.id,\n      metadataHash: encrypted.metadataHash,\n      partialEndVersionVector: pendingFields.partialEndVersionVector,\n      partialStartVersionVector: pendingFields.partialStartVersionVector,\n      plaintextHash: encrypted.plaintextHash,\n      sourceVersionVector: metadata.partialEndVersionVector,\n    },\n  });\n}\n"]}
+{"version":3,"file":"rotationBaseline.js","sourceRoot":"","sources":["rotationBaseline.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAMlF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,MAAM,gBAAgB,GACpB,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB;QACpD,CAAC,CAAC,MAAM,6BAA6B,CAAC;YAClC,4BAA4B,EAC1B,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B;YAClE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC7C,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe;YAC5D,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU;YAClD,2BAA2B,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY;YACrE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU;YAC1D,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;YAChE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;SACjC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE;QAC9D,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAWnD;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,IACE,QAAQ,CAAC,IAAI,KAAK,UAAU;QAC5B,CAAC,mBAAmB,CAClB,QAAQ,CAAC,yBAAyB,EAClC,kBAAkB,EAAE,CACrB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAC7C,KAAK,CAAC,QAAQ,EACd,QAAQ,CAAC,uBAAuB,CACjC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,GAAG;QACpB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,aAAa;KACjB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC;QACpE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;QAChC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE;YACN,cAAc,EAAE,iBAAiB;YACjC,qBAAqB,EAAE,uBAAuB;YAC9C,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,uBAAuB,EAAE,aAAa,CAAC,uBAAuB;YAC9D,yBAAyB,EAAE,aAAa,CAAC,yBAAyB;YAClE,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,mBAAmB,EAAE,QAAQ,CAAC,uBAAuB;SACtD;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  emptyVersionVector,\n  getImportBlobMetadata,\n  versionVectorsEqual,\n} from \"@tearleads/loro\";\nimport type {\n  ContainerManifestRef,\n  DocumentOutgoingUpdate,\n} from \"@tearleads/validators/request\";\nimport { createPendingUpdateFields } from \"../../data/documents/documentSync\";\nimport { importContentKeyMaterial } from \"../../data/documents/shared/contentRecordKeys\";\nimport { encryptDocumentPendingUpdate } from \"../../data/documents/shared/crypto\";\nimport type {\n  DocumentCreateAuthor,\n  DocumentLinkSetMutationOperation,\n  MaterializedDocumentLinkSetMutationPlan,\n} from \"../../data/documents/shared/types\";\nimport { signDocumentOutgoingUpdate } from \"./syncPlan/syncPlanIdentity\";\n\n// A zero-span snapshot (empty document) yields no baseline; the unlink is\n// sent without one and the server verifies the committed frontier is empty.\nexport async function completeLinkSetMutationRequest(input: {\n  author: DocumentCreateAuthor;\n  materializedPlan: MaterializedDocumentLinkSetMutationPlan;\n  operation: DocumentLinkSetMutationOperation;\n  rotationSnapshot: Uint8Array | undefined;\n  signedAt: string;\n}) {\n  const rotationBaseline =\n    input.operation === \"unlink\" && input.rotationSnapshot\n      ? await buildDocumentRotationBaseline({\n          authorizingContainerPathRefs:\n            input.materializedPlan.plan.request.authorizingContainerPathRefs,\n          author: input.author,\n          contentKey: input.materializedPlan.contentKey,\n          contentKeyEpoch: input.materializedPlan.plan.contentKeyEpoch,\n          documentId: input.materializedPlan.plan.documentId,\n          expectedLinkSetManifestHash: input.materializedPlan.plan.manifestHash,\n          expectedTargetHash: input.materializedPlan.plan.targetHash,\n          organizationId: input.materializedPlan.plan.state.organizationId,\n          signedAt: input.signedAt,\n          snapshot: input.rotationSnapshot,\n        })\n      : null;\n  return rotationBaseline\n    ? { ...input.materializedPlan.plan.request, rotationBaseline }\n    : input.materializedPlan.plan.request;\n}\n\nexport async function buildDocumentRotationBaseline(input: {\n  readonly authorizingContainerPathRefs: readonly (readonly ContainerManifestRef[])[];\n  readonly author: DocumentCreateAuthor;\n  readonly contentKey: Uint8Array;\n  readonly contentKeyEpoch: number;\n  readonly documentId: string;\n  readonly expectedLinkSetManifestHash: string;\n  readonly expectedTargetHash: string;\n  readonly organizationId: string;\n  readonly signedAt: string;\n  readonly snapshot: Uint8Array;\n}): Promise<DocumentOutgoingUpdate | null> {\n  const metadata = getImportBlobMetadata(input.snapshot);\n  if (\n    metadata.mode !== \"snapshot\" ||\n    !versionVectorsEqual(\n      metadata.partialStartVersionVector,\n      emptyVersionVector(),\n    )\n  ) {\n    throw new Error(\n      \"Document unlink requires a full-history rotation snapshot\",\n    );\n  }\n  const pendingFields = createPendingUpdateFields(\n    input.snapshot,\n    metadata.partialEndVersionVector,\n  );\n  if (!pendingFields) {\n    // A document with no history serializes to a zero-span full-history\n    // snapshot. There is nothing for a rotation baseline to cover, so the\n    // unlink is submitted without one; the server independently proves the\n    // committed frontier is empty before accepting it.\n    return null;\n  }\n  const pendingUpdate = {\n    id: crypto.randomUUID(),\n    ...pendingFields,\n  };\n  const encrypted = await encryptDocumentPendingUpdate({\n    contentKeyMaterial: await importContentKeyMaterial(input.contentKey),\n    contentKeyEpoch: input.contentKeyEpoch,\n    documentId: input.documentId,\n    organizationId: input.organizationId,\n    update: pendingUpdate,\n  });\n\n  return signDocumentOutgoingUpdate({\n    authorizingContainerPathRefs: input.authorizingContainerPathRefs,\n    author: input.author,\n    contentKeyEpoch: input.contentKeyEpoch,\n    documentId: input.documentId,\n    expectedLinkSetManifestHash: input.expectedLinkSetManifestHash,\n    expectedTargetHash: input.expectedTargetHash,\n    organizationId: input.organizationId,\n    signedAt: input.signedAt,\n    update: {\n      checkpointKind: \"rotate_baseline\",\n      checkpointPayloadKind: \"full_history_snapshot\",\n      ciphertextHash: encrypted.ciphertextHash,\n      contentRecordId: encrypted.contentRecordId,\n      encryptedData: encrypted.encryptedData,\n      id: pendingUpdate.id,\n      metadataHash: encrypted.metadataHash,\n      partialEndVersionVector: pendingFields.partialEndVersionVector,\n      partialStartVersionVector: pendingFields.partialStartVersionVector,\n      plaintextHash: encrypted.plaintextHash,\n      sourceVersionVector: metadata.partialEndVersionVector,\n    },\n  });\n}\n"]}

package/workflows/documents/sync/index.d.ts

@@ -0,0 +1,4 @@
+import type { SyncRemoteDocumentResult } from "../../../data/documents/shared/types.js";
+import { type SyncRemoteDocumentInput } from "./readOnlySync.js";
+export declare function hasDocumentUpdateEvent(events: ReadonlyArray<unknown>, documentId: string | null | undefined): boolean;
+export declare function syncRemoteDocument(input: SyncRemoteDocumentInput): Promise<SyncRemoteDocumentResult | null>;