mindoodb 0.0.72 → 0.0.74

package/dist/core/BaseMindooDB.js

@@ -8,13 +8,16 @@ const automerge_adapter_1 = require("./automerge-adapter");
 const values_1 = require("./values");
 const storeEntryTime_1 = require("./storeEntryTime");
 const types_1 = require("./types");
-const types_2 = require("./appendonlystores/types");
+const types_2 = require("./types");
+const types_3 = require("./appendonlystores/types");
 const syncStores_1 = require("./appendonlystores/syncStores");
-const types_3 = require("./appendonlystores/network/types");
+const types_4 = require("./appendonlystores/network/types");
 const MaterializationPlanner_1 = require("./appendonlystores/MaterializationPlanner");
 const DocumentDagAnalysis_1 = require("./DocumentDagAnalysis");
 const DocumentConflictAnalysis_1 = require("./DocumentConflictAnalysis");
 const AttachmentReadPlanner_1 = require("./appendonlystores/AttachmentReadPlanner");
+const purgedDocumentGuard_1 = require("./appendonlystores/purgedDocumentGuard");
+const purgeDocumentHistory_1 = require("./appendonlystores/purgeDocumentHistory");
 const idGeneration_1 = require("./utils/idGeneration");
 const timeSource_1 = require("./utils/timeSource");
 const errors_1 = require("./errors");
@@ -31,13 +34,14 @@ const builtinDbInvariants_1 = require("./builtinDbInvariants");
 const recipients_1 = require("./userkeys/recipients");
 const sealedTypes_1 = require("./userkeys/sealedTypes");
 const DocumentSummaryStore_1 = require("./indexing/summary/DocumentSummaryStore");
-const types_4 = require("./indexing/summary/types");
+const types_5 = require("./indexing/summary/types");
 const DocumentFullTextIndex_1 = require("./indexing/fulltext/DocumentFullTextIndex");
-const types_5 = require("./indexing/fulltext/types");
-const types_6 = require("./extraction/types");
+const types_6 = require("./indexing/fulltext/types");
+const types_7 = require("./extraction/types");
 const executeQuery_1 = require("./query/executeQuery");
 const queryView_1 = require("./query/queryView");
 const queryLive_1 = require("./query/queryLive");
+const BackgroundTaskTracker_1 = require("./BackgroundTaskTracker");
 /**
  * Default chunk size for attachments: 256KB
  */
@@ -114,7 +118,7 @@ function networkErrorType(error) {
  * server's `Retry-After` when it asks for a longer wait than our backoff.
  */
 function rateLimitRetryDelayMs(error, attempt) {
-    if (networkErrorType(error) !== types_3.NetworkErrorType.RATE_LIMITED ||
+    if (networkErrorType(error) !== types_4.NetworkErrorType.RATE_LIMITED ||
         attempt >= PREFETCH_RATE_LIMIT_DELAYS_MS.length) {
         return null;
     }
@@ -247,10 +251,12 @@ class BaseMindooDB {
          */
         this.quarantineLog = new Map();
         /**
-         * Short-TTL cache of "is access control active for this tenant?" so the
-         * materialization fast-path does not re-query the directory on every load.
+         * Last known "is access control active for this tenant?" verdict. Only used
+         * as the fail-closed fallback when the directory cannot be consulted; the
+         * live check itself is cheap because the directory skips its rebuild while
+         * its changefeed `changeSeq` is unchanged.
          */
-        this.aclActiveCache = null;
+        this.aclActiveLastKnown = null;
         /**
          * Per-document cache of the original creator's signing public key and the
          * trusted time of the `doc_create` entry. Used by the client write prechecks
@@ -450,6 +456,8 @@ class BaseMindooDB {
         this.changeNotifyTimer = null;
         /** While > 0, timer-based emission is suppressed (e.g. during a sync batch). */
         this.changeNotificationHolds = 0;
+        /** Fire-and-forget work of this database; see {@link whenBackgroundIdle}. */
+        this.backgroundTasks = new BackgroundTaskTracker_1.BackgroundTaskTracker();
         // ---------------------------------------------------------------------------
         // Summary auto-follow (see setSummaryAutoUpdateEnabled): keeps the summary
         // buffer current as changes arrive (local writes and sync batches), so the
@@ -565,11 +573,11 @@ class BaseMindooDB {
         if (store.getId() !== attachmentStore.getId()) {
             throw new Error(`[BaseMindooDB] Expected document and attachment stores to share dbId but received ${store.getId()} and ${attachmentStore.getId()}`);
         }
-        if (store.getStoreKind() !== types_2.StoreKind.docs) {
-            throw new Error(`[BaseMindooDB] Expected primary store kind ${types_2.StoreKind.docs} but received ${store.getStoreKind()}`);
+        if (store.getStoreKind() !== types_3.StoreKind.docs) {
+            throw new Error(`[BaseMindooDB] Expected primary store kind ${types_3.StoreKind.docs} but received ${store.getStoreKind()}`);
         }
-        if (attachmentStore.getStoreKind() !== types_2.StoreKind.attachments) {
-            throw new Error(`[BaseMindooDB] Expected attachment store kind ${types_2.StoreKind.attachments} but received ${attachmentStore.getStoreKind()}`);
+        if (attachmentStore.getStoreKind() !== types_3.StoreKind.attachments) {
+            throw new Error(`[BaseMindooDB] Expected attachment store kind ${types_3.StoreKind.attachments} but received ${attachmentStore.getStoreKind()}`);
         }
         this.tenant = tenant;
         this.store = store;
@@ -896,7 +904,7 @@ class BaseMindooDB {
         this.dirtyDocIds.clear();
         this.cacheMetaDirty = false;
         this.summaryStore?.discardDirtyState();
-        this.fulltextIndex?.clearDirty();
+        this.fulltextIndex?.discardDirtyState();
         void cacheManager.deregister(this);
         if (this.summaryStore) {
             void cacheManager.deregister(this.summaryStore);
@@ -937,8 +945,8 @@ class BaseMindooDB {
      */
     async getSummarySetup() {
         try {
-            const doc = await this.getDocument(types_4.DB_SETUP_DOC_ID);
-            return (0, types_4.sanitizeSummaryConfig)(doc.getData()[types_4.SUMMARY_SETUP_FIELD]) ?? null;
+            const doc = await this.getDocument(types_5.DB_SETUP_DOC_ID);
+            return (0, types_5.sanitizeSummaryConfig)(doc.getData()[types_5.SUMMARY_SETUP_FIELD]) ?? null;
         }
         catch (error) {
             if (error instanceof errors_1.DocumentNotFoundError ||
@@ -960,14 +968,14 @@ class BaseMindooDB {
      * backfill — locally and, after sync, on every other replica.
      */
     async setSummarySetup(config) {
-        const doc = await this.createDocument({ id: types_4.DB_SETUP_DOC_ID });
+        const doc = await this.createDocument({ id: types_5.DB_SETUP_DOC_ID });
         await this.changeDoc(doc, (d) => {
             const data = d.getData();
             if (config === null) {
-                delete data[types_4.SUMMARY_SETUP_FIELD];
+                delete data[types_5.SUMMARY_SETUP_FIELD];
             }
             else {
-                data[types_4.SUMMARY_SETUP_FIELD] = (0, types_4.sanitizeSummaryConfig)(config) ?? {};
+                data[types_5.SUMMARY_SETUP_FIELD] = (0, types_5.sanitizeSummaryConfig)(config) ?? {};
             }
         });
     }
@@ -1011,12 +1019,12 @@ class BaseMindooDB {
             this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
-        const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
+        const hasSetupChange = changes.some((change) => change.docId === types_5.DB_SETUP_DOC_ID);
         if (!hasSetupChange && this.summarySetupProbed) {
             return;
         }
         this.summarySetupProbed = true;
-        void this.activateSummaryFromSetupDoc();
+        this.backgroundTasks.run(this.activateSummaryFromSetupDoc());
     }
     /** Create the summary store when the setup document configures one. */
     async activateSummaryFromSetupDoc() {
@@ -1047,7 +1055,7 @@ class BaseMindooDB {
             return;
         }
         this.summaryAutoUpdateRunning = true;
-        void (async () => {
+        this.backgroundTasks.run((async () => {
             try {
                 do {
                     this.summaryAutoUpdatePending = false;
@@ -1061,7 +1069,7 @@ class BaseMindooDB {
             finally {
                 this.summaryAutoUpdateRunning = false;
             }
-        })();
+        })());
     }
     // ---------------------------------------------------------------------------
     // Full-text index (see docs/fulltext-search.md)
@@ -1101,8 +1109,8 @@ class BaseMindooDB {
      */
     async getFulltextSetup() {
         try {
-            const doc = await this.getDocument(types_4.DB_SETUP_DOC_ID);
-            return ((0, types_5.sanitizeFulltextConfig)(doc.getData()[types_5.FULLTEXT_SETUP_FIELD]) ?? null);
+            const doc = await this.getDocument(types_5.DB_SETUP_DOC_ID);
+            return ((0, types_6.sanitizeFulltextConfig)(doc.getData()[types_6.FULLTEXT_SETUP_FIELD]) ?? null);
         }
         catch (error) {
             if (error instanceof errors_1.DocumentNotFoundError ||
@@ -1126,19 +1134,19 @@ class BaseMindooDB {
      * resumable backfill — locally and, after sync, on every other replica.
      */
     async setFulltextSetup(config) {
-        const sanitized = config === null ? null : ((0, types_5.sanitizeFulltextConfig)(config) ?? {});
+        const sanitized = config === null ? null : ((0, types_6.sanitizeFulltextConfig)(config) ?? {});
         const current = await this.getFulltextSetup();
         if (JSON.stringify(current) === JSON.stringify(sanitized)) {
             return;
         }
-        const doc = await this.createDocument({ id: types_4.DB_SETUP_DOC_ID });
+        const doc = await this.createDocument({ id: types_5.DB_SETUP_DOC_ID });
         await this.changeDoc(doc, (d) => {
             const data = d.getData();
             if (sanitized === null) {
-                delete data[types_5.FULLTEXT_SETUP_FIELD];
+                delete data[types_6.FULLTEXT_SETUP_FIELD];
             }
             else {
-                data[types_5.FULLTEXT_SETUP_FIELD] = sanitized;
+                data[types_6.FULLTEXT_SETUP_FIELD] = sanitized;
             }
         });
     }
@@ -1152,8 +1160,8 @@ class BaseMindooDB {
      */
     async getExtractionSetup() {
         try {
-            const doc = await this.getDocument(types_4.DB_SETUP_DOC_ID);
-            return ((0, types_6.sanitizeExtractionConfig)(doc.getData()[types_6.EXTRACTION_SETUP_FIELD]) ?? null);
+            const doc = await this.getDocument(types_5.DB_SETUP_DOC_ID);
+            return ((0, types_7.sanitizeExtractionConfig)(doc.getData()[types_7.EXTRACTION_SETUP_FIELD]) ?? null);
         }
         catch (error) {
             if (error instanceof errors_1.DocumentNotFoundError ||
@@ -1173,19 +1181,19 @@ class BaseMindooDB {
      * without producing changefeed/sync churn.
      */
     async setExtractionSetup(config) {
-        const sanitized = config === null ? null : ((0, types_6.sanitizeExtractionConfig)(config) ?? {});
+        const sanitized = config === null ? null : ((0, types_7.sanitizeExtractionConfig)(config) ?? {});
         const current = await this.getExtractionSetup();
         if (JSON.stringify(current) === JSON.stringify(sanitized)) {
             return;
         }
-        const doc = await this.createDocument({ id: types_4.DB_SETUP_DOC_ID });
+        const doc = await this.createDocument({ id: types_5.DB_SETUP_DOC_ID });
         await this.changeDoc(doc, (d) => {
             const data = d.getData();
             if (sanitized === null) {
-                delete data[types_6.EXTRACTION_SETUP_FIELD];
+                delete data[types_7.EXTRACTION_SETUP_FIELD];
             }
             else {
-                data[types_6.EXTRACTION_SETUP_FIELD] = sanitized;
+                data[types_7.EXTRACTION_SETUP_FIELD] = sanitized;
             }
         });
     }
@@ -1253,12 +1261,12 @@ class BaseMindooDB {
             this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
-        const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
+        const hasSetupChange = changes.some((change) => change.docId === types_5.DB_SETUP_DOC_ID);
         if (!hasSetupChange && this.fulltextSetupProbed) {
             return;
         }
         this.fulltextSetupProbed = true;
-        void this.activateFulltextFromSetupDoc();
+        this.backgroundTasks.run(this.activateFulltextFromSetupDoc());
     }
     /** Create the full-text index when the setup document enables one. */
     async activateFulltextFromSetupDoc() {
@@ -1288,7 +1296,7 @@ class BaseMindooDB {
             return;
         }
         this.fulltextAutoUpdateRunning = true;
-        void (async () => {
+        this.backgroundTasks.run((async () => {
             try {
                 do {
                     this.fulltextAutoUpdatePending = false;
@@ -1302,7 +1310,7 @@ class BaseMindooDB {
             finally {
                 this.fulltextAutoUpdateRunning = false;
             }
-        })();
+        })());
     }
     // ---------------------------------------------------------------------------
     // Change notifications (reactive support)
@@ -1323,6 +1331,29 @@ class BaseMindooDB {
             this.changeListeners.delete(listener);
         };
     }
+    /**
+     * Resolve once this database has no background work left: no coalesced
+     * change event waiting for its timer and no auto-follow catch-up or setup
+     * probe in flight (including work those start). Returns whether there was
+     * anything to wait for.
+     *
+     * @internal Shutdown and test hook; not part of the {@link MindooDB}
+     *   interface.
+     */
+    async whenBackgroundIdle() {
+        let waited = false;
+        for (;;) {
+            if (this.changeNotifyTimer !== null) {
+                waited = true;
+                await new Promise((resolve) => setTimeout(resolve, 0));
+                continue;
+            }
+            if (!(await this.backgroundTasks.settle())) {
+                return waited;
+            }
+            waited = true;
+        }
+    }
     /** Record a document transition for the coalesced change event. */
     noteChangeForListeners(docId, lastModified, isDeleted) {
         if (this.changeListeners.size === 0) {
@@ -2537,7 +2568,7 @@ class BaseMindooDB {
             return;
         }
         this.summarySetupProbed = true;
-        void (async () => {
+        this.backgroundTasks.run((async () => {
             try {
                 const config = await this.getSummarySetup();
                 if (config === null || this.summaryStore) {
@@ -2552,7 +2583,7 @@ class BaseMindooDB {
             catch (error) {
                 this.logger.warn(`Time-travel summary activation failed: ${error}`);
             }
-        })();
+        })());
     }
     /**
      * Open-time probe for full-text auto-activation. Without it, a
@@ -2578,7 +2609,7 @@ class BaseMindooDB {
             return;
         }
         this.fulltextSetupProbed = true;
-        void this.activateFulltextFromSetupDoc();
+        this.backgroundTasks.run(this.activateFulltextFromSetupDoc());
     }
     /**
      * Compute the current tenant KeyBag fingerprint, or `null` when the
@@ -2749,6 +2780,46 @@ class BaseMindooDB {
             }
         }
     }
+    /**
+     * Physically purge a document's history from this database (see
+     * {@link MindooDB.purgeDocumentHistory}).
+     */
+    async purgeDocumentHistory(docId) {
+        this.assertWritable("purgeDocumentHistory");
+        const outcome = await (0, purgeDocumentHistory_1.purgeDocumentHistoryFromStores)({ docsStore: this.store, attachmentStore: this.attachmentStore }, docId);
+        await this.forgetPurgedDocument(docId);
+        // Open time-travel snapshots and persisted snapshot caches hold their own
+        // plaintext copies of the document. Skipped on a repeated purge (callers
+        // re-apply all purge requests on every directory sync), which would
+        // otherwise wipe every snapshot cache each time.
+        if (outcome.docEntriesPurged > 0 || outcome.attachmentChunksPurged > 0) {
+            await this.tenant.forgetPurgedDocumentInSnapshots(this.store.getId(), docId);
+        }
+        return outcome;
+    }
+    /**
+     * Drop everything this instance derived from a document whose store entries
+     * were purged: the L1/L2 caches, summary values and full-text tokens (via
+     * {@link purgeMaterializedDocument}), and the live index entry, which turns
+     * into a deleted tombstone so changefeed consumers and views remove the
+     * document. Safe to call on time-travel snapshots and when nothing is known
+     * about the document.
+     *
+     * @internal Called by {@link purgeDocumentHistory} and the tenant.
+     */
+    async forgetPurgedDocument(docId) {
+        await this.purgeMaterializedDocument(docId);
+        const position = this.getDocIndexPosition(docId);
+        // Already a tombstone (soft-deleted earlier, or purged before): views have
+        // removed it, and bumping it again on every repeated purge would only
+        // churn the changefeed.
+        if (position !== undefined && !this.index[position].isDeleted) {
+            const existing = this.index[position];
+            this.updateIndex(docId, Math.max(existing.lastModified, (0, timeSource_1.semanticNow)()), true, existing.decryptionKeyId, existing.accessState, false, false, true);
+        }
+        this.cacheMetaDirty = true;
+        this.cacheManager?.markDirty();
+    }
     /**
      * Reconcile the in-memory index with the current tenant KeyBag.
      *
@@ -7436,8 +7507,7 @@ class BaseMindooDB {
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => {
                 if (patch.baseHeads && patch.baseHeads.length > 0) {
-                    const result = automerge_adapter_1.Automerge.changeAt(doc, patch.baseHeads, applySpans);
-                    return result.newDoc;
+                    return this.changeOnForkAt(doc, patch.baseHeads, applySpans);
                 }
                 return automerge_adapter_1.Automerge.change(doc, applySpans);
             });
@@ -7463,6 +7533,120 @@ class BaseMindooDB {
             data: wrapped.getData(),
         };
     }
+    async applyDocumentUpdate(doc, update) {
+        this.assertWritable("applyDocumentUpdate");
+        const docId = doc.getId();
+        let internalDoc = this.getCachedDocument(docId);
+        if (!internalDoc) {
+            const loadedDoc = await this.loadDocumentInternal(docId);
+            if (!loadedDoc) {
+                throw new errors_1.DocumentNotFoundError(docId);
+            }
+            internalDoc = loadedDoc;
+        }
+        if (internalDoc.isDeleted) {
+            throw new errors_1.DocumentDeletedError(docId);
+        }
+        const baseHeads = (0, types_2.commonUpdateBaseHeads)(update);
+        if (baseHeads === null) {
+            throw new Error("applyDocumentUpdate: the parts of one update must share their baseHeads");
+        }
+        const hasFields = Object.keys(update.set ?? {}).length > 0 || (update.unset?.length ?? 0) > 0;
+        if (update.json)
+            this.validateJsonPatch(update.json);
+        for (const patch of update.text ?? [])
+            this.validateTextPatch(patch);
+        for (const patch of update.richText ?? [])
+            this.validateRichTextPatch(patch);
+        for (const patch of update.richTextSteps ?? [])
+            this.validateRichTextStepPatch(patch);
+        // top-level fields go through changeDoc elsewhere, which checks sealed access
+        if (hasFields)
+            await this.assertCurrentSealedAccess(internalDoc);
+        const now = (0, timeSource_1.semanticNow)();
+        const headsBeforeChange = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
+        const applyAll = (automergeDoc) => {
+            for (const [key, value] of Object.entries(update.set ?? {})) {
+                if (value !== undefined) {
+                    automergeDoc[key] = this.hydrateTypedValues(value);
+                }
+            }
+            for (const key of update.unset ?? []) {
+                delete automergeDoc[key];
+            }
+            if (update.json)
+                this.applyJsonPatchOperations(automergeDoc, update.json);
+            for (const patch of update.text ?? [])
+                this.applyTextEditsInChange(automergeDoc, patch);
+            for (const patch of update.richText ?? [])
+                this.applyRichTextSpansInChange(automergeDoc, patch, docId);
+            for (const patch of update.richTextSteps ?? [])
+                this.applyRichTextStepsInChange(automergeDoc, patch);
+            automergeDoc._lastModified = now;
+        };
+        let newDoc;
+        try {
+            newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (current) => baseHeads
+                ? this.changeOnForkAt(current, baseHeads, applyAll)
+                : automerge_adapter_1.Automerge.change(current, applyAll));
+        }
+        catch (error) {
+            this.logger.error(`Error applying document update for document ${docId}:`, error);
+            throw error;
+        }
+        await this.persistDocumentChange({
+            internalDoc,
+            newDoc,
+            now,
+            headsBeforeChange,
+            useCustomKey: false,
+            successMessage: "document updated",
+        });
+        const wrapped = this.wrapDocument(internalDoc);
+        return {
+            doc: wrapped,
+            heads: wrapped.getHeads(),
+            data: wrapped.getData(),
+        };
+    }
+    /** The edits of one text patch, inside a change. */
+    applyTextEditsInChange(automergeDoc, patch) {
+        this.ensureTextPath(automergeDoc, patch.path);
+        for (const edit of patch.edits) {
+            automerge_adapter_1.Automerge.splice(automergeDoc, patch.path, edit.index, edit.deleteCount, edit.insert ?? "");
+        }
+    }
+    /** One rich-text snapshot (or sequence), inside a change, with the reset-and-retry recovery. */
+    applyRichTextSpansInChange(automergeDoc, patch, docId) {
+        this.ensureRichTextPath(automergeDoc, patch.path);
+        const spansSequence = patch.spansSequence ?? (patch.spans ? [patch.spans] : []);
+        for (const spans of spansSequence) {
+            const revivedSpans = this.reviveRichTextSpans(spans);
+            try {
+                automerge_adapter_1.Automerge.updateSpans(automergeDoc, patch.path, revivedSpans, patch.updateSpansConfig);
+            }
+            catch (error) {
+                if (!this.isRichTextUpdateSpansBoundsError(error)) {
+                    throw error;
+                }
+                this.logger.warn(`updateSpans failed for document ${docId} at '${patch.path.map(String).join(".")}', resetting rich-text field and applying snapshot from scratch`, error);
+                this.setJsonValueAtPath(automergeDoc, patch.path, "");
+                automerge_adapter_1.Automerge.updateSpans(automergeDoc, patch.path, revivedSpans, patch.updateSpansConfig);
+            }
+        }
+    }
+    /** Positional rich-text steps (splices and marks), inside a change. */
+    applyRichTextStepsInChange(automergeDoc, patch) {
+        this.ensureRichTextPath(automergeDoc, patch.path);
+        for (const step of patch.steps) {
+            automerge_adapter_1.Automerge.splice(automergeDoc, patch.path, step.index, step.deleteCount, step.insert ?? "");
+            for (const markRange of step.marks ?? []) {
+                for (const [name, value] of Object.entries(markRange.marks)) {
+                    automerge_adapter_1.Automerge.mark(automergeDoc, patch.path, { start: markRange.index, end: markRange.index + markRange.length, expand: "none" }, name, this.reviveRichTextValue(value));
+                }
+            }
+        }
+    }
     async applyRichTextStepsPatch(doc, patch) {
         this.assertWritable("applyRichTextStepsPatch");
         const docId = doc.getId();
@@ -8809,6 +8993,34 @@ class BaseMindooDB {
      * {@link applyNewEntriesToCachedDocument} (line ~6606) for the sync
      * pipeline; this helper centralizes it for the patch / changeDoc paths.
      */
+    /**
+     * `Automerge.changeAt(doc, baseHeads, apply)` for changes that call
+     * `updateSpans`. Automerge 3.5's `updateSpans` inside `changeAt` diffs
+     * against the text as of `baseHeads` but applies the resulting indexes to the
+     * current text, so once a concurrent edit of that text is in the document it
+     * throws "out of bounds" (and the reset-and-retry recovery would then drop
+     * the concurrent edit) or edits the wrong characters. `splice`, `updateText`
+     * and `mark` are not affected.
+     *
+     * The change is made on a fork that stands exactly at `baseHeads` and then
+     * merged back: the same causal result `changeAt` would produce. The fork
+     * writes as this replica's actor, unless that actor changed the document
+     * after `baseHeads` (its next sequence number is taken then); in that case a
+     * fresh actor writes the one change.
+     */
+    changeOnForkAt(doc, baseHeads, apply) {
+        const current = automerge_adapter_1.Automerge.getHeads(doc);
+        if (current.length === baseHeads.length &&
+            current.every((head) => baseHeads.includes(head))) {
+            return automerge_adapter_1.Automerge.change(doc, apply);
+        }
+        const base = automerge_adapter_1.Automerge.view(doc, baseHeads);
+        const actor = automerge_adapter_1.Automerge.getActorId(doc);
+        const ownChangeSince = automerge_adapter_1.Automerge.getChanges(base, doc).some((change) => automerge_adapter_1.Automerge.decodeChange(change).actor === actor);
+        const fork = automerge_adapter_1.Automerge.clone(base, ownChangeSince ? undefined : { actor });
+        const changed = automerge_adapter_1.Automerge.change(fork, apply);
+        return automerge_adapter_1.Automerge.merge(doc, changed);
+    }
     runChangeWithOutdatedDocRecovery(internalDoc, apply) {
         try {
             return apply(internalDoc.doc);
@@ -9179,7 +9391,7 @@ class BaseMindooDB {
             return await this.withRateLimitBackoff("entry prefetch", () => this.store.getEntries(ids));
         }
         catch (error) {
-            if (networkErrorType(error) !== types_3.NetworkErrorType.PAYLOAD_TOO_LARGE ||
+            if (networkErrorType(error) !== types_4.NetworkErrorType.PAYLOAD_TOO_LARGE ||
                 ids.length <= 1) {
                 throw error;
             }
@@ -10508,24 +10720,19 @@ class BaseMindooDB {
      * Whether access control is active for this tenant and should gate
      * materialization. Admin-only databases (incl. the directory itself) are
      * always exempt — admin is the root of trust, and exempting the directory DB
-     * also avoids re-entrancy. Cached briefly to keep the load fast-path cheap.
-     * Fails closed-to-disabled on any directory error so document loads never
-     * break due to a transient directory issue (Tier 2 only gates honest clients).
+     * also avoids re-entrancy. Not cached by wall-clock time: a policy change must
+     * take effect on the very next write or load, independent of machine speed.
      */
     async isAclEnforced() {
         if (this._isAdminOnlyDb)
             return false;
-        const now = Date.now();
-        if (this.aclActiveCache && now - this.aclActiveCache.at < 3000) {
-            return this.aclActiveCache.value;
-        }
         try {
             const directory = await this.tenant.openDirectory();
             let value = false;
             if (typeof directory.isAccessControlActive === "function") {
                 value = await directory.isAccessControlActive();
             }
-            this.aclActiveCache = { value, at: now };
+            this.aclActiveLastKnown = value;
             return value;
         }
         catch (error) {
@@ -10534,9 +10741,9 @@ class BaseMindooDB {
             // materialization gate entirely). Reuse the last known verdict if we have
             // one; otherwise assume enforced so the materialization path governs the
             // load and retries once the directory is reachable again.
-            if (this.aclActiveCache) {
-                this.logger.debug(`[ACL] active-check failed, reusing last known verdict (${this.aclActiveCache.value}): ${error}`);
-                return this.aclActiveCache.value;
+            if (this.aclActiveLastKnown !== null) {
+                this.logger.debug(`[ACL] active-check failed, reusing last known verdict (${this.aclActiveLastKnown}): ${error}`);
+                return this.aclActiveLastKnown;
             }
             this.logger.warn(`[ACL] active-check failed with no prior verdict, assuming enforced (fail closed): ${error}`);
             return true;
@@ -12489,15 +12696,15 @@ class BaseMindooDB {
      * Resolve a sync target to a ContentAddressedStore.
      * Accepts either a raw store or a MindooDB instance (calls getStore()).
      */
-    getStoreForKind(storeKind = types_2.StoreKind.docs) {
-        return storeKind === types_2.StoreKind.attachments
+    getStoreForKind(storeKind = types_3.StoreKind.docs) {
+        return storeKind === types_3.StoreKind.attachments
             ? this.attachmentStore
             : this.store;
     }
-    resolveStore(remote, storeKind = types_2.StoreKind.docs) {
+    resolveStore(remote, storeKind = types_3.StoreKind.docs) {
         if ("getStore" in remote &&
             typeof remote.getStore === "function") {
-            return storeKind === types_2.StoreKind.attachments
+            return storeKind === types_3.StoreKind.attachments
                 ? remote.getAttachmentStore()
                 : remote.getStore();
         }
@@ -12745,9 +12952,16 @@ class BaseMindooDB {
      */
     async pullChangesFrom(remote, options) {
         this.assertWritable("pullChangesFrom");
-        const storeKind = options?.storeKind ?? types_2.StoreKind.docs;
-        const localStore = this.getStoreForKind(storeKind);
+        const storeKind = options?.storeKind ?? types_3.StoreKind.docs;
         const remoteStore = this.resolveStore(remote, storeKind);
+        // Entries of documents purged by an admin-signed request are refused on the
+        // way in, so a replica that has not executed the purge yet cannot hand the
+        // erased history back (docs/accesscontrol.md §13). Never applied to the
+        // directory, which carries the purge requests themselves.
+        const dbId = this.store.getId();
+        const localStore = dbId === "directory"
+            ? this.getStoreForKind(storeKind)
+            : (0, purgedDocumentGuard_1.guardStoreAgainstPurgedDocuments)(this.getStoreForKind(storeKind), () => this.tenant.getPurgedDocumentIds(dbId), this.logger);
         if (localStore.getId() !== remoteStore.getId() ||
             localStore.getStoreKind() !== remoteStore.getStoreKind()) {
             throw new Error(`[BaseMindooDB] Cannot pull entries from the incompatible store ${localStore.getId()}/${localStore.getStoreKind()}`);
@@ -12760,7 +12974,7 @@ class BaseMindooDB {
             // summary buffer / full-text index materialize and extract documents
             // while the next page is still on the wire, instead of all at once
             // after the transfer (see docs/adhoc-queries.md, "Cold start").
-            const syncResult = await this.syncEntriesFromStore(remoteStore, localStore, options, storeKind === types_2.StoreKind.docs
+            const syncResult = await this.syncEntriesFromStore(remoteStore, localStore, options, storeKind === types_3.StoreKind.docs
                 ? () => this.syncStoreChanges()
                 : undefined);
             const transferredBytes = syncResult.transferredBytes ?? 0;
@@ -12776,7 +12990,7 @@ class BaseMindooDB {
             }
             if (syncResult.transferred === 0) {
                 this.logger.debug(`No new entries to pull`);
-                if (storeKind === types_2.StoreKind.docs) {
+                if (storeKind === types_3.StoreKind.docs) {
                     await this.reconcileAfterDocsPull();
                 }
                 return {
@@ -12804,7 +13018,7 @@ class BaseMindooDB {
                     cancelled: true,
                 };
             }
-            if (storeKind === types_2.StoreKind.docs) {
+            if (storeKind === types_3.StoreKind.docs) {
                 await this.syncStoreChanges();
                 await this.reconcileAfterDocsPull();
             }
@@ -12873,7 +13087,7 @@ class BaseMindooDB {
      */
     async pushChangesTo(remote, options) {
         this.assertWritable("pushChangesTo");
-        const storeKind = options?.storeKind ?? types_2.StoreKind.docs;
+        const storeKind = options?.storeKind ?? types_3.StoreKind.docs;
         const localStore = this.getStoreForKind(storeKind);
         const remoteStore = this.resolveStore(remote, storeKind);
         if (localStore.getId() !== remoteStore.getId() ||