mindoodb 0.0.85 → 0.0.88

package/dist/core/BaseMindooDB.js

@@ -5,6 +5,7 @@ exports.BaseMindooDB = exports.CUSTOM_DOC_ID_INITIAL_CHANGE_BYTES = void 0;
 // React Native: native Rust (react-native-automerge-generated)
 // Browser/Node.js: WASM (@automerge/automerge/slim)
 const automerge_adapter_1 = require("./automerge-adapter");
+const ChangeDocDraft_1 = require("./ChangeDocDraft");
 const values_1 = require("./values");
 const storeEntryTime_1 = require("./storeEntryTime");
 const changeAttribution_1 = require("./changeAttribution");
@@ -364,6 +365,25 @@ class BaseMindooDB {
          */
         this.revisionFeedDocCache = new Map();
         this.revisionFeedCacheLimit = 256;
+        /**
+         * Revisions of documents whose fold suffix holds un-witnessed entries, keyed
+         * by the exact fold (entry order, witness state and prefix). The feed
+         * re-discovers such entries on every resume, since their trusted time is the
+         * provisional `now`; while nothing about the document changed, only that
+         * trusted time differs, so the revisions are re-emitted from here instead
+         * of being loaded, verified, decrypted and folded again. Without it, every
+         * pass re-folded every un-witnessed document: registering N users offline
+         * cost O(N) per registration. An entry is replaced on any change and
+         * dropped once the document has no un-witnessed entries left.
+         *
+         * Each revision holds its own document state, so the cache is bounded: a
+         * document with a longer suffix, or one arriving when the cache is full, is
+         * folded every pass as before.
+         */
+        this.provisionalRevisionCache = new Map();
+        this.provisionalRevisionCacheSize = 0;
+        this.provisionalRevisionCacheLimit = 4096;
+        this.provisionalRevisionCacheDocLimit = 32;
         /**
          * Window size for batching encrypted-payload loads while folding a document's
          * revision suffix ({@link foldDocRevisions}): one {@link ContentAddressedStore.getEntries}
@@ -462,6 +482,16 @@ class BaseMindooDB {
         this.syncStoreChangesInFlight = null;
         /** Shared follow-up run for callers that arrive mid-sync. */
         this.syncStoreChangesQueued = null;
+        /**
+         * > 0 while this database hands a sealed document's wrap list to the tenant
+         * ({@link ingestSealed}). Unwrapping may resolve the own User-Key, which
+         * reads `directory` (grants, username hashes) and so calls
+         * {@link syncStoreChanges} on it. When this database *is* `directory` (a
+         * sealed admin document there, e.g. a mail gateway configuration sealed to
+         * the gateway), that call would wait for the very run that is waiting for
+         * it. Such nested calls return at once and read the index as it is.
+         */
+        this.sealedIngestDepth = 0;
         this.changeListeners = new Set();
         this.pendingChangeNotifications = new Map();
         this.changeNotifyTimer = null;
@@ -764,16 +794,97 @@ class BaseMindooDB {
      * — a peer sync — and therefore have to apply the admin/owner rules
      * themselves.
      *
-     * Deliberately the same check the load path uses, so an entry admitted here
-     * is one that will also materialize. The alternative, accepting on ingest
-     * and dropping on load, leaves the entry sitting in the store and pushes it
-     * on to the server at the next sync, where it is refused and fails the run.
+     * This is the server's write rule ({@link evaluateBuiltinWrite}), not the
+     * lenient load-path filter. The load path may fail open because whatever it
+     * reads already passed a server; an entry arriving from a peer has passed
+     * nothing, so an owner hash that cannot be resolved is a refusal here, as it
+     * is on the server. Everything this admits also passes the load path, so an
+     * admitted entry still materializes.
+     *
+     * `batch` is the rest of the delivery: a new document arrives as its
+     * `doc_create` plus later changes in one batch, and the create is what names
+     * the owner. Pass entries with their payload (`encryptedData`) where you have
+     * it; a `doc_create` of a userkey document is decrypted to read
+     * `username_hash`.
      *
      * Returns false for databases without a builtin invariant, so callers can
      * ask unconditionally.
      */
-    async violatesBuiltinWriteInvariant(entry) {
-        return this.shouldSkipLoadedEntryForBuiltin(entry);
+    async violatesBuiltinWriteInvariant(entry, batch = []) {
+        return (await this.builtinIngestDenial(entry, batch)) !== null;
+    }
+    /** Reason the builtin invariant refuses `entry` from a peer, or null. */
+    async builtinIngestDenial(entry, batch) {
+        const dbId = this.effectiveBuiltinDbId();
+        if (!(0, builtinDbInvariants_1.hasBuiltinWriteInvariant)(dbId)) {
+            return null;
+        }
+        const entryType = entry.entryType ?? "doc_change";
+        const op = (0, builtinDbInvariants_1.entryTypeToBuiltinOp)(entryType);
+        if (!op) {
+            // Not a document lifecycle entry (attachment chunks and the like). The
+            // admin-only rule still holds for `directory`; `userdirectory` has no
+            // rule for them, exactly as on the server.
+            if (dbId === types_1.DIRECTORY_DB_ID && !this.isAdminKey(entry.createdByPublicKey)) {
+                return "Admin-only database: only the admin key can modify data";
+            }
+            return null;
+        }
+        let documentUsernameHash = null;
+        let signerUsernameHash = null;
+        let creatorUsernameHash = null;
+        if (dbId === types_1.USER_DIRECTORY_DB_ID) {
+            // Fresh, not the load-path cache: that one remembers a miss for a key
+            // that has since been granted.
+            signerUsernameHash = await this.resolveSignerUsernameHash(entry.createdByPublicKey);
+            const createInBatch = entryType === "doc_create"
+                ? entry
+                : batch.find((candidate) => candidate.entryType === "doc_create" && candidate.docId === entry.docId);
+            if ((0, builtinDbInvariants_1.isPersonalUserdirectoryDocId)(entry.docId)) {
+                if (op === "doc_create") {
+                    creatorUsernameHash = signerUsernameHash;
+                }
+                else if (createInBatch) {
+                    creatorUsernameHash = await this.resolveSignerUsernameHash(createInBatch.createdByPublicKey);
+                }
+                else if (entry.docId) {
+                    creatorUsernameHash = await this.ensurePersonalDocCreatorHash(entry.docId);
+                }
+            }
+            else if (createInBatch?.encryptedData) {
+                documentUsernameHash = await this.usernameHashFromCreateEntry(createInBatch);
+            }
+            else if (entry.docId && op !== "doc_create") {
+                documentUsernameHash = await this.ensureUserdirectoryDocHash(entry.docId);
+            }
+        }
+        const decision = (0, builtinDbInvariants_1.evaluateBuiltinWrite)({
+            dbId,
+            op,
+            signerKey: entry.createdByPublicKey,
+            adminPublicKey: this.getAdminPublicKey(),
+            documentUsernameHash,
+            signerUsernameHash,
+            docId: entry.docId,
+            creatorUsernameHash,
+        });
+        return decision.allowed ? null : decision.reason;
+    }
+    isAdminKey(publicKey) {
+        return (0, DirectoryStateNode_1.signingKeysEqual)(publicKey, this.getAdminPublicKey());
+    }
+    /** `username_hash` out of a userkey document's `doc_create` payload. */
+    async usernameHashFromCreateEntry(entry) {
+        if (!entry.encryptedData || !entry.decryptionKeyId) {
+            return null;
+        }
+        try {
+            const decrypted = await this.tenant.decryptPayload(entry.encryptedData, entry.decryptionKeyId);
+            return (0, builtinDbInvariants_1.usernameHashFromCreateChangeBytes)(decrypted);
+        }
+        catch {
+            return null;
+        }
     }
     async ensureSignerUsernameHash(signerKey) {
         if (this.signerUsernameHashByKey.has(signerKey)) {
@@ -2808,6 +2919,93 @@ class BaseMindooDB {
         }
         return outcome;
     }
+    /**
+     * Request the hard delete of deleted documents in a personal database
+     * (`mmail_…`, `mmailout_…`; docs/accesscontrol.md §6.11, "Purge"). Writes a
+     * purge request document (`purgereq_…`, `$publicinfos`) that names the
+     * documents; push it like any change. The server accepts it only from the
+     * owner's devices, a service with a matching `accessPrefixes` grant or the
+     * tenant admin, and only for documents that are deleted; it then removes
+     * their history and refuses it from then on. Every replica (also this one)
+     * removes the documents when it next pulls the request
+     * ({@link applyPurgeRequests}).
+     *
+     * @returns The id of the purge request document.
+     */
+    async requestPurgeOfDeletedDocuments(docIds) {
+        this.assertWritable("requestPurgeOfDeletedDocuments");
+        const dbId = this.store.getId();
+        if (!(0, builtinDbInvariants_1.personalDatabaseOwner)(dbId)) {
+            throw new Error(`Purge requests are only for personal databases, not ${dbId}`);
+        }
+        const ids = Array.from(new Set(docIds.filter((id) => typeof id === "string" && id.length > 0)));
+        if (ids.length === 0)
+            throw new Error("No document ids to purge");
+        const deleted = new Set(await this.getDeletedDocumentIds());
+        for (const id of ids) {
+            if ((0, builtinDbInvariants_1.isPurgeRequestDocId)(id))
+                throw new Error(`A purge request cannot be purged: ${id}`);
+            if (!deleted.has(id))
+                throw new Error(`Document ${id} is not deleted; delete it before purging`);
+        }
+        const request = await this.createDocument({
+            idPrefix: builtinDbInvariants_1.PURGE_REQUEST_ID_PREFIX.slice(0, -1),
+            decryptionKeyId: types_1.PUBLIC_INFOS_KEY_ID,
+            initialValues: { form: builtinDbInvariants_1.PURGE_REQUEST_FORM, docIds: ids, requestedAt: Date.now() },
+        });
+        return request.getId();
+    }
+    /**
+     * The document ids the purge requests of this personal database name
+     * (§6.11). Empty for any other database. With `onlyAccepted`, only requests
+     * the server has accepted (their `doc_create` carries a witness receipt):
+     * a request that is still local, or that the server refused, purges
+     * nothing, so a refused request never loses data that stays on the server.
+     */
+    async getPurgeRequestedDocIds(options) {
+        const result = new Set();
+        if (!(0, builtinDbInvariants_1.personalDatabaseOwner)(this.store.getId()))
+            return result;
+        for (const requestId of await this.getAllDocumentIds({ idPrefix: builtinDbInvariants_1.PURGE_REQUEST_ID_PREFIX.slice(0, -1) })) {
+            if (options?.onlyAccepted) {
+                const metas = await this.store.findNewEntriesForDoc([], requestId);
+                const create = metas.find((m) => m.entryType === "doc_create");
+                if (!create?.receivedAt)
+                    continue;
+            }
+            try {
+                const data = (await this.getDocument(requestId)).getData();
+                if (data.form !== builtinDbInvariants_1.PURGE_REQUEST_FORM || !Array.isArray(data.docIds))
+                    continue;
+                for (const id of data.docIds) {
+                    const docId = String(id);
+                    if (docId && !(0, builtinDbInvariants_1.isPurgeRequestDocId)(docId))
+                        result.add(docId);
+                }
+            }
+            catch {
+                // Not readable here (no $publicinfos yet): picked up on a later run.
+            }
+        }
+        return result;
+    }
+    /**
+     * Execute the purge requests of this personal database locally (§6.11):
+     * remove every named document that still has entries here. Idempotent; runs
+     * after every docs pull of a personal database.
+     *
+     * @returns How many documents were removed in this run.
+     */
+    async applyPurgeRequests() {
+        this.assertWritable("applyPurgeRequests");
+        let removed = 0;
+        for (const docId of await this.getPurgeRequestedDocIds({ onlyAccepted: true })) {
+            const outcome = await this.purgeDocumentHistory(docId);
+            if (outcome.docEntriesPurged > 0 || outcome.attachmentChunksPurged > 0)
+                removed++;
+        }
+        return removed;
+    }
     /**
      * Drop everything this instance derived from a document whose store entries
      * were purged: the L1/L2 caches, summary values and full-text tokens (via
@@ -2887,7 +3085,7 @@ class BaseMindooDB {
             }
             const existingIndex = this.getDocIndexPosition(docId);
             const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
-            await this.tenant.ingestSealedFromEntries?.(visibility.decryptionKeyId, metadataByDoc.get(docId));
+            await this.ingestSealed(visibility.decryptionKeyId, metadataByDoc.get(docId));
             const canRead = await this.tenant.hasDecryptionKey(visibility.decryptionKeyId);
             if (canRead) {
                 // This scan is the authority on visibility, so it also heals a tally
@@ -3167,6 +3365,10 @@ class BaseMindooDB {
      * {@link syncStoreChangesInFlight}).
      */
     async syncStoreChanges() {
+        if (this.sealedIngestDepth > 0) {
+            // Called back from our own sealed ingest (see sealedIngestDepth).
+            return;
+        }
         if (this.syncStoreChangesInFlight) {
             if (!this.syncStoreChangesQueued) {
                 // The running scan may have started before the entries this caller
@@ -3308,7 +3510,7 @@ class BaseMindooDB {
                             });
                             sealedIngestEntries = fullDocMetadata;
                         }
-                        await this.tenant.ingestSealedFromEntries?.(representativeEntry.decryptionKeyId, sealedIngestEntries);
+                        await this.ingestSealed(representativeEntry.decryptionKeyId, sealedIngestEntries);
                         const keyAvailable = await this.tenant.hasDecryptionKey(representativeEntry.decryptionKeyId);
                         if (!keyAvailable) {
                             this.logger.debug(`Skipping metadata-first index for doc ${docId} — decryption key "${representativeEntry.decryptionKeyId}" not available`);
@@ -4057,6 +4259,9 @@ class BaseMindooDB {
             }
             this.validateIdPrefixOption("createDocuments", options);
             this.validateAssumeUniqueIdOption("createDocuments", options);
+            if ((options.attachments?.length ?? 0) > 0) {
+                throw new Error("createDocuments: attachments are only supported by createDocument()");
+            }
             (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         }
         const results = new Array(inputs.length).fill(null);
@@ -4235,6 +4440,10 @@ class BaseMindooDB {
                 throw new Error("createDocument: recipients is not supported together with a convergent custom id; " +
                     "pass assumeUniqueId for random ids.");
             }
+            if (useDeterministicSeed && (options.attachments?.length ?? 0) > 0) {
+                throw new Error("createDocument: attachments are not supported together with a convergent custom id; " +
+                    "pass assumeUniqueId, or add them with changeDoc().");
+            }
         }
         const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
         const createUsernameHash = this.usernameHashFromRecord(Object.fromEntries(initialValueEntries));
@@ -4293,11 +4502,17 @@ class BaseMindooDB {
         else {
             this.logger.debug(`Creating initial Automerge change for document ${docId}`);
             const initialDoc = automerge_adapter_1.Automerge.init();
+            // Attachments of the first entry: chunks are written now, under the
+            // document's key, and referenced from the doc_create change below.
+            const createAttachments = [];
+            for (const attachment of options.attachments ?? []) {
+                createAttachments.push(await this.addAttachmentInternal(docId, attachment.data, attachment.fileName, attachment.mimeType, keyId, now));
+            }
             try {
                 newDoc = automerge_adapter_1.Automerge.change(initialDoc, changeMessage ? { message: changeMessage } : {}, (doc) => {
                     // Store metadata in the document payload
                     // We need to modify the document to ensure a change is created
-                    doc._attachments = [];
+                    doc._attachments = createAttachments.map((ref) => ({ ...ref }));
                     if (sealedCreate) {
                         (0, recipients_1.applyEncryptForCreate)(doc, sealedCreate.encryptFor);
                     }
@@ -4804,6 +5019,22 @@ class BaseMindooDB {
         });
         return this.wrapDocument(internalDoc);
     }
+    /**
+     * Hands a sealed document's newest wrap list to the tenant, with nested
+     * {@link syncStoreChanges} calls on this database short-circuited meanwhile
+     * (see {@link sealedIngestDepth}).
+     */
+    async ingestSealed(keyId, entries) {
+        if (!this.tenant.ingestSealedFromEntries)
+            return;
+        this.sealedIngestDepth++;
+        try {
+            await this.tenant.ingestSealedFromEntries(keyId, entries);
+        }
+        finally {
+            this.sealedIngestDepth--;
+        }
+    }
     /**
      * Unwrap a `$sealed:` DEK from entry recipient wraps into the tenant session
      * cache. `loadDocumentInternal` already does this; history, timestamp, and
@@ -4816,7 +5047,7 @@ class BaseMindooDB {
             return;
         const keyId = entries.find((entry) => entry.entryType === "doc_create")
             ?.decryptionKeyId ?? entries[0].decryptionKeyId;
-        await this.tenant.ingestSealedFromEntries?.(keyId, entries);
+        await this.ingestSealed(keyId, entries);
     }
     /**
      * Re-ingest the newest sealed wrap list. When this replica can no longer
@@ -5176,10 +5407,48 @@ class BaseMindooDB {
         if (firstChangedIdx < 0) {
             return;
         }
+        // Unchanged document whose suffix is still provisional: re-emit the
+        // previous fold with the current trusted times (see provisionalRevisionCache).
+        const suffix = ttSorted.slice(firstChangedIdx);
+        const hasProvisional = suffix.some((r) => !r.witnessed);
+        const foldKey = [
+            ttSorted.slice(0, firstChangedIdx).map((r) => r.meta.id).join(","),
+            suffix.map((r) => `${r.meta.id}:${r.meta.receivedAt ?? "-"}`).join(","),
+        ].join("|");
+        const cachedFold = this.provisionalRevisionCache.get(docId);
+        if (cachedFold && cachedFold.key === foldKey) {
+            for (let i = 0; i < cachedFold.revisions.length; i++) {
+                yield { ...cachedFold.revisions[i], trustedTime: suffix[i].tt, cursor: resumeCursor };
+            }
+            return;
+        }
+        if (cachedFold) {
+            this.provisionalRevisionCache.delete(docId);
+            this.provisionalRevisionCacheSize -= cachedFold.revisions.length;
+        }
+        const foldedRevisions = [];
+        let foldComplete = true;
         // Origin time and key id come from the document's create entry, independent
         // of fold order (under the trusted-time rule un-witnessed entries can sort
         // before the create, so we must not rely on seeing the create first).
         const createMeta = replayMeta.find((m) => m.entryType === "doc_create");
+        // A document this replica holds no key for (e.g. an admin document in
+        // `directory` encrypted with `default` or sealed to someone else, read by a
+        // `$publicinfos`-only member or the sync server) is not part of its feed,
+        // just as it is not part of its index; decrypting it would throw and stop
+        // the whole feed (and with it the directory state and access checks).
+        const feedKeyId = createMeta?.decryptionKeyId ?? replayMeta[0]?.decryptionKeyId;
+        if (feedKeyId && !(await this.tenant.hasDecryptionKey(feedKeyId))) {
+            // Sealed: the wrap list may not be ingested yet. Not for admin-only
+            // databases: ingesting there can read `directory`, whose state this
+            // feed may be building (the directory sync already ingested them).
+            if ((0, sealedTypes_1.isSealedKeyId)(feedKeyId) && !this._isAdminOnlyDb) {
+                await this.ingestSealed(feedKeyId, replayMeta);
+            }
+            if (!(await this.tenant.hasDecryptionKey(feedKeyId))) {
+                return;
+            }
+        }
         // Seed the running doc to the merge of the unchanged prefix.
         const prefix = ttSorted.slice(0, firstChangedIdx).map((r) => r.meta);
         const seed = await this.seedRevisionFold(docId, prefix, docAllMeta);
@@ -5225,6 +5494,7 @@ class BaseMindooDB {
                 // Absent from the loaded window means missing in the store or it failed
                 // signature verification (already logged during the parallel prepare).
                 this.logger.warn(`Revision entry ${meta.id} unavailable (missing or invalid), skipping`);
+                foldComplete = false;
                 continue;
             }
             const entryData = ready.entry;
@@ -5249,16 +5519,24 @@ class BaseMindooDB {
                 // this document's replay entries seen up to and including this one.
                 isDeleted: this.computeIsDeletedFromMetadata([...seenMeta]),
             };
-            yield {
+            const revision = {
                 docId,
                 entryId: meta.id,
                 doc: this.wrapDocument(internalDoc),
                 entryType: meta.entryType,
-                trustedTime: rev.tt,
                 witnessed: rev.witnessed,
                 createdByPublicKey: meta.createdByPublicKey,
-                cursor: resumeCursor,
             };
+            foldedRevisions.push(revision);
+            yield { ...revision, trustedTime: rev.tt, cursor: resumeCursor };
+        }
+        // Reached only when the consumer took every revision of this document.
+        if (hasProvisional &&
+            foldComplete &&
+            foldedRevisions.length <= this.provisionalRevisionCacheDocLimit &&
+            this.provisionalRevisionCacheSize + foldedRevisions.length <= this.provisionalRevisionCacheLimit) {
+            this.provisionalRevisionCache.set(docId, { key: foldKey, revisions: foldedRevisions });
+            this.provisionalRevisionCacheSize += foldedRevisions.length;
         }
         // Cache the doc's full merged state for the next incremental advance.
         this.putRevisionFeedCache(docId, {
@@ -8137,8 +8415,6 @@ class BaseMindooDB {
         //
         // We use a two-phase approach: the callback can do async work and collect
         // what needs to be changed, then we apply those changes in Automerge.change()
-        const pendingChanges = new Map();
-        const pendingDeletions = new Set();
         // Track pending attachment operations
         const pendingAttachmentAdditions = [];
         const pendingAttachmentRemovals = new Set();
@@ -8146,19 +8422,6 @@ class BaseMindooDB {
         const pendingAttachmentAppends = new Map();
         // Map of attachmentId -> extraction result for setAttachmentExtractedText
         const pendingAttachmentTextUpdates = new Map();
-        // incrementCounter() calls, applied in call order after the field
-        // assignments so they can target counters assigned in the same callback.
-        const pendingCounterIncrements = [];
-        // Assignments and deletions are applied before the increments, so an
-        // assignment or deletion of a field supersedes the increments queued on it
-        // (or below it) earlier in the callback; later increments still apply.
-        const dropPendingCounterIncrements = (field) => {
-            for (let i = pendingCounterIncrements.length - 1; i >= 0; i--) {
-                if (pendingCounterIncrements[i].path[0] === field) {
-                    pendingCounterIncrements.splice(i, 1);
-                }
-            }
-        };
         // Reference to db for closures
         const db = this;
         // Guard flag to prevent operations after callback completes
@@ -8169,6 +8432,15 @@ class BaseMindooDB {
                 throw new Error(`${methodName}() cannot be called after changeDoc() callback has completed. Document changes can only be made within the callback.`);
             }
         };
+        // getData() edits a lazily built shadow copy and logs every edit, at any
+        // depth, for replay inside Automerge.change() below.
+        const draft = new ChangeDocDraft_1.ChangeDocDraft(internalDoc.doc, {
+            scalarKind: (value) => db.automergeScalarKind(value),
+            readScalar: (value) => db.readAutomergeScalar(value),
+            makeCounter: (value) => new automerge_adapter_1.Automerge.Counter(value),
+            isRichTextInBase: (path) => db.isRichTextAt(internalDoc.doc, path),
+            assertActive: throwIfCallbackInactive,
+        });
         // Create a document wrapper that collects changes
         const collectingDoc = {
             getDatabase: () => this,
@@ -8186,62 +8458,7 @@ class BaseMindooDB {
             isEncryptedFor: (users) => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId) &&
                 (0, recipients_1.isPayloadEncryptedFor)(internalDoc.doc, internalDoc.sealedRecipients, Array.isArray(users) ? users : [users]),
             getHeads: () => automerge_adapter_1.Automerge.getHeads(internalDoc.doc),
-            getData: () => {
-                // Return a proxy that collects property assignments and deletions
-                const currentData = internalDoc.doc;
-                return new Proxy(currentData, {
-                    set: (target, prop, value) => {
-                        throwIfCallbackInactive("set property");
-                        if (typeof prop === "string") {
-                            dropPendingCounterIncrements(prop);
-                            // If this property was marked for deletion, remove it from deletions
-                            pendingDeletions.delete(prop);
-                            // Track the change
-                            pendingChanges.set(prop, value);
-                            // NOTE: Don't set on target immediately - Automerge requires changes
-                            // to be made inside Automerge.change(). Pending changes are applied later.
-                        }
-                        return true;
-                    },
-                    deleteProperty: (target, prop) => {
-                        throwIfCallbackInactive("delete property");
-                        if (typeof prop === "string") {
-                            dropPendingCounterIncrements(prop);
-                            // Mark for deletion
-                            pendingDeletions.add(prop);
-                            // Remove from pending changes if it was there
-                            pendingChanges.delete(prop);
-                            // NOTE: Don't delete from target immediately - Automerge requires changes
-                            // to be made inside Automerge.change(). Pending deletions are applied later.
-                        }
-                        return true;
-                    },
-                    get: (target, prop) => {
-                        // If marked for deletion, return undefined
-                        if (typeof prop === "string" && pendingDeletions.has(prop)) {
-                            return undefined;
-                        }
-                        // Check pending changes first, then target
-                        if (typeof prop === "string" && pendingChanges.has(prop)) {
-                            return pendingChanges.get(prop);
-                        }
-                        // Counters read as numbers and immutable strings as strings here
-                        // too; change counters with incrementCounter().
-                        return db.readAutomergeScalar(target[prop]);
-                    },
-                    has: (target, prop) => {
-                        // If marked for deletion, it doesn't exist
-                        if (typeof prop === "string" && pendingDeletions.has(prop)) {
-                            return false;
-                        }
-                        // Check pending changes first, then target
-                        if (typeof prop === "string" && pendingChanges.has(prop)) {
-                            return true;
-                        }
-                        return prop in target;
-                    },
-                });
-            },
+            getData: () => draft.getRoot(),
             // ========== Attachment Write Methods (work in changeDoc context) ==========
             addAttachment: async (fileData, fileName, mimeType, keyId) => {
                 throwIfCallbackInactive("addAttachment");
@@ -8356,12 +8573,25 @@ class BaseMindooDB {
                 }
             },
             // ========== Counter Write Methods ==========
+            updateText: (path, value) => {
+                const segments = typeof path === "string" ? [path] : [...path];
+                db.validateJsonPath(segments, "updateText");
+                if (draft.getFieldType(segments) === "richText") {
+                    throw new Error(`updateText: '${segments.map(String).join(".")}' is rich text (marks or blocks); use applyRichTextPatch() or applyRichTextStepsPatch()`);
+                }
+                draft.updateText(segments, value);
+            },
+            getFieldType: (path) => {
+                const segments = typeof path === "string" ? [path] : [...path];
+                db.validateJsonPath(segments, "getFieldType");
+                return draft.getFieldType(segments);
+            },
             incrementCounter: (path, delta) => {
                 throwIfCallbackInactive("incrementCounter");
                 const segments = typeof path === "string" ? [path] : [...path];
                 db.validateJsonPath(segments, "incrementCounter");
                 (0, values_1.assertCounterAmount)(delta, "incrementCounter delta");
-                pendingCounterIncrements.push({ path: segments, delta });
+                draft.incrementCounter(segments, delta);
             },
             // ========== Attachment Read Methods (also work in changeDoc context) ==========
             getAttachments: () => {
@@ -8396,20 +8626,14 @@ class BaseMindooDB {
         let newDoc;
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, (automergeDoc) => {
-                // Apply all pending changes (sets/updates)
-                for (const [key, value] of pendingChanges) {
-                    this.assignHydrated(automergeDoc, key, this.hydrateTypedValues(value));
-                }
-                // Apply all pending deletions
-                for (const key of pendingDeletions) {
-                    delete automergeDoc[key];
-                }
+                // Replay the callback's field edits and counter increments in the
+                // order they were made: an assignment after an increment replaces
+                // it, an increment after an assignment adds to the new counter, and
+                // a list index means the element it meant at that moment.
+                this.applyChangeDocDraftOps(automergeDoc, draft.ops);
                 // Engine-internal edits that need the raw Automerge document, e.g.
                 // restoreDocumentToEntry's rich-text spans.
                 internalMutation?.(automergeDoc);
-                for (const { path, delta } of pendingCounterIncrements) {
-                    this.incrementCounterAtPath(automergeDoc, path, delta);
-                }
                 // Apply pending attachment changes
                 if (pendingAttachmentAdditions.length > 0 ||
                     pendingAttachmentRemovals.size > 0 ||
@@ -8514,6 +8738,96 @@ class BaseMindooDB {
         }
         await Promise.all(pendingAttachmentAdditions.map((ref) => this.clearPendingAttachmentUploadLedger(ref.attachmentId)));
     }
+    /** "counter" / "atomic" for the CRDT scalars that read as plain values, otherwise null. */
+    automergeScalarKind(value) {
+        if (this.isAutomergeCounter(value))
+            return "counter";
+        if (this.isAutomergeImmutableString(value))
+            return "atomic";
+        return null;
+    }
+    /** Whether the text at `path` carries marks or block markers (rich text). */
+    isRichTextAt(automergeDoc, path) {
+        if (typeof this.readValueAtPath(automergeDoc, path) !== "string")
+            return false;
+        const spans = automerge_adapter_1.Automerge.spans(automergeDoc, path);
+        return spans.some((span) => span.type === "block" || (span.marks !== undefined && Object.keys(span.marks).length > 0));
+    }
+    fieldTypeAt(automergeDoc, path) {
+        if (path.length === 0)
+            return "map";
+        let parent = automergeDoc;
+        for (const segment of path.slice(0, -1)) {
+            parent = parent?.[segment];
+            if (parent === null || typeof parent !== "object" || this.automergeScalarKind(parent) !== null)
+                return undefined;
+        }
+        const key = path[path.length - 1];
+        if (!Object.prototype.hasOwnProperty.call(parent, key))
+            return undefined;
+        const value = parent[key];
+        if (typeof value === "string")
+            return this.isRichTextAt(automergeDoc, path) ? "richText" : "text";
+        return (0, ChangeDocDraft_1.fieldTypeOf)(value, { scalarKind: (v) => this.automergeScalarKind(v) });
+    }
+    async getFieldType(doc, path) {
+        const segments = typeof path === "string" ? [path] : [...path];
+        this.validateJsonPath(segments, "getFieldType");
+        const docId = doc.getId();
+        let internalDoc = this.wrappedInternalDocs.get(doc) ?? this.getCachedDocument(docId);
+        if (!internalDoc) {
+            const loadedDoc = await this.loadDocumentInternal(docId);
+            if (!loadedDoc) {
+                throw new errors_1.DocumentNotFoundError(docId);
+            }
+            internalDoc = loadedDoc;
+        }
+        return this.fieldTypeAt(internalDoc.doc, segments);
+    }
+    /** Replays the edits a changeDoc() callback made through getData(), see ChangeDocDraft. */
+    applyChangeDocDraftOps(automergeDoc, ops) {
+        const containerAt = (path) => {
+            let current = automergeDoc;
+            for (const segment of path)
+                current = current[segment];
+            return current;
+        };
+        for (const op of ops) {
+            if (op.kind === "counter") {
+                this.incrementCounterAtPath(automergeDoc, op.path, op.delta);
+                continue;
+            }
+            if (op.kind === "splice") {
+                const list = containerAt(op.path);
+                const values = this.hydrateTypedValues(op.items);
+                list.splice(op.index, op.deleteCount, ...this.withoutNestedFloats(values));
+                values.forEach((value, offset) => {
+                    if (value instanceof automerge_adapter_1.Automerge.Float64)
+                        list[op.index + offset] = new automerge_adapter_1.Automerge.Float64(value.value);
+                    else
+                        this.restoreNestedFloats(list[op.index + offset], value);
+                });
+                continue;
+            }
+            const parent = containerAt(op.path.slice(0, -1));
+            const key = op.path[op.path.length - 1];
+            if (op.kind === "delete") {
+                delete parent[key];
+                continue;
+            }
+            const current = parent[key];
+            if (op.kind === "text" && typeof current === "string") {
+                // Splice only the changed middle, so the edit merges with concurrent
+                // typing instead of replacing the whole text.
+                const splice = (0, ChangeDocDraft_1.diffTextSplice)(current, op.value);
+                if (splice) {
+                    automerge_adapter_1.Automerge.splice(automergeDoc, op.path, splice.index, splice.deleteCount, splice.insert);
+                }
+                continue;
+            }
+            this.assignHydrated(parent, key, this.hydrateTypedValues(op.value));
+        }
+    }
     validateTextPatch(patch) {
         if (!Array.isArray(patch.path) || patch.path.length === 0) {
             throw new Error("Text patch path must contain at least one segment");
@@ -11882,7 +12196,7 @@ class BaseMindooDB {
             .map((em) => `${em.entryType}@${em.createdAt}`)
             .join(", ");
         this.logger.debug(`Entry types for ${docId}: ${entryTypes}`);
-        await this.tenant.ingestSealedFromEntries?.(allEntryMetadata.find((em) => em.entryType === "doc_create")
+        await this.ingestSealed(allEntryMetadata.find((em) => em.entryType === "doc_create")
             ?.decryptionKeyId ?? allEntryMetadata[0].decryptionKeyId, allEntryMetadata);
         const loadKeyId = allEntryMetadata.find((em) => em.entryType === "doc_create")
             ?.decryptionKeyId ?? allEntryMetadata[0].decryptionKeyId;
@@ -12367,6 +12681,14 @@ class BaseMindooDB {
             setAttachmentExtractedText: () => {
                 throw new Error("setAttachmentExtractedText() can only be called within changeDoc() callback");
             },
+            getFieldType: (path) => {
+                const segments = typeof path === "string" ? [path] : [...path];
+                this.validateJsonPath(segments, "getFieldType");
+                return this.fieldTypeAt(internalDoc.doc, segments);
+            },
+            updateText: () => {
+                throw new Error("updateText() can only be called within changeDoc() callback; use applyJsonPatch() with textSplice outside of it");
+            },
             incrementCounter: () => {
                 throw new Error("incrementCounter() can only be called within changeDoc() callback; use applyJsonPatch() with counterIncrement outside of it");
             },
@@ -13181,9 +13503,19 @@ class BaseMindooDB {
         // erased history back (docs/accesscontrol.md §13). Never applied to the
         // directory, which carries the purge requests themselves.
         const dbId = this.store.getId();
+        // Personal databases carry their own purge requests (§6.11) on top.
+        const isPersonal = (0, builtinDbInvariants_1.personalDatabaseOwner)(dbId) !== null;
         const localStore = dbId === "directory"
             ? this.getStoreForKind(storeKind)
-            : (0, purgedDocumentGuard_1.guardStoreAgainstPurgedDocuments)(this.getStoreForKind(storeKind), () => this.tenant.getPurgedDocumentIds(dbId), this.logger);
+            : (0, purgedDocumentGuard_1.guardStoreAgainstPurgedDocuments)(this.getStoreForKind(storeKind), async () => {
+                const fromDirectory = await this.tenant.getPurgedDocumentIds(dbId);
+                if (!isPersonal)
+                    return fromDirectory;
+                const own = await this.getPurgeRequestedDocIds();
+                for (const id of fromDirectory)
+                    own.add(id);
+                return own;
+            }, this.logger);
         if (localStore.getId() !== remoteStore.getId() ||
             localStore.getStoreKind() !== remoteStore.getStoreKind()) {
             throw new Error(`[BaseMindooDB] Cannot pull entries from the incompatible store ${localStore.getId()}/${localStore.getStoreKind()}`);
@@ -13291,6 +13623,17 @@ class BaseMindooDB {
             await this.tenant.reconcileUserKeysSafe?.();
             await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
         }
+        // Personal databases: execute the purge requests the server accepted (§6.11).
+        if ((0, builtinDbInvariants_1.personalDatabaseOwner)(this.store.getId())) {
+            try {
+                const removed = await this.applyPurgeRequests();
+                if (removed > 0)
+                    this.logger.info(`Purged ${removed} document(s) by purge request`);
+            }
+            catch (error) {
+                this.logger.warn(`Applying purge requests failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
     }
     /**
      * Push changes to a remote content-addressed store or another MindooDB instance.