T-X-D-D Support

[Nick (ingalls)]

Context

• 🚀 Allow deleting features remotely via t-x-d-d messages

[codecov]

Codecov Report

❌ Patch coverage is 0% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
api/web/src/workers/atlas-connection.ts	0.00%	11 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR adds client-side handling for remote CoT delete tasking (t-x-d-d) in the web Atlas connection worker, enabling incoming task messages to remove (or immediately stale-out) referenced features in the local store.

Changes:

• Implement t-x-d-d task handling in AtlasConnection to remove or stale linked CoT items, while blocking deletion of Mission-origin items.
• Bump API dependencies (notably @tak-ps/node-cot, sharp, c8) and update api/package-lock.json accordingly.
• Regenerate/update api/derived-types.d.ts (openapi-typescript output), resulting in significant endpoint typing churn.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
api/web/src/workers/atlas-connection.ts	Adds t-x-d-d processing logic to remove or stale linked CoT features, with Mission-origin guard.
api/package.json	Updates API dependency versions (including @tak-ps/node-cot, sharp, c8) and package version.
api/package-lock.json	Lockfile refresh reflecting dependency upgrades and transitive changes.
api/derived-types.d.ts	Regenerated OpenAPI TypeScript definitions with substantial typing reordering/additions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

api/web/src/workers/atlas-connection.ts:249

• The t-x-d-d handler applies server-driven state changes using the normal client mutation paths, which can trigger outbound API writes. Specifically, cot.update(...) may call save() (PUT) for archived features, and atlas.db.remove(...) may issue a DELETE for archived features. For server-originated delete/stale tasking, these should be applied locally without re-saving/re-deleting over the network to avoid circular sync and permission/404 noise.

                    const forcedelete = task.properties.forcedelete === true;

                    for (const link of task.properties.links || []) {
                        if (!link.uid) continue;

                        const cot = await this.atlas.db.get(link.uid);

                        if (!cot) continue;

                        // Don't allow remote access to a Data Sync Mission (Priv. Escalation)
                        if (cot.origin.mode === OriginMode.MISSION) {
                            console.warn(`Ignoring t-x-d-d for ${link.uid} as it originates from a Mission`);
                            continue;
                        }

                        if (forcedelete) {
                            await this.atlas.db.remove(link.uid);
                        } else {
                            await cot.update({
                                properties: {
                                    ...cot.properties,
                                    stale: new Date().toISOString()
                                }
                            });
                        }