At this level
app.tempomusic.actor · 8- app.tempomusic.actor.defs defs The viewer's analytics consent preferences. Private appview data — never written to the public PDS repo. Business fields only: the last-write-wins clock travels as a sibling `updatedAtMicros` field on the get/put envelopes, never inside this document.
- app.tempomusic.actor.deleteAccount procedure Schedule the requesting viewer's account for deletion. Soft-deletes the profile and cascades soft-delete on every post, reply and like owned by the viewer in a single transaction. The viewer can log back in within 30 days and call restoreAccount to undo. After 30 days the account is hard-deleted irreversibly and the content is anonymised. See ADR-009 for the full retention lifecycle.
- app.tempomusic.actor.getAnalyticsConsent query Fetch the requesting viewer's analytics consent preferences. The viewer DID is read from the service-auth JWT (`iss` claim). `preferences` and `updatedAtMicros` are absent together when the viewer has never stored preferences — the client then hydrates its early-access defaults.
- app.tempomusic.actor.getDeletionState query Return the requesting viewer's account-deletion state so the client's bootstrap gate can decide between showing the app, the dated restoration screen, or the terminal 'window passed' variant (TEM-492). The viewer DID is read from the service-auth JWT (`iss` claim) — no explicit parameter, matching the appview's `getAnalyticsConsent` convention. When the profile row has been hard-deleted at day 30 the endpoint returns `deleted: false` (indistinguishable from an account that was never deleted — in
- app.tempomusic.actor.profile record Customizable profile attributes for a Tempo actor. Stored as a singleton per repository under the literal record key 'self'.
- app.tempomusic.actor.putAnalyticsConsent procedure Store the requesting viewer's analytics consent preferences with last-write-wins semantics on the sibling updatedAtMicros clock (client wall-clock microseconds): the server keeps the document with the highest value and always returns the winning document with its clock, which the client must adopt as its new local state. The viewer DID is read from the service-auth JWT (`iss` claim).
- app.tempomusic.actor.restoreAccount procedure Restore the requesting viewer's previously soft-deleted account. Clears deleted_at on the profile and unconditionally on every post, reply and like owned by the viewer (including content the viewer soft-deleted individually before the account cascade). Moderation-held content stays in moderation hold. Only valid within the 30-day restoration window opened by deleteAccount; outside the window the profile has been hard-deleted and the cascade content is anonymised, so restoration is impossible. Se
- app.tempomusic.actor.searchActorsTypeahead query Accounts whose display name or handle starts with `q`, case-insensitively, for the mention picker. At most `limit` results, ordered: exact handle match first, then display-name prefix matches, then handle prefix matches, each group by display name then DID. Filtered for the viewer: accounts in a block relation with the viewer in either direction, sanctioned accounts (suspended or banned), soft-deleted or moderation-held profiles and the viewer's own account are never returned. The viewer DID is