Legacy Plaintext Asset Purge

This is a destructive, owner-run procedure for the E2EE asset-storage cutover. It deletes objects from the old plaintext assets/{workspaceId}/ R2 keyspace. The current client stores encrypted attachments under the separate assets-e2ee/{workspaceId}/ keyspace, which this procedure must never target.

Users must re-upload attachments

Legacy plaintext objects are unreadable after the E2EE cutover. Purging them is permanent, and no automatic content migration exists. Tell affected users that they must re-upload every attachment they still need.

When to run it

The legacy and E2EE prefixes do not overlap, so the purge is safe either before or after D1 migration 0022. It does not read user_assets rows and needs no pre-migration D1 snapshot. Run it only after the E2EE client deployment is stable, the mandatory re-upload communication is ready, and the owner has reviewed a fresh dry-run inventory.

Dry-run inventory

Use an R2 API token with Workers R2 Storage Read permission:

CLOUDFLARE_ACCOUNT_ID=... CLOUDFLARE_API_TOKEN=... \
  node workers/sync-server/scripts/purge-legacy-assets.mjs

The default mode lists every candidate key and reports the total object count and bytes. It does not delete anything. To inspect only one workspace:

CLOUDFLARE_ACCOUNT_ID=... CLOUDFLARE_API_TOKEN=... \
  node workers/sync-server/scripts/purge-legacy-assets.mjs \
  --workspace '<workspace-id>'

Verify that the reported prefix is exactly assets/ or assets/<workspace-id>/. Stop immediately if the output or command mentions assets-e2ee/; never adapt the script to accept that prefix.

Owner-confirmed deletion

After saving and reviewing the dry-run output, use a token that also has Workers R2 Storage Write permission and repeat the identical command with --confirm:

CLOUDFLARE_ACCOUNT_ID=... CLOUDFLARE_API_TOKEN=... \
  node workers/sync-server/scripts/purge-legacy-assets.mjs --confirm

For a staged rollout, keep the same --workspace '<workspace-id>' filter on both the reviewed dry run and confirmed command. Save the final count and byte total in the operations record, revoke the temporary write-capable token, and remind users to re-upload their attachments.

The script enforces the legacy prefix before listing and again before every delete. --confirm is the only mode that sends delete requests.