@3sln/trove 0.0.11 → 0.0.13

package/packages/core/src/plugins/contributions.js

@@ -17,6 +17,19 @@
 // plugin, so its status item, its register and its command can't shadow each other,
 // and `trove+contrib:acme.com/docs/status` names exactly one thing in the world.
 //
+//
+// TWO SENSES OF "CONTRIBUTION", and this is one of them. Here it is an EXTENSION POINT a
+// package declares in its manifest and the host addresses by URI —
+// `trove+contrib:acme.com/docs/player`. The other sense lives in core/src/indexers/
+// contribution.js: per-node ENRICHMENT produced at runtime and addressed by contributorId,
+// which is what an `indexer` declared here goes on to emit. So a plugin declares a
+// contribution (this sense) which produces contributions (that one).
+//
+// The rule for telling them apart: this sense is DECLARED, static, and named by URI; that
+// sense is PRODUCED, per node, and named by contributor. Renaming the second was weighed
+// and declined — it is a wire rename on `node.contributions` and `/api/index/:indexerId`,
+// needing a dual-read window for a stored field, which is a lot of churn for a distinction
+// two sentences can carry.
 // Each contribution's `entry` (openers, indexers) points into the plugin's ONE module
 // tree — they are not nested sub-packages, so everything in a plugin shares modules
 // and code. What gets opened or indexed depends only on which entry module runs.

package/packages/core/src/rateLimit.js

@@ -0,0 +1,253 @@
+// What one caller may cost.
+//
+// There was no limit anywhere: a key, a signed-in person, or on an open drive a stranger,
+// could issue requests as fast as they could open sockets and every one was served. That is
+// survivable while the only user is whoever deployed it, and stops being survivable the
+// moment a key is handed to somebody else's script or the drive is put somewhere reachable.
+//
+// REQUESTS ARE NOT EQUAL, so neither are the limits. A limit that treats a range request
+// and a semantic search as the same thing is either useless against the expensive one or
+// absurd against the cheap one. Work is named by CLASS, and a class is a statement about
+// what one call can cost someone:
+//
+//   search    a paid third-party call per query where TROVE_EMBEDDINGS_URL is set. The one
+//             where an attacker spends the operator's money rather than their CPU.
+//   upload    bytes through the drive — and both directions for an encrypted collection,
+//             since the drive seals. `maxUploadBytes` caps one file and nothing capped the
+//             rate, so a thousand small uploads cost what the limit was meant to prevent.
+//   download  bytes out. Generous, because a media player range-requests one file many
+//             times and that is one file's worth of bandwidth, not many.
+//   job       scan, reindex, rotate. Each schedules real work over a whole collection.
+//   install   unzip, verify, store.
+//   evaluate  the deliberately unauthenticated access endpoint: a JWKS fetch or cache read
+//             and an RSA verify, reachable with no credential at all.
+//   write     ordinary mutations. A backstop, not a real cost model.
+//
+// Reads are not limited. They are cheap, the shell issues many, and a limit low enough to
+// matter would break normal use — which is the definition of theatre.
+//
+// WHERE THE COUNTERS LIVE is the hard part, and the honest answer differs by runtime. A
+// per-process counter is exact on a long-lived Bun or Node instance and a lie on Workers,
+// where each isolate has its own memory and "60 a minute" becomes 60 per isolate per
+// minute. So there are two stores, the choice is configuration, and `describeRateLimits`
+// exists so a deployment that cannot enforce them SAYS SO rather than appearing to.
+
+import { TroveError } from './errors.js';
+
+/**
+ * `count/window` for each class of work.
+ *
+ * Generous enough that someone using the drive normally never sees a 429, tight enough
+ * that a loop does. Windows are all a minute because a limit you have to reason about in
+ * two units is one nobody reasons about.
+ */
+export const DEFAULT_RATE_LIMITS = {
+  search: { limit: 60, windowMs: 60_000 },
+  upload: { limit: 240, windowMs: 60_000 },
+  download: { limit: 1200, windowMs: 60_000 },
+  job: { limit: 10, windowMs: 60_000 },
+  install: { limit: 10, windowMs: 60_000 },
+  evaluate: { limit: 60, windowMs: 60_000 },
+  write: { limit: 600, windowMs: 60_000 },
+};
+
+export const RATE_CLASSES = Object.keys(DEFAULT_RATE_LIMITS);
+
+/**
+ * Counters in this process's memory.
+ *
+ * EXACT on a runtime where one process serves every request, which is what a self-hosted
+ * Bun or Node drive is. Wrong on Workers — see the module header, and `describeRateLimits`,
+ * which is how a deployment finds out rather than assuming.
+ *
+ * Buckets expire, and expired ones are swept when the map grows rather than on a timer:
+ * there is no timer to hang it on inside a request, and a sweep proportional to how much
+ * traffic there was is the right shape anyway.
+ */
+export class MemoryRateStore {
+  constructor({ maxEntries = 10_000 } = {}) {
+    this.buckets = new Map(); // key -> { count, expiresAt }
+    this.maxEntries = maxEntries;
+  }
+
+  async bump(key, windowMs, now) {
+    // A cheap backstop between sweeps, for a burst that outruns the maintenance tick.
+    if (this.buckets.size > this.maxEntries) await this.sweep(now);
+    const held = this.buckets.get(key);
+    if (held && held.expiresAt > now) {
+      held.count += 1;
+      return held.count;
+    }
+    this.buckets.set(key, { count: 1, expiresAt: now + windowMs });
+    return 1;
+  }
+
+  /**
+   * Drop buckets whose window has passed. The same method the KV store has, and the same
+   * caller — periodic maintenance.
+   *
+   * It exists on BOTH stores so the caller does not have to ask which one it got. A
+   * `store.sweep?.()` there would be the optional-call shape this codebase records as
+   * having turned a sweep into a permanent no-op once already; and without a periodic
+   * sweep a long-lived process holds an expired bucket for every subject it has ever seen
+   * until the size backstop fires, which on a quiet drive is never.
+   *
+   * @returns {Promise<number>} how many went
+   */
+  async sweep(now = Date.now()) {
+    let dropped = 0;
+    for (const [k, b] of this.buckets) if (b.expiresAt <= now) { this.buckets.delete(k); dropped++; }
+    return dropped;
+  }
+}
+
+/**
+ * Counters in the shared KeyValueStore, so every instance sees one budget.
+ *
+ * The cost is a read and a write per LIMITED request — which is why only the expensive
+ * classes are limited at all. And it is read-modify-write rather than an atomic increment,
+ * because the store has no atomic increment: requests that overlap exactly can each read
+ * the same count and each write count+1, so a burst can slip a few through. That is a
+ * limiter that is occasionally generous, which is a different thing from no limiter, and
+ * it is stated here rather than discovered.
+ *
+ * Expired buckets are removed by `sweep`, called from periodic maintenance. Without it the
+ * namespace grows one key per subject per class per window, forever.
+ */
+export class KvRateStore {
+  static NS = 'ratelimit';
+
+  constructor({ kv }) {
+    if (!kv) throw TroveError.invalid('KvRateStore needs a KeyValueStore');
+    this.kv = kv;
+  }
+
+  async bump(key, windowMs, now) {
+    const held = await this.kv.get(KvRateStore.NS, key).catch(() => null);
+    const next = held && held.expiresAt > now
+      ? { count: held.count + 1, expiresAt: held.expiresAt }
+      : { count: 1, expiresAt: now + windowMs };
+    await this.kv.set(KvRateStore.NS, key, next).catch(() => {});
+    return next.count;
+  }
+
+  /** Drop buckets whose window has passed. @returns {Promise<number>} how many went */
+  async sweep(now = Date.now()) {
+    const rows = await this.kv.list(KvRateStore.NS).catch(() => []);
+    let dropped = 0;
+    for (const { key, value } of rows) {
+      if (!value || value.expiresAt <= now) {
+        await this.kv.delete(KvRateStore.NS, key).catch(() => {});
+        dropped++;
+      }
+    }
+    return dropped;
+  }
+}
+
+/**
+ * Decide whether this subject may do another unit of this class of work.
+ *
+ * FIXED WINDOWS, not a sliding log. A sliding window is fairer at the boundary and costs a
+ * list per request to be so; a fixed window's worst case is twice the limit across two
+ * adjacent windows, which for limits chosen to bound cost rather than to be precise is a
+ * trade worth taking. It also gives an exact `Retry-After`: the window's own end.
+ */
+export class RateLimiter {
+  /**
+   * @param {object} deps
+   * @param {{bump: (key: string, windowMs: number, now: number) => Promise<number>}} deps.store
+   * @param {Record<string, {limit: number, windowMs: number}>} [deps.limits]
+   * @param {() => number} [deps.now] injected clock, for tests
+   */
+  constructor({ store, limits = DEFAULT_RATE_LIMITS, now = () => Date.now() } = {}) {
+    if (!store) throw TroveError.invalid('RateLimiter needs a store');
+    this.store = store;
+    this.limits = limits;
+    this.now = now;
+  }
+
+  /**
+   * @returns {Promise<{ok: boolean, limit?: number, remaining?: number, retryAfterMs?: number}>}
+   *   `{ok: true}` for a class with no limit configured — an unnamed class is not an
+   *   error, it is work nobody decided to meter.
+   */
+  async check(subject, className) {
+    const rule = this.limits[className];
+    if (!rule || !rule.limit) return { ok: true };
+    const now = this.now();
+    // The bucket is part of the key, so a new window is a new counter and there is nothing
+    // to reset — which is also what makes this safe across processes that never talk.
+    const bucket = Math.floor(now / rule.windowMs);
+    const endsAt = (bucket + 1) * rule.windowMs;
+    const count = await this.store.bump(`${className}:${subject}:${bucket}`, rule.windowMs, now);
+    if (count > rule.limit) {
+      return { ok: false, limit: rule.limit, remaining: 0, retryAfterMs: Math.max(0, endsAt - now) };
+    }
+    return { ok: true, limit: rule.limit, remaining: rule.limit - count };
+  }
+
+  /**
+   * The same, as a refusal.
+   *
+   * QUOTA and retryable, which errors.js already maps to 429 — "A rate limit is 429: back
+   * off and try again", as distinct from being out of disk, which is 507 because retrying
+   * changes nothing. `retryAfterMs` rides in `details` so the HTTP layer can turn it into
+   * a `Retry-After` header instead of every client guessing.
+   */
+  async enforce(subject, className) {
+    const verdict = await this.check(subject, className);
+    if (verdict.ok) return verdict;
+    throw TroveError.rateLimited(
+      `Too many ${className} requests — wait ${Math.ceil(verdict.retryAfterMs / 1000)}s and try again`,
+      { details: { limit: verdict.limit, retryAfterMs: verdict.retryAfterMs, kind: className } },
+    );
+  }
+}
+
+/**
+ * Who is being limited.
+ *
+ * The two credentials are already resolved in one place, and a grant is resolved FIRST and
+ * an identity only if there is no grant — so this does not re-derive anything, it names
+ * what was decided.
+ *
+ * The third case is the one that needs a decision rather than a default. With no
+ * credential there is nothing stable to key on but the address, and an address behind a
+ * proxy is whatever the proxy says — trusting a header a client can set is worse than not
+ * limiting at all, because it hands every caller their own budget for the asking. So the
+ * forwarded address is used only where the operator has said the proxy is trustworthy
+ * (TROVE_TRUST_PROXY), and otherwise every anonymous caller shares ONE budget.
+ *
+ * Sharing one budget is a real limit — it bounds what the drive spends, which is the point
+ * — and it has a real cost: on a drive open to the internet, one stranger can exhaust the
+ * anonymous allowance for the rest. That is the trade, stated. An operator who does not
+ * want it configures a proxy and says so, or requires authentication.
+ */
+export function rateSubject({ grant, principal, req, trustProxy = false } = {}) {
+  if (grant?.keyId) return `key:${grant.keyId}`;
+  if (principal?.id) return `user:${principal.id}`;
+  if (trustProxy && req) {
+    const forwarded = (req.headers.get('x-forwarded-for') || '').split(',')[0].trim();
+    if (forwarded) return `ip:${forwarded}`;
+  }
+  return 'anon';
+}
+
+/**
+ * What this deployment will actually enforce, in its own words.
+ *
+ * Exists because the ticket's requirement was that a runtime which cannot enforce a limit
+ * says so rather than pretending. `scope: 'isolate'` is that admission: in-memory counters
+ * on a runtime with no long-lived process count per isolate, so the effective limit is the
+ * configured one times however many isolates the platform decided to run.
+ */
+export function describeRateLimits({ enabled, store, limits, perProcess }) {
+  if (!enabled) return { enabled: false, scope: 'none', limits: {} };
+  return {
+    enabled: true,
+    store,
+    scope: store === 'kv' ? 'drive' : (perProcess ? 'process' : 'isolate'),
+    limits,
+  };
+}

package/packages/core/src/scan.js

@@ -96,6 +96,9 @@ export class CollectionScanner {
     // outside: the scan adopts it AGAIN, resurrecting the deleted file under a new id
     // that shares the original's storage key. Emptying the trash then deletes the live
     // copy's bytes, leaving an item that lists, opens, and 404s forever.
+    // The one optional call left on a store method, and the interface says why: soft
+    // delete is documented as optional — a store that makes deletes permanent has no trash
+    // to enumerate. Every other declared method is called unguarded.
     const trashedKeys = await this.vfs.metadata.trashedStorageKeys?.(collectionId) ?? new Set();
 
     const result = {
@@ -215,28 +218,52 @@ export class CollectionScanner {
    * excluded: one of those with no metadata row is a leftover from a failed write, not
    * a file someone put there, and adopting it would surface `obj_9fc0…` as a document.
    */
+  /**
+   * What a record should say about an object, read from the OBJECT.
+   *
+   * Is this an encrypted object somebody copied in? The envelope says so, and says which
+   * key it wants, WITHOUT the key — which is the entire reason the header is readable.
+   * Without this the object is recorded as plaintext, and every read of it hands back raw
+   * ciphertext with no error: the drive shows a file, and opening it gives you an
+   * unreadable blob. Sideloading is a named use case here, so it has to be the case that
+   * works.
+   *
+   * ONE rule, and both callers ask it. They disagreed before: adoption read the envelope
+   * while refresh took `object.size`, so an encrypted item replaced in place — which is
+   * precisely the scenario this scanner exists for — recorded the size of the ENVELOPE
+   * (plaintext + 44 header + 16 tag per chunk) as the size of the file. Wrong from then on
+   * in listings, quotas and collectionStats, and it feeds rotation, where `node.size`
+   * bounds the read loop and is written into the new header.
+   *
+   * `size` is left undefined when the object reports none, so each caller can apply the
+   * fallback that makes sense for it. Costs one 44-byte read per object.
+   */
+  async #factsOf(collectionId, object) {
+    const envelope = await this.#envelopeOf(collectionId, object.key);
+    return {
+      // The size the file has, not the size the envelope occupies.
+      size: envelope ? envelope.plaintextSize : object.size,
+      etag: object.etag ?? null,
+      // Null when there is no envelope, deliberately: an encrypted object replaced by a
+      // plaintext one must stop claiming a key, or every read of it fails looking for a
+      // header that is not there.
+      encryption: envelope
+        ? { fingerprint: toHex(envelope.fingerprint), chunkSize: envelope.chunkSize }
+        : null,
+    };
+  }
+
   async #adopt(collectionId, object) {
     if (TROVE_KEY.test(object.key)) return null; // orphaned blob from an interrupted upload
     const name = await this.#uniqueName(collectionId, object.key);
-    // Is this an encrypted object somebody copied in?
-    //
-    // The envelope says so, and says which key it wants, WITHOUT the key — which is the
-    // entire reason the header is readable. Without this an adopted object is recorded as
-    // plaintext, and every read of it hands back raw ciphertext with no error: the drive
-    // shows a file, and opening it gives you an unreadable blob. Sideloading is a named
-    // use case here, so it has to be the case that works.
-    const envelope = await this.#envelopeOf(collectionId, object.key);
+    const facts = await this.#factsOf(collectionId, object);
     const node = await this.vfs.metadata.create({
       collectionId,
       name,
       storageKey: object.key,
-      // The size the file has, not the size the envelope occupies.
-      size: envelope ? envelope.plaintextSize : (object.size ?? 0),
-      etag: object.etag ?? null,
+      ...facts,
+      size: facts.size ?? 0,
       contentType: this.vfs.guessContentType(name),
-      encryption: envelope
-        ? { fingerprint: toHex(envelope.fingerprint), chunkSize: envelope.chunkSize }
-        : null,
       meta: { adopted: true, adoptedAt: Date.now() },
     });
     // Adopted files are indexed like any other, so they are findable immediately —
@@ -247,9 +274,10 @@ export class CollectionScanner {
 
   /** Re-read an item whose bytes were replaced in place. */
   async #refresh(node, object) {
+    const facts = await this.#factsOf(node.collectionId, object);
     const updated = await this.vfs.metadata.update(node.id, {
-      size: object.size ?? node.size,
-      etag: object.etag ?? null,
+      ...facts,
+      size: facts.size ?? node.size,
     });
     await this.vfs.indexing.indexNode(updated).catch(() => {});
     return updated;

package/packages/core/src/sidecar/document.js

@@ -1,13 +1,18 @@
 // The per-file sidecar document — a small CRDT that holds everything mutable and
 // social about a file WITHOUT touching the file bytes: its conversation
-// (threaded comments + reactions), its tags, its per-indexer facet data (scoped
-// to the indexer that produced it), and who's subscribed to the thread.
+// (threaded comments + reactions), its tags, and who's subscribed to the thread.
+//
+// It does NOT hold indexer output. It advertised a per-indexer `facets` register for a
+// long time with no writer and no reader anywhere in core, server, web or the plugin SDK,
+// and there is no facet verb on the plugin RPC surface either — so the header was the
+// documentation someone extending an indexer would find first, and following it would land
+// data nothing queries. Indexer contributions live in the queryable metadata store, which
+// is what makes them show up in list/stat and drive tag filtering (see indexing.js).
 //
 // It's designed to live as cold JSON in object storage and be merged whenever
 // it's read-before-write, so two servers (or a stale hot copy vs the cold one)
 // converge without a lock or a conflict. Every field is a CRDT register:
 //   • tags   — LWW-Element-Set (add/remove wins by Lamport stamp)
-//   • facets — per-indexer LWW register
 //   • comments — grow-only map; body edit & deletion are LWW registers; reactions
 //     are an OR-map (per user, per emoji, LWW on/off)
 //   • subscribers — LWW register (subscribed / muted)
@@ -17,7 +22,7 @@
 export const SIDECAR_VERSION = 1;
 
 export function emptyDoc(nodeId) {
-  return { v: SIDECAR_VERSION, nodeId, clock: 0, tags: {}, facets: {}, comments: {}, subscribers: {} };
+  return { v: SIDECAR_VERSION, nodeId, clock: 0, tags: {}, comments: {}, subscribers: {} };
 }
 
 // A stamp orders and tie-breaks a write. Higher clock wins; equal clock → higher
@@ -96,12 +101,6 @@ export function removeTag(doc, name, { actor, at } = {}) {
   if (newer(s, cur)) doc.tags[name] = { present: false, value: cur?.value, ...s };
 }
 
-export function setFacet(doc, indexerId, data, { actor, at } = {}) {
-  const s = stamp(doc, actor ?? indexerId, at);
-  const cur = doc.facets[indexerId];
-  if (newer(s, cur)) doc.facets[indexerId] = { data, ...s };
-}
-
 export function subscribe(doc, userId, { muted = false, actor, at } = {}) {
   if (!userId) return;
   const s = stamp(doc, actor ?? userId, at);
@@ -120,10 +119,16 @@ export function unsubscribe(doc, userId, { actor, at } = {}) {
 export function mergeDoc(a, b) {
   if (!a) return structuredCloneSafe(b);
   if (!b) return structuredCloneSafe(a);
-  const out = { v: SIDECAR_VERSION, nodeId: a.nodeId || b.nodeId, clock: Math.max(a.clock || 0, b.clock || 0), tags: {}, facets: {}, comments: {}, subscribers: {} };
+  const out = { v: SIDECAR_VERSION, nodeId: a.nodeId || b.nodeId, clock: Math.max(a.clock || 0, b.clock || 0), tags: {}, comments: {}, subscribers: {} };
 
   for (const key of union(a.tags, b.tags)) out.tags[key] = pick(a.tags[key], b.tags[key]);
-  for (const key of union(a.facets, b.facets)) out.facets[key] = pick(a.facets[key], b.facets[key]);
+  // Documents written before the register was removed still carry one, and a merge that
+  // dropped half of a stored document would not be a merge. Guarded on presence so it
+  // costs nothing on the documents every writer produces now.
+  if (a.facets || b.facets) {
+    out.facets = {};
+    for (const key of union(a.facets, b.facets)) out.facets[key] = pick(a.facets[key], b.facets[key]);
+  }
   for (const key of union(a.subscribers, b.subscribers)) out.subscribers[key] = pick(a.subscribers[key], b.subscribers[key]);
 
   for (const id of union(a.comments, b.comments)) {
@@ -183,9 +188,8 @@ export function viewDoc(doc) {
     if (c.parentId && byId.has(c.parentId)) byId.get(c.parentId).replies.push(c);
     else roots.push(c);
   }
-  const facets = Object.fromEntries(Object.entries(doc.facets || {}).map(([k, v]) => [k, v.data]));
   const subscribers = Object.entries(doc.subscribers || {}).filter(([, s]) => s.subscribed).map(([id]) => id).sort();
-  return { nodeId: doc.nodeId, tags, comments: roots, commentCount: all.filter((c) => !c.deleted).length, facets, subscribers };
+  return { nodeId: doc.nodeId, tags, comments: roots, commentCount: all.filter((c) => !c.deleted).length, subscribers };
 }
 
 function summariseReactions(reactions = {}) {

package/packages/core/src/sidecar/index.js

@@ -1,5 +1,5 @@
 // SidecarService — the API surface over sidecar documents: conversations
-// (threaded comments, edits, reactions), tags, per-indexer facets, and thread
+// (threaded comments, edits, reactions), tags, and thread
 // subscriptions. It resolves the acting Principal into comment authorship,
 // extracts @mentions, auto-subscribes participants, and emits mention events to
 // a callback (wired to the notification batcher). Routes call these methods.
@@ -7,7 +7,7 @@
 import { SidecarStore } from './store.js';
 import { SidecarManager } from './manager.js';
 import {
-  addComment, editComment, deleteComment, react, setTag, removeTag, setFacet,
+  addComment, editComment, deleteComment, react, setTag, removeTag,
   subscribe, unsubscribe, viewDoc, extractMentions,
 } from './document.js';
 import { newId } from '../util.js';
@@ -47,6 +47,13 @@ export class SidecarService {
   flushAll() {
     return this.manager.flushAll();
   }
+  /**
+   * Try again to save what could not be saved — what the `sidecar-flush` issue's Retry
+   * button runs. Clears the issue for each document that lands.
+   */
+  retryPending() {
+    return this.manager.retryPending();
+  }
 
   // --- conversation ----------------------------------------------------------
 
@@ -108,14 +115,6 @@ export class SidecarService {
     return this.view(nodeId);
   }
 
-  // --- facets (indexer-scoped) ----------------------------------------------
-
-  /** Write an indexer's facet into the sidecar, namespaced under indexerId. */
-  async setFacet(nodeId, indexerId, data) {
-    await this.manager.mutate(nodeId, (doc) => setFacet(doc, indexerId, data, { actor: indexerId }));
-    return { ok: true };
-  }
-
   // --- subscriptions ---------------------------------------------------------
 
   async subscribe(nodeId, principal, muted = false) {

package/packages/core/src/sidecar/manager.js

@@ -27,10 +27,10 @@ export class SidecarManager {
     let e = this.hot.get(nodeId);
     if (e) {
       if (e.loading) await e.loading;
-      e.lastAccess = now();
+      e.lastAccess = Date.now();
       return e;
     }
-    e = { doc: null, dirty: false, timer: null, lastAccess: now() };
+    e = { doc: null, dirty: false, timer: null, lastAccess: Date.now() };
     this.hot.set(nodeId, e);
     e.loading = (async () => {
       e.doc = (await this.store.load(nodeId)) || this.store.emptyDoc(nodeId);
@@ -99,15 +99,18 @@ export class SidecarManager {
           // Out of retries. The comment is still in memory and still served, but it will
           // not survive a restart, and the person who wrote it has been told it saved.
           // That is a standing problem, which is exactly what the issue registry is for.
-          this.issues?.raise?.({
+          this.issues?.raise({
             kind: 'sidecar-flush',
             subject: nodeId,
             severity: 'error',
             title: 'A comment or tag could not be saved',
             detail: `Changes to this item's conversation are held in memory only — ${err?.message || err}`,
-            // The op the server registers via issues.handle('sidecar-flush', …), which
-            // is what makes the Retry button appear and do the right thing.
-            retry: 'sidecar-flush',
+            // `{ op, nodeId }`, not a bare string: `canRetry` reads `issue.retry.op`, so
+            // the string form answered false and the Retry button never rendered — and if
+            // it had, `IssueRegistry.retry` would have thrown. Both halves were broken
+            // independently, on the one retry that matters most: the user has been told
+            // their comment saved and it exists only in memory.
+            retry: { op: 'sidecar-flush', nodeId },
           }).catch(() => {});
         }
       });
@@ -189,7 +192,7 @@ export class SidecarManager {
    * transient storage blip into silent data loss a minute later.
    */
   async sweep() {
-    const cutoff = now() - this.idleEvictMs;
+    const cutoff = Date.now() - this.idleEvictMs;
     for (const [id, e] of this.hot) {
       if (e.lastAccess >= cutoff || e.timer) continue;
       if (e.dirty) {
@@ -229,11 +232,3 @@ export class SidecarManager {
     return result;
   }
 }
-
-function now() {
-  try {
-    return Date.now();
-  } catch {
-    return 0;
-  }
-}

package/packages/core/src/uploads.js

@@ -19,7 +19,6 @@ import {
   HEADER_BYTES as ENVELOPE_HEAD,
 } from './encryption/envelope.js';
 import { fromHex, toHex } from './encryption/keys.js';
-import { shouldEncrypt } from './encryption/policy.js';
 
 export const DEFAULT_PART_SIZE = 8 * 1024 * 1024; // 8 MiB
 const MIN_MULTIPART_PART = 5 * 1024 * 1024; // S3 floor (except final part)
@@ -147,14 +146,28 @@ export class UploadManager {
    * @param {object} [deps.sessions] session store (defaults in-memory)
    * @param {number} [deps.partSize]
    */
-  constructor({ storage, storageFor, sessions, encryptionFor, partSize = DEFAULT_PART_SIZE, maxBytes = null }) {
+  constructor({ storage, storageFor, sessions, sealingFor, keyFor, partSize = DEFAULT_PART_SIZE, maxBytes = null }) {
     // Either a single backend, or a resolver keyed by collectionId (collections).
     this.storageFor = storageFor ?? (async () => storage);
     this.sessions = sessions ?? new MemorySessionStore();
-    // What a collection encrypts, and the key to do it with:
-    // `(collectionId) => { encryption, dataKey } | null`. Absent means nothing is
-    // encrypted, which is what every existing deployment is.
-    this.encryptionFor = encryptionFor ?? (async () => null);
+    // Whether this item gets sealed and with what:
+    // `(collectionId, name, contentType) => { key, fingerprint, chunkSize } | null`.
+    //
+    // INJECTED rather than decided here, because there was a second implementation of the
+    // same question and the two disagreed in the direction that matters. This one used to
+    // ask for a collection-wide policy and apply `shouldEncrypt` itself, and a miss on the
+    // key answered `null` — which made the upload session PLAINTEXT in a collection set up
+    // to encrypt. `Vfs.#sealingFor`, the other implementation, throws. `#assertSealed` is
+    // the guard built to stop exactly this and it is gated on `s.encrypted`, so it never
+    // ran on the fail-open path. There is one implementation now and it fails closed.
+    //
+    // Absent means nothing is encrypted, which is what a Vfs-less deployment is.
+    this.sealingFor = sealingFor ?? (async () => null);
+    // The key a FINGERPRINT names, for sealing the remaining parts of an upload that has
+    // already decided. Not `sealingFor` again: that answers with whatever key is current,
+    // and a rotation starting mid-upload makes the current key a different one — parts
+    // sealed under it while the header names the old fingerprint decrypt as corruption.
+    this.keyFor = keyFor ?? (async () => null);
     this.partSize = partSize;
     this.maxBytes = maxBytes || null; // per-file quota (null = unbounded)
   }
@@ -197,9 +210,9 @@ export class UploadManager {
     // plus an authentication tag per chunk. Planning multipart boundaries against the
     // plaintext size is short by exactly that, which is the difference between a final part
     // that exists and one that does not.
-    const policy = await this.encryptionFor(collectionId);
-    const encrypting = !!policy && shouldEncrypt(policy.encryption, { name: req.name, contentType });
-    const chunkSize = policy?.encryption?.chunkSize || DEFAULT_CHUNK_SIZE;
+    const sealing = await this.sealingFor(collectionId, req.name, contentType);
+    const encrypting = !!sealing;
+    const chunkSize = sealing?.chunkSize || DEFAULT_CHUNK_SIZE;
     const storedSize = encrypting ? cipherSize(req.size, chunkSize) : req.size;
 
     // The per-file limit is checked against what will be STORED, and checked here rather
@@ -245,7 +258,7 @@ export class UploadManager {
       // may arrive in any order — see `#sealPart`. Generating it per part would reuse
       // nonces across the object, which AES-GCM does not survive.
       noncePrefix: encrypting ? toHex(crypto.getRandomValues(new Uint8Array(8))) : null,
-      keyFingerprint: encrypting ? policy.encryption.fingerprint : null,
+      keyFingerprint: encrypting ? toHex(sealing.fingerprint) : null,
       contentType,
       createdAt: Date.now(),
       strategy: null,
@@ -279,7 +292,9 @@ export class UploadManager {
       const wireSize = encrypting ? req.size : storedSize;
       const partCount = Math.max(1, Math.ceil(wireSize / this.partSize));
       // A part must hold a whole number of chunks, or the chunk a part boundary lands
-      // inside would be sealed twice under two different indices.
+      // inside would be sealed twice under two different indices. Reachable, unlike a
+      // per-collection chunk size: `partSize` really is injectable (`uploadPartSize`), and
+      // the chunk size is fixed, so this checks the half a deployment can get wrong.
       if (encrypting && this.partSize % chunkSize !== 0) {
         throw TroveError.internal(
           `Part size ${this.partSize} is not a multiple of the ${chunkSize}-byte chunk size`,
@@ -466,10 +481,16 @@ export class UploadManager {
     return prependBytes(header, sealed);
   }
 
-  /** The collection's key, for sealing. Never leaves this process. */
+  /**
+   * The key this SESSION decided on, for sealing. Never leaves this process.
+   *
+   * By fingerprint, not "whatever the collection encrypts with now": the fingerprint was
+   * pinned at negotiation because the collection's rules and its current key can both
+   * change while an upload is in flight, and half an object sealed under each is
+   * unreadable in a way nothing reports.
+   */
   async #dataKeyFor(s) {
-    const policy = await this.encryptionFor(s.collectionId);
-    const key = policy?.dataKeyHex ? fromHex(policy.dataKeyHex) : null;
+    const key = await this.keyFor(s.collectionId, s.keyFingerprint);
     if (!key) throw TroveError.internal('This collection is encrypted but its key is unavailable');
     return key;
   }
@@ -598,7 +619,11 @@ export class UploadManager {
    * @returns {Promise<{aborted: number, failed: number}>}
    */
   async sweepExpired(now = Date.now()) {
-    const ids = (await this.sessions.expired?.(now)) || [];
+    // Not `expired?.()`. Both session stores define it and it is part of the store
+    // interface — the optional call is the shape server/src/index.js records as having
+    // turned "evict idle documents" into a permanent no-op, because a name that stopped
+    // existing looked exactly like a name that was never required.
+    const ids = (await this.sessions.expired(now)) || [];
     let aborted = 0;
     let failed = 0;
     for (const id of ids) {