@pairlobby/server-core 0.32.0 → 0.33.0

package/dist/service.js

@@ -1,14 +1,22 @@
 //! Room operations shared by every transport. The Cloudflare Durable Object and
 //! the Node server both run this; only the store and the socket layer differ.
-import { ABSOLUTE_MAX_FILE_BYTES, CONTACT_INVITE_LIFETIME_MS, DEFAULT_MAX_FILE_BYTES, DEFAULT_MAX_RETAINED_FILE_BYTES, DEFAULT_ROOM_POLICY, PROTOCOL_VERSION, ProtocolError, UNATTACHED_FILE_LIFETIME_MS, canSee, formatFileSize, hashCredential, newId, newInviteCode, normalizeInviteCode, roomType, safeFileName } from '@pairlobby/protocol';
-import { assertRoomWritable, appendEvent, assertRoomJoinable, assertCanWrite, assertCanAcknowledge, assertActiveMember, assertController, assertPermitted, authenticate, closeRoom, createRoom, joinAsGuest, joinOnLocalNetwork, recordInvitation, joinRoom, leaveRoom, rejoinRoom, renameRoom, renameSelf, requestControl, revokeParticipant, sendEvent, setExpiry, setAutoClose, setInviteRole, setJoinPolicy, setLocalJoin, setLocked, setMuted, setParticipantPermissions, setParticipantRole, setRoomPermissions, setRoomType, setRoomVisibility, emptyMutation, findParticipant, isActive, toSnapshot } from '@pairlobby/room-core';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { ABSOLUTE_MAX_FILE_BYTES, CONTACT_INVITE_LIFETIME_MS, DEFAULT_MAX_FILE_BYTES, DEFAULT_MAX_RETAINED_FILE_BYTES, DEFAULT_ROOM_POLICY, FILE_CHUNK_BYTES, PROTOCOL_VERSION, ProtocolError, UNATTACHED_FILE_LIFETIME_MS, canSee, formatFileSize, hashCredential, newId, newInviteCode, normalizeInviteCode, roomType, safeFileName } from '@pairlobby/protocol';
+import { assertRoomWritable, assertRoomReadable, appendEvent, assertRoomJoinable, assertCanWrite, assertCanAcknowledge, assertActiveMember, assertController, assertPermitted, authenticate, closeRoom, createRoom, joinAsGuest, joinOnLocalNetwork, recordInvitation, joinRoom, leaveRoom, rejoinRoom, renameRoom, renameSelf, requestControl, revokeParticipant, sendEvent, setExpiry, setAutoClose, setInviteRole, setJoinPolicy, setLocalJoin, setLocked, setMuted, setParticipantPermissions, setParticipantRole, setRoomPermissions, setRoomType, setRoomVisibility, emptyMutation, findParticipant, isActive, toSnapshot } from '@pairlobby/room-core';
 import { stableStringify } from './stable-json.js';
 import { TurnCoordinator, assertTurn } from './turns.js';
 import { AutoCloseStore } from './auto-close-store.js';
+import { retryRoomConflict } from './commit.js';
+import { exportResponse, retainedEvents } from './export.js';
+/** Membership authorization for a transport attachment that was authenticated when issued. */
+export function assertConnectedParticipant(snapshot, participantId) {
+    const participant = snapshot.participants.find((entry) => entry.participantId === participantId);
+    if (!participant || participant.revoked || participant.left) {
+        throw new ProtocolError('participant_revoked', 'this participant is no longer in the room');
+    }
+}
 /** Why a code made by a member, or a join by name, did not let someone in. */
 const NOT_VISIBLE = 'the room\'s owner has not let you see this room: ask them for a code, or log in to the relay as someone who can see it (pairlobby login)';
-/** Requests a watermark marks received in one write; the rest wait for the next one. */
-const WATERMARK_REQUEST_LIMIT = 2000;
 /** A receipt that only says the message arrived: no Read stage, no action. */
 function isPlainReceipt(request) {
     return request.type === 'message.received' && !request.payload.stage && !request.payload.action;
@@ -61,13 +69,24 @@ export class RoomService {
     ctx() {
         return { now: this.now(), newEventId: () => newId('event') };
     }
-    async view(roomId) {
-        const view = await this.store.loadRoom(roomId);
+    async view(roomId, handovers = false) {
+        const view = await this.store.loadRoom(roomId, { handovers });
         if (!view) {
             throw new ProtocolError('room_not_found', 'no such room');
         }
         return view;
     }
+    /** Reading events or requests needs one credential, not every past member and handover. */
+    async reader(roomId, credential) {
+        const head = await this.store.roomHead(roomId);
+        if (!head) {
+            throw new ProtocolError('room_not_found', 'no such room');
+        }
+        const hash = await hashCredential(credential);
+        const participant = await this.store.participantByCredential(roomId, hash);
+        const actor = authenticate({ ...head, participants: participant ? [participant] : [], controls: [], handovers: [] }, hash, this.now());
+        return { head, actor };
+    }
     /** What the room looks like, plus what this relay can do that depends on its store rather than on the room. */
     snapshotOf(view) {
         return { ...toSnapshot(view), filesSupported: this.store.files !== undefined, receiptMode: this.receiptMode };
@@ -89,31 +108,86 @@ export class RoomService {
      */
     async uploadFile(roomId, credential, upload) {
         const files = this.fileStore();
+        const credentialHash = await hashCredential(credential);
+        const size = upload.bytes.byteLength;
+        const { uploaderId } = await this.uploadPermission(roomId, credentialHash, size);
+        const now = this.now();
+        await files.deleteUnattachedFiles(roomId, now - UNATTACHED_FILE_LIFETIME_MS);
+        const digest = hexDigest(sha256(upload.bytes));
+        const file = this.uploadRecord(roomId, uploaderId, upload.name, upload.mediaType, size, digest, now);
+        await retryRoomConflict(async () => {
+            const { view, retained } = await this.uploadPermission(roomId, credentialHash, size);
+            if (!(await files.putFile(file, upload.bytes, retained, view.room.stateRevision ?? 0))) {
+                throw new ProtocolError('quota_exceeded', `this room has reached its file storage limit of ${formatFileSize(retained)}`);
+            }
+        });
+        return toAttachment(file);
+    }
+    async uploadPermission(roomId, credentialHash, size) {
         const view = await this.view(roomId);
         const now = this.now();
-        const actor = authenticate(view, await hashCredential(credential), now);
+        const actor = authenticate(view, credentialHash, now);
         assertRoomWritable(view, now);
         const sender = assertCanWrite(actor);
         assertPermitted(view, actor, 'attach');
         const limit = Math.min(view.room.policy.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES, ABSOLUTE_MAX_FILE_BYTES);
-        const size = upload.bytes.byteLength;
         if (limit === 0) {
             throw new ProtocolError('unsupported_capability', 'this room does not accept files');
         }
         if (size === 0) {
             throw new ProtocolError('invalid_request', 'an empty file cannot be attached');
         }
+        if (!Number.isSafeInteger(size) || size < 0) {
+            throw new ProtocolError('invalid_request', 'a file needs a positive, declared byte length');
+        }
         if (size > limit) {
             throw new ProtocolError('payload_too_large', `this file is ${formatFileSize(size)}; this room accepts files up to ${formatFileSize(limit)}`);
         }
-        await files.deleteUnattachedFiles(roomId, now - UNATTACHED_FILE_LIFETIME_MS);
-        const digest = await globalThis.crypto.subtle.digest('SHA-256', upload.bytes);
-        const sha256 = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
-        const mediaType = /^[\w.+-]{1,60}\/[\w.+-]{1,60}$/.test(upload.mediaType.split(';')[0].trim()) ? upload.mediaType.split(';')[0].trim().toLowerCase() : 'application/octet-stream';
-        const file = { fileId: newId('file'), roomId, uploaderId: sender.participantId, name: safeFileName(upload.name), size, mediaType, sha256, createdAt: now, eventId: null };
-        const retained = view.room.policy.maxRetainedFileBytes ?? DEFAULT_MAX_RETAINED_FILE_BYTES;
-        if (!(await files.putFile(file, upload.bytes, retained))) {
-            throw new ProtocolError('quota_exceeded', `this room has reached its file storage limit of ${formatFileSize(retained)}`);
+        return { view, uploaderId: sender.participantId, retained: view.room.policy.maxRetainedFileBytes ?? DEFAULT_MAX_RETAINED_FILE_BYTES };
+    }
+    uploadRecord(roomId, uploaderId, name, claimedType, size, digest, now) {
+        const baseType = claimedType.split(';')[0].trim();
+        const mediaType = /^[\w.+-]{1,60}\/[\w.+-]{1,60}$/.test(baseType) ? baseType.toLowerCase() : 'application/octet-stream';
+        return { fileId: newId('file'), roomId, uploaderId, name: safeFileName(name), size, mediaType, sha256: digest, createdAt: now, eventId: null };
+    }
+    /** Reserve quota, stream bounded chunks, and make the upload visible only after validation and fresh authorization. */
+    async uploadFileStream(roomId, credential, upload, run = (action) => action()) {
+        const files = this.fileStore();
+        const credentialHash = await hashCredential(credential);
+        const { uploaderId } = await run(() => this.uploadPermission(roomId, credentialHash, upload.size));
+        const now = this.now();
+        await run(() => files.deleteUnattachedFiles(roomId, now - UNATTACHED_FILE_LIFETIME_MS));
+        const file = this.uploadRecord(roomId, uploaderId, upload.name, upload.mediaType, upload.size, '', now);
+        if (!files.createUpload || !files.writeChunk || !files.completeUpload || !files.cancelUpload) {
+            // Compatibility for older in-process adapters. The production SQLite adapters implement staging.
+            const bytes = new Uint8Array(upload.size);
+            let offset = 0;
+            await consumeUpload(upload, async (chunk) => { bytes.set(chunk, offset); offset += chunk.byteLength; });
+            return run(() => this.uploadFile(roomId, credential, { name: upload.name, mediaType: upload.mediaType, bytes }));
+        }
+        await retryRoomConflict(() => run(async () => {
+            const { view, retained } = await this.uploadPermission(roomId, credentialHash, upload.size);
+            if (!(await files.createUpload(file, retained, view.room.stateRevision ?? 0))) {
+                throw new ProtocolError('quota_exceeded', `this room has reached its file storage limit of ${formatFileSize(retained)}`);
+            }
+        }));
+        try {
+            let index = 0;
+            const digest = sha256.create();
+            await consumeUpload(upload, async (chunk) => {
+                digest.update(chunk);
+                await run(() => files.writeChunk(roomId, file.fileId, index++, chunk));
+            });
+            file.sha256 = hexDigest(digest.digest());
+            await retryRoomConflict(() => run(async () => {
+                upload.signal?.throwIfAborted();
+                const { view } = await this.uploadPermission(roomId, credentialHash, upload.size);
+                await files.completeUpload(file, view.room.stateRevision ?? 0);
+            }));
+        }
+        catch (error) {
+            await run(() => files.cancelUpload(roomId, file.fileId));
+            throw error;
         }
         return toAttachment(file);
     }
@@ -130,16 +204,24 @@ export class RoomService {
         return (await files.attachedFiles(roomId)).map((file) => ({ ...toAttachment(file), uploaderId: file.uploaderId, createdAt: file.createdAt, eventId: file.eventId }));
     }
     async downloadFile(roomId, credential, fileId) {
+        const { file, body } = await this.downloadFileStream(roomId, credential, fileId);
+        return { file, bytes: new Uint8Array(await new Response(body).arrayBuffer()) };
+    }
+    async downloadFileStream(roomId, credential, fileId) {
         const files = this.fileStore();
         const actor = authenticate(await this.view(roomId), await hashCredential(credential), this.now());
         const file = await files.file(roomId, fileId);
         // An upload not yet sent is visible to its uploader only, and says no more than a missing file does.
         const visible = file && (file.eventId !== null || (actor.kind === 'participant' && actor.participant.participantId === file.uploaderId));
-        const bytes = visible ? await files.fileBytes(roomId, fileId) : null;
-        if (!file || !bytes) {
+        let body = visible && files.fileStream ? await files.fileStream(roomId, fileId) : null;
+        if (visible && !files.fileStream) {
+            const bytes = await files.fileBytes(roomId, fileId);
+            body = bytes ? new Response(bytes).body : null;
+        }
+        if (!file || !body) {
             throw new ProtocolError('invalid_request', 'no such file in this room');
         }
-        return { file, bytes };
+        return { file, body };
     }
     /** Replaces what the client said about each file with the relay's own record of it. */
     async attachments(view, actor, claimed) {
@@ -186,6 +268,9 @@ export class RoomService {
         return { roomId: created.room.roomId, participantId: created.participant.participantId, invite, snapshot: this.snapshotOf(view) };
     }
     async mintInvite(roomId, credential, role, reusable = true, expiresAt, defaultName) {
+        return retryRoomConflict(() => this.mintInviteAttempt(roomId, credential, role, reusable, expiresAt, defaultName));
+    }
+    async mintInviteAttempt(roomId, credential, role, reusable, expiresAt, defaultName) {
         const view = await this.view(roomId);
         const actor = authenticate(view, await hashCredential(credential), this.now());
         assertPermitted(view, actor, 'invite');
@@ -215,7 +300,7 @@ export class RoomService {
             boundCredentialHash: null,
             redeemedParticipantId: null,
             recoverableUntil: deadline === null ? null : deadline + (deadline - now)
-        });
+        }, view.room.stateRevision ?? 0);
         return { code, expiresAt: deadline, reusable };
     }
     /** A code no invite has, claimed in the directory when there is one. */
@@ -244,36 +329,51 @@ export class RoomService {
      * The room checks again that the listing stands and that they see the room.
      */
     async contactInvite(roomId, listing, handle) {
-        const view = await this.view(roomId);
-        const now = this.now();
-        const agent = findParticipant(view, listing.participantId);
-        if (!agent || !(await this.listable(roomId, listing.participantId)) || !(await this.sees(view.room, handle))) {
-            throw new ProtocolError('invalid_request', 'no such listing');
-        }
-        const expiresAt = now + CONTACT_INVITE_LIFETIME_MS;
-        const { code, digest } = await this.allocateCode(roomId, expiresAt);
-        await this.store.putInvite({
-            digest,
-            roomId,
-            role: 'member',
-            createdAt: now,
-            expiresAt,
-            state: 'unused',
-            // Sharing the agent was the owner's consent; the room was checked against this member just now.
-            issuedBy: 'owner',
-            origin: { directory: true, handle, listingId: listing.listingId, contact: listing.contact },
-            reusable: false,
-            boundAttemptId: null,
-            boundCredentialHash: null,
-            redeemedParticipantId: null,
-            recoverableUntil: expiresAt + CONTACT_INVITE_LIFETIME_MS
+        return retryRoomConflict(async () => {
+            const view = await this.view(roomId);
+            const now = this.now();
+            const agent = findParticipant(view, listing.participantId);
+            if (!agent || !(await this.listable(roomId, listing.participantId)) || !(await this.sees(view.room, handle))) {
+                throw new ProtocolError('invalid_request', 'no such listing');
+            }
+            const expiresAt = now + CONTACT_INVITE_LIFETIME_MS;
+            const { code, digest } = await this.allocateCode(roomId, expiresAt);
+            await this.store.putInvite({
+                digest,
+                roomId,
+                role: 'member',
+                createdAt: now,
+                expiresAt,
+                state: 'unused',
+                // Sharing the agent was the owner's consent; the room was checked against this member just now.
+                issuedBy: 'owner',
+                origin: { directory: true, handle, listingId: listing.listingId, contact: listing.contact },
+                reusable: false,
+                boundAttemptId: null,
+                boundCredentialHash: null,
+                redeemedParticipantId: null,
+                recoverableUntil: expiresAt + CONTACT_INVITE_LIFETIME_MS
+            }, view.room.stateRevision ?? 0);
+            return { code, expiresAt, roomId, agentId: agent.participantId, agentName: agent.displayName, roomName: view.room.name, owner: listing.owner, contact: listing.contact, connection: listing.connection };
         });
-        return { code, expiresAt, roomId, agentId: agent.participantId, agentName: agent.displayName, roomName: view.room.name, owner: listing.owner, contact: listing.contact, connection: listing.connection };
     }
     /** Whether a member reaches this listing: it still stands, and they see its room. */
     async listingVisible(listing, handle) {
-        const view = await this.store.loadRoom(listing.roomId);
-        return Boolean(view) && (await this.listable(listing.roomId, listing.participantId)) && this.sees(view.room, handle);
+        const view = await this.store.loadRoom(listing.roomId, { handovers: false });
+        return Boolean(view && this.listableParticipant(view, listing.participantId) && await this.sees(view.room, handle));
+    }
+    async visibleListings(listings, handle) {
+        const rooms = new Map();
+        const visible = await Promise.all(listings.map(async (listing) => {
+            let loading = rooms.get(listing.roomId);
+            if (!loading) {
+                loading = this.store.loadRoom(listing.roomId, { handovers: false });
+                rooms.set(listing.roomId, loading);
+            }
+            const view = await loading;
+            return Boolean(view && this.listableParticipant(view, listing.participantId) && await this.sees(view.room, handle));
+        }));
+        return listings.filter((_, index) => visible[index]);
     }
     /**
      * Redemption binds the invite to one attempt before membership exists, so a
@@ -285,6 +385,9 @@ export class RoomService {
         return (await this.store.inviteByDigest(digest))?.roomId ?? null;
     }
     async redeemInvite(input) {
+        return retryRoomConflict(() => this.redeemInviteAttempt(input));
+    }
+    async redeemInviteAttempt(input) {
         const normalized = normalizeInviteCode(input.code);
         if (!normalized) {
             throw new ProtocolError('invite_unknown', 'that invite code is not well formed');
@@ -295,7 +398,7 @@ export class RoomService {
             throw new ProtocolError('invite_unknown', 'that invite code is not valid');
         }
         const now = this.now();
-        const view = await this.view(invite.roomId);
+        let view = await this.view(invite.roomId);
         assertRoomJoinable(view, now);
         let expectedOccupantId = null;
         const credentialHash = await hashCredential(input.participantCredential);
@@ -340,15 +443,24 @@ export class RoomService {
         if (invite.issuedBy === 'member' && !(await this.sees(view.room, input.member))) {
             throw new ProtocolError('unauthorized', NOT_VISIBLE);
         }
-        const reserved = await this.store.reserveInvite(digest, input.attemptId, credentialHash, expectedOccupantId);
+        const reserved = await this.store.reserveInvite(digest, input.attemptId, credentialHash, expectedOccupantId, view.room.stateRevision ?? 0);
         if (!reserved) {
             throw new ProtocolError('invite_already_redeemed', 'that invite code is being redeemed by another attempt');
         }
+        // Reservation is a separate durable stage. Recheck admission against the revision it left.
+        view = await this.view(invite.roomId);
+        assertRoomJoinable(view, this.now());
+        if (roomType(view.room.policy) === 'personal' && reserved.issuedBy !== 'owner' && reserved.issuedBy !== 'admin') {
+            throw new ProtocolError('unauthorized', 'this is a personal room: only codes from its owner admit anyone');
+        }
+        if (reserved.issuedBy === 'member' && !(await this.sees(view.room, input.member))) {
+            throw new ProtocolError('unauthorized', NOT_VISIBLE);
+        }
         // Recovery path: the previous attempt created membership but lost its response.
         const existing = await this.store.participantByCredential(invite.roomId, credentialHash);
         if (existing) {
-            assertActiveMember(authenticate(view, credentialHash, now));
-            await this.store.completeInvite(digest, existing.participantId);
+            assertActiveMember(authenticate(await this.view(invite.roomId), credentialHash, now));
+            await this.store.completeInvite(digest, existing.participantId, input.attemptId);
             return { roomId: invite.roomId, participantId: existing.participantId, role: existing.role, replayed: true, snapshot: this.snapshotOf(await this.view(invite.roomId)) };
         }
         const previousOccupant = view.participants.find((participant) => participant.participantId === invite.redeemedParticipantId);
@@ -374,11 +486,14 @@ export class RoomService {
             joined.participant.permissions = refused;
         }
         await this.store.apply(joined.mutation, null);
-        await this.store.completeInvite(digest, joined.participant.participantId);
+        await this.store.completeInvite(digest, joined.participant.participantId, input.attemptId);
         return { roomId: invite.roomId, participantId: joined.participant.participantId, role: admissionRole, replayed: false, snapshot: this.snapshotOf(await this.view(invite.roomId)) };
     }
     async send(roomId, credential, request) {
-        const view = await this.view(roomId);
+        return retryRoomConflict(() => this.sendAttempt(roomId, credential, request));
+    }
+    async sendAttempt(roomId, credential, request) {
+        const view = await this.view(roomId, request.type.startsWith('handover.'));
         // One clock reading for the whole operation: the request record and the event it
         // produces must carry the same time, or a client comparing them sees one as stale.
         const now = this.now();
@@ -576,8 +691,7 @@ export class RoomService {
             throw new ProtocolError('invalid_request', 'responseStage requires replyTo');
         }
         if (request.type === 'message' && recipients.length && !request.replyTo) {
-            const pending = await this.store.messageRequests(roomId, 0, 1000);
-            if (pending.requests.length + recipients.length > 1000) {
+            if ((await this.store.pendingRequestCount(roomId)) + recipients.length > 1000) {
                 throw new ProtocolError('quota_exceeded', 'answer or resolve pending requests before creating more');
             }
         }
@@ -648,38 +762,43 @@ export class RoomService {
         return { event: mutation.appendEvent, deduplicated: false };
     }
     async acknowledgeMessage(roomId, credential, eventId) {
-        const view = await this.view(roomId);
-        const now = this.now();
-        const actor = authenticate(view, await hashCredential(credential), now);
-        const participant = assertCanAcknowledge(actor);
-        const target = await this.turns.resolve(roomId, eventId, participant.participantId);
-        if (target?.to === participant.participantId && target.receivedAt !== null) {
-            return this.publicRequest(target);
-        }
-        if (this.receiptMode === 'watermark') {
-            assertRoomWritable(view, now);
-            await this.plainReceipt(view, participant, eventId, now);
-            const received = await this.turns.resolve(roomId, eventId, participant.participantId);
-            return received ? this.publicRequest(received) : null;
-        }
-        const root = target?.conversationId ?? eventId;
-        const key = `receipt-${root}-${participant.participantId}`;
-        const saved = await this.store.idempotencyRecord(roomId, key);
-        const digest = stableStringify({ type: 'message.received', payload: { eventId: root }, recipientId: null, replyTo: null });
-        if (saved && saved.requestDigest !== digest) {
-            throw new ProtocolError('idempotency_conflict', 'the receipt key was used with different content');
-        }
-        if (!saved) {
-            await this.send(roomId, credential, { type: 'message.received', payload: { eventId: root }, idempotencyKey: key });
-        }
-        const updated = await this.turns.resolve(roomId, eventId, participant.participantId);
-        return updated ? this.publicRequest(updated) : null;
+        return retryRoomConflict(async () => {
+            const view = await this.view(roomId);
+            const now = this.now();
+            const actor = authenticate(view, await hashCredential(credential), now);
+            const participant = assertCanAcknowledge(actor);
+            const target = await this.turns.resolve(roomId, eventId, participant.participantId);
+            if (target?.to === participant.participantId && target.receivedAt !== null) {
+                return this.publicRequest(target);
+            }
+            if (this.receiptMode === 'watermark') {
+                assertRoomWritable(view, now);
+                await this.plainReceipt(view, participant, eventId, now);
+                const received = await this.turns.resolve(roomId, eventId, participant.participantId);
+                return received ? this.publicRequest(received) : null;
+            }
+            const root = target?.conversationId ?? eventId;
+            const key = `receipt-${root}-${participant.participantId}`;
+            const saved = await this.store.idempotencyRecord(roomId, key);
+            const digest = stableStringify({ type: 'message.received', payload: { eventId: root }, recipientId: null, replyTo: null });
+            if (saved && saved.requestDigest !== digest) {
+                throw new ProtocolError('idempotency_conflict', 'the receipt key was used with different content');
+            }
+            if (!saved) {
+                await this.send(roomId, credential, { type: 'message.received', payload: { eventId: root }, idempotencyKey: key });
+            }
+            const updated = await this.turns.resolve(roomId, eventId, participant.participantId);
+            return updated ? this.publicRequest(updated) : null;
+        });
     }
     /**
      * `POST /v1/rooms/:id/receipts`: this participant has received every event up to `throughSeq`.
      * Moves their watermark and marks their requests up to there received, with no event.
      */
     async receipt(roomId, credential, throughSeq) {
+        return retryRoomConflict(() => this.receiptAttempt(roomId, credential, throughSeq));
+    }
+    async receiptAttempt(roomId, credential, throughSeq) {
         if (this.receiptMode === 'events') {
             throw new ProtocolError('unsupported_capability', 'this relay keeps receipts as events; acknowledge each message instead');
         }
@@ -717,35 +836,11 @@ export class RoomService {
         if (room === view.room) {
             return room;
         }
-        const requests = await this.receivedThrough(room.roomId, participantId, room.receipts[participantId].throughSeq, now);
-        await this.store.updateTurns(room, requests, view.room.turnRevision ?? 0);
+        // The store records a compact timestamped range atomically with this mark. Request reads
+        // project their first receipt from it, including completed replies and arbitrarily old backlogs.
+        await this.store.updateTurns(room, [], view.room.turnRevision ?? 0);
         return room;
     }
-    /** This participant's requests whose message is at or before `throughSeq` and not yet received, marked received at `now`. */
-    async receivedThrough(roomId, participantId, throughSeq, now) {
-        const page = (after) => this.store.unreceivedRequests ? this.store.unreceivedRequests(roomId, participantId, after, 200) : this.store.messageRequests(roomId, after, 200, participantId);
-        const marked = [];
-        let after = 0;
-        while (marked.length < WATERMARK_REQUEST_LIMIT) {
-            const { requests, hasMore } = await page(after);
-            for (const request of requests) {
-                if (request.receivedAt !== null) {
-                    continue;
-                }
-                // Requests are numbered in message order, so the first one past the watermark ends the search.
-                if ((await this.messageSeqOf(roomId, request)) > throughSeq) {
-                    return marked;
-                }
-                marked.push({ ...request, receivedAt: now });
-            }
-            const last = requests.at(-1)?.seq;
-            if (!hasMore || last === undefined || last <= after) {
-                return marked;
-            }
-            after = last;
-        }
-        return marked;
-    }
     /** The transcript seq of a request's message; 0 when that message is no longer retained, which puts it behind any watermark. */
     async messageSeqOf(roomId, request) {
         return request.messageSeq ?? (await this.store.eventById(roomId, request.conversationId ?? request.eventId))?.seq ?? 0;
@@ -757,7 +852,7 @@ export class RoomService {
         return result;
     }
     async requests(roomId, credential, after = 0, limit = 100, recipientId, supportsTurns = true) {
-        authenticate(await this.view(roomId), await hashCredential(credential), this.now());
+        await this.reader(roomId, credential);
         if (supportsTurns) {
             const page = await this.store.messageRequests(roomId, after, limit, recipientId);
             return { ...page, requests: page.requests.map((request) => this.publicRequest(request)) };
@@ -766,7 +861,7 @@ export class RoomService {
         // hasMore=true that gives their cursor no way to advance.
         let cursor = after;
         const visible = [];
-        for (let pageNumber = 0; pageNumber < 11; pageNumber++) {
+        for (let pageNumber = 0; pageNumber < 1101; pageNumber++) {
             const page = await this.store.messageRequests(roomId, cursor, Math.max(limit, 100), recipientId);
             visible.push(...page.requests.filter((request) => !request.turnRequired));
             if (visible.length >= limit || !page.hasMore) {
@@ -781,7 +876,7 @@ export class RoomService {
         throw new ProtocolError('server_unavailable', 'pending request limit exceeded');
     }
     async request(roomId, credential, eventId) {
-        const actor = authenticate(await this.view(roomId), await hashCredential(credential), this.now());
+        const { actor } = await this.reader(roomId, credential);
         const request = await this.turns.resolve(roomId, eventId, actor.kind === 'participant' ? actor.participant.participantId : undefined);
         if (!request) {
             throw new ProtocolError('invalid_request', 'no such addressed delivery; use a recipient delivery ID for a group message');
@@ -877,34 +972,46 @@ export class RoomService {
         throw new ProtocolError('server_unavailable', 'request resolution could not be committed');
     }
     async setLocked(roomId, credential, locked) {
-        return this.applyOne(setLocked(await this.view(roomId), await hashCredential(credential), locked, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setLocked(await this.view(roomId), await hashCredential(credential), locked, this.ctx()));
+        });
     }
     async setMuted(roomId, credential, participantId, muted) {
-        return this.applyOne(setMuted(await this.view(roomId), await hashCredential(credential), participantId, muted, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setMuted(await this.view(roomId), await hashCredential(credential), participantId, muted, this.ctx()));
+        });
     }
     async setRole(roomId, credential, participantId, role) {
-        const mutation = setParticipantRole(await this.view(roomId), await hashCredential(credential), participantId, role, this.ctx());
-        if (mutation) {
-            await this.applyOne(mutation);
-        }
-        return this.snapshotOf(await this.view(roomId));
+        return retryRoomConflict(async () => {
+            const mutation = setParticipantRole(await this.view(roomId), await hashCredential(credential), participantId, role, this.ctx());
+            if (mutation) {
+                await this.applyOne(mutation);
+            }
+            return this.snapshotOf(await this.view(roomId));
+        });
     }
     async setRoomPermissions(roomId, credential, change) {
-        const mutation = setRoomPermissions(await this.view(roomId), await hashCredential(credential), change, this.ctx());
-        if (mutation) {
-            await this.applyOne(mutation);
-        }
-        return this.snapshotOf(await this.view(roomId));
+        return retryRoomConflict(async () => {
+            const mutation = setRoomPermissions(await this.view(roomId), await hashCredential(credential), change, this.ctx());
+            if (mutation) {
+                await this.applyOne(mutation);
+            }
+            return this.snapshotOf(await this.view(roomId));
+        });
     }
     async setParticipantPermissions(roomId, credential, participantId, change) {
-        const mutation = setParticipantPermissions(await this.view(roomId), await hashCredential(credential), participantId, change, this.ctx());
-        if (mutation) {
-            await this.applyOne(mutation);
-        }
-        return this.snapshotOf(await this.view(roomId));
+        return retryRoomConflict(async () => {
+            const mutation = setParticipantPermissions(await this.view(roomId), await hashCredential(credential), participantId, change, this.ctx());
+            if (mutation) {
+                await this.applyOne(mutation);
+            }
+            return this.snapshotOf(await this.view(roomId));
+        });
     }
     async control(roomId, credential, targetParticipantId, paused) {
-        return this.applyOne(requestControl(await this.view(roomId), await hashCredential(credential), targetParticipantId, paused, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(requestControl(await this.view(roomId), await hashCredential(credential), targetParticipantId, paused, this.ctx()));
+        });
     }
     /**
      * Stops one agent: holds its later work like a pause, then fences the turn it is
@@ -912,55 +1019,75 @@ export class RoomService {
      * actually stop. Other agents and the rest of a group round are not affected.
      */
     async interrupt(roomId, credential, targetParticipantId) {
-        const event = await this.applyOne(requestControl(await this.view(roomId), await hashCredential(credential), targetParticipantId, true, this.ctx(), true));
+        const event = await retryRoomConflict(async () => this.applyOne(requestControl(await this.view(roomId), await hashCredential(credential), targetParticipantId, true, this.ctx(), true)));
         const fenced = await this.turns.fenceRunning(roomId, credential, targetParticipantId);
         return { event, fenced };
     }
     async revoke(roomId, credential, targetParticipantId) {
-        return this.applyOne(revokeParticipant(await this.view(roomId), await hashCredential(credential), targetParticipantId, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(revokeParticipant(await this.view(roomId), await hashCredential(credential), targetParticipantId, this.ctx()));
+        });
     }
     async leave(roomId, credential) {
-        return this.applyOne(leaveRoom(await this.view(roomId), await hashCredential(credential), this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(leaveRoom(await this.view(roomId), await hashCredential(credential), this.ctx()));
+        });
     }
     async rejoin(roomId, credential) {
-        const view = await this.view(roomId);
-        const hash = await hashCredential(credential);
-        const actor = authenticate(view, hash, this.now());
-        if (actor.kind !== 'participant') {
-            throw new ProtocolError('unauthorized', 'rejoining requires the saved participant credential');
-        }
-        if (actor.participant.leftAt === null) {
-            return this.snapshotOf(view);
-        }
-        await this.applyOne(rejoinRoom(view, hash, this.ctx()));
-        return this.snapshot(roomId, credential);
+        return retryRoomConflict(async () => {
+            const view = await this.view(roomId);
+            const hash = await hashCredential(credential);
+            const actor = authenticate(view, hash, this.now());
+            if (actor.kind !== 'participant') {
+                throw new ProtocolError('unauthorized', 'rejoining requires the saved participant credential');
+            }
+            if (actor.participant.leftAt === null) {
+                return this.snapshotOf(view);
+            }
+            await this.applyOne(rejoinRoom(view, hash, this.ctx()));
+            return this.snapshot(roomId, credential);
+        });
     }
     async renameSelf(roomId, credential, input) {
-        const mutation = renameSelf(await this.view(roomId), await hashCredential(credential), input, this.ctx());
-        if (mutation) {
-            await this.applyOne(mutation);
-        }
-        return this.snapshot(roomId, credential);
+        return retryRoomConflict(async () => {
+            const mutation = renameSelf(await this.view(roomId), await hashCredential(credential), input, this.ctx());
+            if (mutation) {
+                await this.applyOne(mutation);
+            }
+            return this.snapshot(roomId, credential);
+        });
     }
     async rename(roomId, credential, name) {
-        return this.applyOne(renameRoom(await this.view(roomId), await hashCredential(credential), name, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(renameRoom(await this.view(roomId), await hashCredential(credential), name, this.ctx()));
+        });
     }
     async setJoinPolicy(roomId, credential, joinPolicy) {
-        return this.applyOne(setJoinPolicy(await this.view(roomId), await hashCredential(credential), joinPolicy, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setJoinPolicy(await this.view(roomId), await hashCredential(credential), joinPolicy, this.ctx()));
+        });
     }
     async setInviteRole(roomId, credential, inviteRole) {
-        return this.applyOne(setInviteRole(await this.view(roomId), await hashCredential(credential), inviteRole, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setInviteRole(await this.view(roomId), await hashCredential(credential), inviteRole, this.ctx()));
+        });
     }
     async setLocalJoin(roomId, credential, localJoin) {
-        return this.applyOne(setLocalJoin(await this.view(roomId), await hashCredential(credential), localJoin, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setLocalJoin(await this.view(roomId), await hashCredential(credential), localJoin, this.ctx()));
+        });
     }
     async setRoomType(roomId, credential, type) {
-        return this.applyOne(setRoomType(await this.view(roomId), await hashCredential(credential), type, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setRoomType(await this.view(roomId), await hashCredential(credential), type, this.ctx()));
+        });
     }
     /** Sets who sees the room; null when it already was. Owner or admin, on a room with an owner. */
     async setVisibility(roomId, credential, visibility) {
-        const mutation = setRoomVisibility(await this.view(roomId), await hashCredential(credential), visibility, this.ctx());
-        return mutation ? this.applyOne(mutation) : null;
+        return retryRoomConflict(async () => {
+            const mutation = setRoomVisibility(await this.view(roomId), await hashCredential(credential), visibility, this.ctx());
+            return mutation ? this.applyOne(mutation) : null;
+        });
     }
     /** Whether the member with this handle sees the room, after its owner's default. */
     async sees(room, handle) {
@@ -968,12 +1095,18 @@ export class RoomService {
     }
     /** Adds "invited @handle" or "withdrew the invitation" to the transcript. For relays that hold accounts; there is no HTTP route for it. */
     async recordInvitation(roomId, credential, change) {
-        return this.applyOne(recordInvitation(await this.view(roomId), await hashCredential(credential), change, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(recordInvitation(await this.view(roomId), await hashCredential(credential), change, this.ctx()));
+        });
     }
     /** Guest entry. Knowing the room id is the entire claim, so the room must allow it. */
     async joinAsGuest(roomId, input) {
         return this.joinWithoutInvite(roomId, input, joinAsGuest);
     }
+    /** A trusted account layer has already authorized this identity and role; ordinary room admission and retry rules still apply. */
+    async joinAuthorized(roomId, input, role) {
+        return this.joinWithoutInvite(roomId, input, (view, identity, context) => joinRoom(view, { ...identity, role }, context));
+    }
     /**
      * Member entry by name from the relay's local network or tailnet. Only call this
      * once the transport has established where the request came from; the room
@@ -988,34 +1121,40 @@ export class RoomService {
     }
     /** A retry with the same credential gets its original membership back instead of a second one. */
     async joinWithoutInvite(roomId, input, admit) {
-        const view = await this.view(roomId);
-        assertRoomJoinable(view, this.now());
-        const credentialHash = await hashCredential(input.participantCredential);
-        const existing = await this.store.participantByCredential(roomId, credentialHash);
-        if (existing) {
-            authenticate(view, credentialHash, this.now());
-            return { roomId, participantId: existing.participantId, role: existing.role, replayed: true, snapshot: this.snapshotOf(view) };
-        }
-        const joined = admit(view, {
-            credentialHash,
-            displayName: input.displayName,
-            kind: input.kind,
-            nameSource: input.nameSource,
-            sessionId: input.sessionId ?? null,
-            capabilities: input.capabilities ?? null,
-            ...(input.member ? { member: input.member } : {})
-        }, this.ctx());
-        await this.store.apply(joined.mutation, null);
-        return { roomId, participantId: joined.participant.participantId, role: joined.participant.role, replayed: false, snapshot: this.snapshotOf(await this.view(roomId)) };
+        return retryRoomConflict(async () => {
+            const view = await this.view(roomId);
+            assertRoomJoinable(view, this.now());
+            const credentialHash = await hashCredential(input.participantCredential);
+            const existing = await this.store.participantByCredential(roomId, credentialHash);
+            if (existing) {
+                assertActiveMember(authenticate(view, credentialHash, this.now()));
+                return { roomId, participantId: existing.participantId, role: existing.role, replayed: true, snapshot: this.snapshotOf(view) };
+            }
+            const joined = admit(view, {
+                credentialHash,
+                displayName: input.displayName,
+                kind: input.kind,
+                nameSource: input.nameSource,
+                sessionId: input.sessionId ?? null,
+                capabilities: input.capabilities ?? null,
+                ...(input.member ? { member: input.member } : {})
+            }, this.ctx());
+            await this.store.apply(joined.mutation, null);
+            return { roomId, participantId: joined.participant.participantId, role: joined.participant.role, replayed: false, snapshot: this.snapshotOf(await this.view(roomId)) };
+        });
     }
     async setExpiry(roomId, credential, expiresAt) {
-        return this.applyOne(setExpiry(await this.view(roomId), await hashCredential(credential), expiresAt, this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(setExpiry(await this.view(roomId), await hashCredential(credential), expiresAt, this.ctx()));
+        });
     }
     async setAutoClose(roomId, credential, autoClose) {
-        const event = await this.applyOne(setAutoClose(await this.view(roomId), await hashCredential(credential), autoClose, this.ctx()));
-        // A policy that is already overdue closes the room now rather than at the next request.
-        await this.store.loadRoom(roomId);
-        return event;
+        return retryRoomConflict(async () => {
+            const event = await this.applyOne(setAutoClose(await this.view(roomId), await hashCredential(credential), autoClose, this.ctx()));
+            // A policy that is already overdue closes the room now rather than at the next request.
+            await this.store.loadRoom(roomId);
+            return event;
+        });
     }
     /**
      * Closes rooms whose deadline has passed, in a bounded batch. Returns how many
@@ -1029,20 +1168,40 @@ export class RoomService {
                 closed++;
             }
         }
-        return { closed, more: due.length === limit, nextAt: await this.store.nextAutoCloseAt() };
+        return { closed, more: due.length === limit, nextAt: await this.store.nextAutoCloseAt(this.now()) };
     }
     async close(roomId, credential) {
-        return this.applyOne(closeRoom(await this.view(roomId), await hashCredential(credential), this.ctx()));
+        return retryRoomConflict(async () => {
+            return this.applyOne(closeRoom(await this.view(roomId), await hashCredential(credential), this.ctx()));
+        });
     }
-    async read(roomId, credential, after, limit, receiptsAfter) {
-        const view = await this.view(roomId);
-        authenticate(view, await hashCredential(credential), this.now());
+    async read(roomId, credential, after, limit, receiptsAfter, sync) {
+        return retryRoomConflict(() => this.readAttempt(roomId, credential, after, limit, receiptsAfter, sync));
+    }
+    async readAttempt(roomId, credential, after, limit, receiptsAfter, sync) {
+        const { head: view } = await this.reader(roomId, credential);
         if (after > 0 && after < view.earliestSeq - 1) {
             throw new ProtocolError('cursor_gap', 'history before this cursor is no longer retained', { earliestAvailableSeq: view.earliestSeq });
         }
-        const page = await this.store.readEvents(roomId, after, limit);
+        const page = await this.store.readEvents(roomId, after, limit, view.room.nextSeq - 1);
         const events = await Promise.all(page.events.map((event) => this.restoreAudience(event)));
-        return { events, earliestSeq: view.earliestSeq, latestSeq: view.room.nextSeq - 1, hasMore: page.hasMore, ...(receiptsAfter !== undefined && this.receiptMode !== 'events' ? receiptsSince(view.room, receiptsAfter) : {}) };
+        const metadata = {};
+        if (sync) {
+            metadata.stateRevision = view.room.stateRevision ?? 0;
+            metadata.requestRevision = view.room.requestRevision ?? 0;
+            metadata.snapshotRevision = view.room.snapshotRevision ?? 0;
+            metadata.turnRevision = view.room.turnRevision ?? 0;
+            metadata.autoCloseAt = view.room.autoCloseAt ?? null;
+            metadata.lastMessageAt = view.room.lastMessageAt ?? null;
+            if (sync.snapshotAfter === undefined || sync.snapshotAfter !== metadata.snapshotRevision) {
+                metadata.snapshot = this.snapshotOf(await this.view(roomId));
+            }
+            const current = await this.store.roomHead(roomId);
+            if (!current || (current.room.stateRevision ?? 0) !== metadata.stateRevision || current.earliestSeq !== view.earliestSeq) {
+                throw new ProtocolError('turn_conflict', 'the room changed during synchronization; retry');
+            }
+        }
+        return { events, earliestSeq: view.earliestSeq, latestSeq: view.room.nextSeq - 1, hasMore: page.hasMore, ...(receiptsAfter !== undefined && this.receiptMode !== 'events' ? receiptsSince(view.room, receiptsAfter) : {}), ...metadata };
     }
     /** Older group events kept the all flag only in their canonical idempotency request. */
     async restoreAudience(event) {
@@ -1067,22 +1226,41 @@ export class RoomService {
         authenticate(view, await hashCredential(credential), this.now());
         return this.snapshotOf(view);
     }
+    async connection(roomId, credential) {
+        const view = await this.view(roomId);
+        const participant = assertActiveMember(authenticate(view, await hashCredential(credential), this.now()));
+        assertRoomWritable(view, this.now());
+        return { snapshot: this.snapshotOf(view), participantId: participant.participantId };
+    }
+    /** Only a transport's authenticated ticket/socket attachment may supply this participant identity. */
+    async connectedSnapshot(roomId, participantId) {
+        const snapshot = await this.connectionAudience(roomId);
+        assertConnectedParticipant(snapshot, participantId);
+        return snapshot;
+    }
+    /** Trusted transport projection, loaded once for a broadcast; each attachment still needs participant authorization. */
+    async connectionAudience(roomId) {
+        const view = await this.view(roomId);
+        assertRoomReadable(view, this.now());
+        return this.snapshotOf(view);
+    }
     /** Returns the history the caller's room still retains, and says so when retention already dropped some. */
     async export(roomId, credential) {
+        const source = await this.exportSource(roomId, credential);
+        const events = [];
+        for await (const event of source.events) {
+            events.push(event);
+        }
+        return { ...source.metadata, events };
+    }
+    async exportStream(roomId, credential, format = 'json') {
+        return exportResponse(await this.exportSource(roomId, credential), format);
+    }
+    async exportSource(roomId, credential) {
         const view = await this.view(roomId);
         authenticate(view, await hashCredential(credential), this.now());
-        const collected = [];
-        let after = 0;
-        for (;;) {
-            const page = await this.store.readEvents(roomId, after, 500);
-            collected.push(...page.events);
-            if (!page.hasMore || page.events.length === 0) {
-                break;
-            }
-            after = page.events.at(-1).seq;
-        }
         const files = this.store.files ? { files: await this.roomFiles(this.store.files, roomId) } : {};
-        return { room: this.snapshotOf(view), events: collected, handovers: await this.store.handovers(roomId), exportedAt: this.now(), complete: view.earliestSeq <= 1, ...files };
+        return { metadata: { room: this.snapshotOf(view), handovers: await this.store.handovers(roomId), exportedAt: this.now(), complete: view.earliestSeq <= 1, ...files }, events: retainedEvents(this.store, roomId, view.earliestSeq, view.room.nextSeq - 1) };
     }
     /**
      * The agent a listing shares: the caller's own participant, an agent still in this open room.
@@ -1106,25 +1284,99 @@ export class RoomService {
     }
     /** Whether a listing of this participant still stands: the room open and unexpired, the agent still in it. */
     async listable(roomId, participantId) {
-        const view = await this.store.loadRoom(roomId);
-        const participant = view ? findParticipant(view, participantId) : undefined;
-        return Boolean(view && participant && roomType(view.room.policy) !== 'personal' && view.room.lifecycle === 'open' && (view.room.expiresAt === null || this.now() < view.room.expiresAt) && isActive(participant));
+        const view = await this.store.loadRoom(roomId, { handovers: false });
+        return Boolean(view && this.listableParticipant(view, participantId));
+    }
+    listableParticipant(view, participantId) {
+        const participant = findParticipant(view, participantId);
+        return Boolean(participant && roomType(view.room.policy) !== 'personal' && view.room.lifecycle === 'open' && (view.room.expiresAt === null || this.now() < view.room.expiresAt) && isActive(participant));
     }
     /** Makes the room inaccessible immediately; physical cleanup may lag. */
     async delete(roomId, credential) {
-        const view = await this.view(roomId);
-        const actor = authenticate(view, await hashCredential(credential), this.now());
-        if (actor.kind !== 'controller' && actor.participant.role !== 'controller') {
-            throw new ProtocolError('unauthorized', 'deleting a room requires the controller credential');
-        }
-        await this.store.setLifecycle(roomId, 'deleted');
-        await this.store.deleteRoom(roomId);
+        return retryRoomConflict(async () => {
+            const view = await this.view(roomId);
+            const actor = authenticate(view, await hashCredential(credential), this.now());
+            assertController(actor);
+            await this.store.setLifecycle(roomId, 'deleted', view.room.stateRevision ?? 0);
+            await this.store.deleteRoom(roomId);
+        });
     }
     async applyOne(mutation) {
         await this.store.apply(mutation, null);
         return mutation.appendEvent;
     }
 }
+function hexDigest(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/** Portable incremental verification for storage adapters, without retaining the binary body. */
+export async function sha256Stream(body) {
+    const reader = body.getReader();
+    const hash = sha256.create();
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                return { size, sha256: hexDigest(hash.digest()) };
+            }
+            size += value.byteLength;
+            hash.update(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+}
+/** Never retain more than one storage chunk in addition to the transport's current input chunk. */
+async function consumeUpload(upload, write) {
+    const reader = upload.body.getReader();
+    const abort = () => { void reader.cancel(upload.signal?.reason).catch(() => { }); };
+    upload.signal?.addEventListener('abort', abort, { once: true });
+    let total = 0;
+    let used = 0;
+    let buffer = new Uint8Array(Math.min(FILE_CHUNK_BYTES, upload.size));
+    try {
+        for (;;) {
+            upload.signal?.throwIfAborted();
+            const { done, value } = await reader.read();
+            upload.signal?.throwIfAborted();
+            if (done) {
+                break;
+            }
+            total += value.byteLength;
+            if (total > upload.size) {
+                throw new ProtocolError('payload_too_large', 'the file is longer than its declared byte length');
+            }
+            for (let offset = 0; offset < value.byteLength;) {
+                const length = Math.min(buffer.byteLength - used, value.byteLength - offset);
+                buffer.set(value.subarray(offset, offset + length), used);
+                offset += length;
+                used += length;
+                if (used === buffer.byteLength) {
+                    await write(buffer);
+                    buffer = new Uint8Array(FILE_CHUNK_BYTES);
+                    used = 0;
+                }
+            }
+        }
+        if (total !== upload.size) {
+            throw new ProtocolError('invalid_request', 'the file is shorter than its declared byte length');
+        }
+        if (used > 0) {
+            await write(buffer.subarray(0, used));
+        }
+    }
+    catch (error) {
+        await reader.cancel(error).catch(() => { });
+        throw error;
+    }
+    finally {
+        upload.signal?.removeEventListener('abort', abort);
+        reader.releaseLock();
+    }
+}
 function toAttachment(file) {
     return { fileId: file.fileId, name: file.name, size: file.size, mediaType: file.mediaType, sha256: file.sha256 };
 }