@powerhousedao/reactor-attachments 6.2.2-dev.5 → 6.2.2-dev.50

package/dist/index.js

@@ -1,10 +1,17 @@
-import { _ as SizeMismatch, a as RemoteAttachmentUpload, c as AttachmentService, d as AttachmentAlreadyExists, f as AttachmentNotFound, g as ReservationNotFound, h as InvalidAttachmentRef, i as RemoteAttachmentUploadFactory, l as createRef, m as HashMismatch, n as createRemoteAttachmentService, o as RemoteReservationStore, p as AttachmentPending, r as RemoteAttachmentStore, s as SwitchboardAttachmentTransport, t as NullAttachmentTransport, u as parseRef, v as UploadTooLarge } from "./null-attachment-transport-Drx03s02.js";
+import { _ as HashMismatch, a as RemoteAttachmentUpload, b as SizeMismatch, c as AttachmentService, d as parseAttachmentDownloadTarget, f as parseAttachmentUploadTarget, g as AttachmentTransferError, h as AttachmentPending, i as RemoteAttachmentUploadFactory, l as createRef, m as AttachmentNotFound, n as createRemoteAttachmentService, o as RemoteReservationStore, p as AttachmentAlreadyExists, r as RemoteAttachmentStore, s as SwitchboardAttachmentTransport, t as NullAttachmentTransport, u as parseRef, v as InvalidAttachmentRef, x as UploadTooLarge, y as ReservationNotFound } from "./null-attachment-transport-CTBrRCDe.js";
 import { dirname, join } from "node:path";
 import { Migrator, sql } from "kysely";
 import { mkdir, rename, rm } from "node:fs/promises";
 import { createReadStream, createWriteStream } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { Readable } from "node:stream";
+import { generatorTypeDefs } from "@powerhousedao/document-engineering/graphql";
+import { constantCase, pascalCase } from "change-case";
+import { Kind, buildASTSchema, getNamedType, isInputObjectType, isListType, isNonNullType, parse } from "graphql";
+import { BaseReadModel } from "@powerhousedao/reactor";
+import { Buffer as Buffer$1 } from "node:buffer";
+import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -391,84 +398,84 @@ var KyselyReservationStore = class {
 //#endregion
 //#region src/storage/migrations/001_create_attachment_table.ts
 var _001_create_attachment_table_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$6,
+	up: () => up$6
 });
-async function up$5(db) {
+async function up$6(db) {
 	await db.schema.createTable("attachment").addColumn("hash", "text", (col) => col.primaryKey()).addColumn("mime_type", "text", (col) => col.notNull()).addColumn("file_name", "text", (col) => col.notNull()).addColumn("size_bytes", "bigint", (col) => col.notNull()).addColumn("extension", "text").addColumn("status", "text", (col) => col.notNull().defaultTo("available")).addColumn("storage_path", "text", (col) => col.notNull()).addColumn("source", "text", (col) => col.notNull().defaultTo("local")).addColumn("created_at_utc", "text", (col) => col.notNull()).addColumn("last_accessed_at_utc", "text", (col) => col.notNull()).execute();
 	await db.schema.createIndex("idx_attachment_status").on("attachment").column("status").execute();
 	await db.schema.createIndex("idx_attachment_lru").on("attachment").columns(["status", "last_accessed_at_utc"]).execute();
 }
-async function down$5(db) {
+async function down$6(db) {
 	await db.schema.dropTable("attachment").ifExists().execute();
 }
 //#endregion
 //#region src/storage/migrations/002_create_reservation_table.ts
 var _002_create_reservation_table_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$5,
+	up: () => up$5
 });
-async function up$4(db) {
+async function up$5(db) {
 	await db.schema.createTable("attachment_reservation").addColumn("reservation_id", "text", (col) => col.primaryKey()).addColumn("mime_type", "text", (col) => col.notNull()).addColumn("file_name", "text", (col) => col.notNull()).addColumn("extension", "text").addColumn("created_at_utc", "text", (col) => col.notNull()).execute();
 }
-async function down$4(db) {
+async function down$5(db) {
 	await db.schema.dropTable("attachment_reservation").ifExists().execute();
 }
 //#endregion
 //#region src/storage/migrations/003_add_reservation_expires_at.ts
 var _003_add_reservation_expires_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
-async function up$3(db) {
+async function up$4(db) {
 	await db.schema.alterTable("attachment_reservation").addColumn("expires_at_utc", "text").execute();
 	await db.updateTable("attachment_reservation").set({ expires_at_utc: sql`created_at_utc` }).where("expires_at_utc", "is", null).execute();
 	await db.schema.alterTable("attachment_reservation").alterColumn("expires_at_utc", (col) => col.setNotNull()).execute();
 	await db.schema.createIndex("idx_reservation_expires_at").on("attachment_reservation").column("expires_at_utc").execute();
 }
-async function down$3(db) {
+async function down$4(db) {
 	await db.schema.dropIndex("idx_reservation_expires_at").ifExists().execute();
 	await db.schema.alterTable("attachment_reservation").dropColumn("expires_at_utc").execute();
 }
 //#endregion
 //#region src/storage/migrations/004_add_reservation_soft_delete.ts
 var _004_add_reservation_soft_delete_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
-async function up$2(db) {
+async function up$3(db) {
 	await db.schema.alterTable("attachment_reservation").addColumn("deleted_at_utc", "text").execute();
 }
-async function down$2(db) {
+async function down$3(db) {
 	await db.schema.alterTable("attachment_reservation").dropColumn("deleted_at_utc").execute();
 }
 //#endregion
 //#region src/storage/migrations/005_add_reservation_active_index.ts
 var _005_add_reservation_active_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
-async function up$1(db) {
+async function up$2(db) {
 	await db.schema.dropIndex("idx_reservation_expires_at").ifExists().execute();
 	await db.schema.createIndex("idx_reservation_expires_at_active").on("attachment_reservation").column("expires_at_utc").where(sql`deleted_at_utc IS NULL`).execute();
 }
-async function down$1(db) {
+async function down$2(db) {
 	await db.schema.dropIndex("idx_reservation_expires_at_active").ifExists().execute();
 	await db.schema.createIndex("idx_reservation_expires_at").on("attachment_reservation").column("expires_at_utc").execute();
 }
 //#endregion
 //#region src/storage/migrations/006_add_reservation_client_hash.ts
 var _006_add_reservation_client_hash_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
-async function up(db) {
+async function up$1(db) {
 	await db.schema.alterTable("attachment_reservation").addColumn("client_hash", "text").execute();
 	await db.schema.alterTable("attachment_reservation").addColumn("size_bytes", "bigint").execute();
 	await db.schema.alterTable("attachment_reservation").addCheckConstraint("attachment_reservation_hash_size_check", sql`client_hash is null or size_bytes is not null`).execute();
 	await db.schema.createIndex("idx_reservation_client_hash").on("attachment_reservation").column("client_hash").execute();
 }
-async function down(db) {
+async function down$1(db) {
 	await db.schema.dropIndex("idx_reservation_client_hash").ifExists().execute();
 	await db.schema.alterTable("attachment_reservation").dropColumn("size_bytes").execute();
 	await db.schema.alterTable("attachment_reservation").dropColumn("client_hash").execute();
@@ -476,7 +483,7 @@ async function down(db) {
 //#endregion
 //#region src/storage/migrations/migrator.ts
 const ATTACHMENT_SCHEMA = "attachments";
-const migrations = {
+const migrations$1 = {
 	"001_create_attachment_table": _001_create_attachment_table_exports,
 	"002_create_reservation_table": _002_create_reservation_table_exports,
 	"003_add_reservation_expires_at": _003_add_reservation_expires_at_exports,
@@ -484,9 +491,9 @@ const migrations = {
 	"005_add_reservation_active_index": _005_add_reservation_active_index_exports,
 	"006_add_reservation_client_hash": _006_add_reservation_client_hash_exports
 };
-var ProgrammaticMigrationProvider = class {
+var ProgrammaticMigrationProvider$1 = class {
 	getMigrations() {
-		return Promise.resolve(migrations);
+		return Promise.resolve(migrations$1);
 	}
 };
 async function runAttachmentMigrations(db, schema = ATTACHMENT_SCHEMA) {
@@ -501,7 +508,7 @@ async function runAttachmentMigrations(db, schema = ATTACHMENT_SCHEMA) {
 	}
 	const migrator = new Migrator({
 		db: db.withSchema(schema),
-		provider: new ProgrammaticMigrationProvider(),
+		provider: new ProgrammaticMigrationProvider$1(),
 		migrationTableSchema: schema
 	});
 	let error;
@@ -621,12 +628,69 @@ var DirectAttachmentUploadFactory = class {
 	}
 };
 //#endregion
+//#region src/direct/filesystem-attachment-backend.ts
+/**
+* Filesystem keeps byte transfer behind Switchboard. URL construction stays
+* at the server edge, while this adapter validates that a filesystem backend
+* can never accidentally return a direct-provider target.
+*/
+var FilesystemAttachmentBackend = class {
+	kind = "filesystem";
+	constructor(store, config) {
+		this.store = store;
+		this.config = config;
+	}
+	async prepareUploadTarget(reservation) {
+		const target = parseAttachmentUploadTarget(await this.config.uploadTarget(reservation));
+		if (target.kind !== "switchboard") throw new Error("Filesystem upload target must use Switchboard");
+		return target;
+	}
+	async prepareDownloadTarget(hash) {
+		const target = parseAttachmentDownloadTarget(await this.config.downloadTarget(hash));
+		if (target.kind !== "switchboard") throw new Error("Filesystem download target must use Switchboard");
+		return target;
+	}
+	exists(hash) {
+		return this.store.has(hash);
+	}
+	async health() {
+		return {
+			kind: this.kind,
+			ready: await (this.config.readiness?.() ?? true)
+		};
+	}
+};
+//#endregion
+//#region src/storage/s3/upload-factory.ts
+var S3AttachmentUpload = class {
+	reservationId;
+	ref;
+	expiresAtUtc;
+	uploadTarget;
+	constructor(reservation) {
+		this.reservationId = reservation.reservationId;
+		this.ref = reservation.clientHash === null ? null : createRef(reservation.clientHash);
+		this.expiresAtUtc = reservation.expiresAtUtc;
+		this.uploadTarget = reservation.uploadTarget;
+	}
+	async send(data) {
+		await data.cancel().catch(() => {});
+		throw new Error("S3 attachment upload must use the presigned target");
+	}
+};
+var S3AttachmentUploadFactory = class {
+	createUpload(reservation) {
+		return new S3AttachmentUpload(reservation);
+	}
+};
+//#endregion
 //#region src/attachment-builder.ts
 var AttachmentBuilder = class {
 	transport = new NullAttachmentTransport();
 	customUploadFactory;
 	maxUploadBytes;
 	reservationSweepMs;
+	backend;
 	constructor(db, storagePath) {
 		this.db = db;
 		this.storagePath = storagePath;
@@ -639,6 +703,10 @@ var AttachmentBuilder = class {
 		this.customUploadFactory = factory;
 		return this;
 	}
+	withBackend(backend) {
+		this.backend = backend;
+		return this;
+	}
 	withMaxUploadBytes(maxBytes) {
 		this.maxUploadBytes = maxBytes;
 		return this;
@@ -661,8 +729,8 @@ var AttachmentBuilder = class {
 		const scopedDb = this.db.withSchema(ATTACHMENT_SCHEMA);
 		const store = new KyselyAttachmentStore(scopedDb, this.transport, this.storagePath);
 		const reservations = new KyselyReservationStore(scopedDb);
-		const uploadFactory = this.customUploadFactory ?? new DirectAttachmentUploadFactory(scopedDb, this.storagePath, reservations, this.maxUploadBytes);
-		const service = new AttachmentService(store, reservations, uploadFactory);
+		const uploadFactory = this.customUploadFactory ?? (this.backend?.kind === "s3" ? new S3AttachmentUploadFactory() : new DirectAttachmentUploadFactory(scopedDb, this.storagePath, reservations, this.maxUploadBytes));
+		const service = new AttachmentService(store, reservations, uploadFactory, this.backend);
 		let sweepTimer;
 		if (this.reservationSweepMs !== void 0) {
 			const intervalMs = this.reservationSweepMs;
@@ -682,11 +750,728 @@ var AttachmentBuilder = class {
 			store,
 			reservations,
 			uploadFactory,
+			...this.backend ? { backend: this.backend } : {},
 			destroy
 		};
 	}
 };
 //#endregion
-export { ATTACHMENT_SCHEMA, AttachmentAlreadyExists, AttachmentBuilder, AttachmentNotFound, AttachmentPending, AttachmentService, DEFAULT_RESERVATION_TTL_MS, DirectAttachmentUpload, DirectAttachmentUploadFactory, HashMismatch, InvalidAttachmentRef, KyselyAttachmentStore, KyselyReservationStore, NullAttachmentTransport, RemoteAttachmentStore, RemoteAttachmentUpload, RemoteAttachmentUploadFactory, RemoteReservationStore, ReservationNotFound, SizeMismatch, SwitchboardAttachmentTransport, UploadTooLarge, createRef, createRemoteAttachmentService, parseRef, runAttachmentMigrations };
+//#region src/reference-index/attachment-schema-compiler.ts
+const ATTACHMENT_REF_TYPE = "AttachmentRef";
+const CODEGEN_SCALAR_NAMES = new Set([
+	"Unknown",
+	"DateTime",
+	"Address",
+	ATTACHMENT_REF_TYPE,
+	...Object.keys(generatorTypeDefs)
+]);
+function describeContext(context) {
+	return `document type "${context.documentType}", version ${context.version}, action "${context.actionType}"`;
+}
+function compilationError(context, reason) {
+	return /* @__PURE__ */ new Error(`Attachment schema compilation failed for ${describeContext(context)}: ${reason}`);
+}
+function extractionError(context, path, reason) {
+	return /* @__PURE__ */ new Error(`Attachment extraction failed for ${describeContext(context)} at ${path}: ${reason}`);
+}
+function applicableSpecification(module, context) {
+	const matches = module.documentModel.global.specifications.filter((specification) => specification.version === context.version);
+	if (matches.length !== 1) throw compilationError(context, matches.length === 0 ? "the module has no matching specification" : "the module has multiple matching specifications");
+	return matches[0];
+}
+function parseOperations(specification, context) {
+	return specification.modules.flatMap((moduleSpecification) => moduleSpecification.operations.map((operation) => {
+		if (operation.schema === null) return {
+			document: null,
+			operation
+		};
+		try {
+			return {
+				document: parse(operation.schema),
+				operation
+			};
+		} catch {
+			throw compilationError(context, "an operation has invalid GraphQL SDL");
+		}
+	}));
+}
+function selectOperation(operations, context) {
+	const matches = operations.filter(({ operation }) => operation.name !== null && constantCase(operation.name) === context.actionType);
+	if (matches.length > 1) throw compilationError(context, "multiple operations map to the action");
+	if (matches.length === 0) return null;
+	return matches[0];
+}
+function buildEffectiveSchema(specification, context) {
+	const scalarSchemas = Array.from(CODEGEN_SCALAR_NAMES, (name) => `scalar ${name}`);
+	const stateSchemas = Object.values(specification.state).map((state) => state.schema);
+	const operationSchemas = specification.modules.flatMap((moduleSpecification) => moduleSpecification.operations.flatMap((operation) => operation.schema === null ? [] : [operation.schema]));
+	try {
+		return buildASTSchema(parse([
+			...scalarSchemas,
+			...stateSchemas,
+			...operationSchemas
+		].filter(Boolean).join("\n\n")));
+	} catch {
+		throw compilationError(context, "the effective GraphQL schema is invalid");
+	}
+}
+function attachmentReachableTypes(definitions) {
+	const reachable = /* @__PURE__ */ new Set();
+	let changed = true;
+	while (changed) {
+		changed = false;
+		for (const [name, definition] of definitions) {
+			if (reachable.has(name)) continue;
+			if (Object.values(definition.getFields()).some((field) => {
+				const typeName = getNamedType(field.type).name;
+				return typeName === ATTACHMENT_REF_TYPE || definitions.has(typeName) && reachable.has(typeName);
+			})) {
+				reachable.add(name);
+				changed = true;
+			}
+		}
+	}
+	return reachable;
+}
+function compileValuePlan(type, objectPlans) {
+	if (isNonNullType(type)) return {
+		...compileValuePlan(type.ofType, objectPlans),
+		required: true
+	};
+	if (isListType(type)) return {
+		item: compileValuePlan(type.ofType, objectPlans),
+		kind: "list",
+		required: false
+	};
+	const typeName = type.name;
+	if (typeName === ATTACHMENT_REF_TYPE) return {
+		kind: "attachment",
+		required: false
+	};
+	const body = objectPlans.get(typeName);
+	if (!body) throw new Error(`Internal attachment schema plan error for ${typeName}`);
+	return {
+		body,
+		kind: "object",
+		required: false
+	};
+}
+function compileRootPlan(rootName, definitions) {
+	const reachable = attachmentReachableTypes(definitions);
+	if (!reachable.has(rootName)) return null;
+	const objectPlans = /* @__PURE__ */ new Map();
+	for (const name of reachable) objectPlans.set(name, { fields: [] });
+	for (const name of reachable) {
+		const definition = definitions.get(name);
+		const body = objectPlans.get(name);
+		if (!definition || !body) continue;
+		for (const field of Object.values(definition.getFields())) {
+			const typeName = getNamedType(field.type).name;
+			if (typeName !== ATTACHMENT_REF_TYPE && !reachable.has(typeName)) continue;
+			body.fields.push({
+				hasDefault: field.defaultValue !== void 0,
+				name: field.name,
+				value: compileValuePlan(field.type, objectPlans)
+			});
+		}
+	}
+	return objectPlans.get(rootName) ?? null;
+}
+function readOwnField(value, fieldName, context, path) {
+	try {
+		if (!Object.prototype.hasOwnProperty.call(value, fieldName)) return {
+			present: false,
+			value: void 0
+		};
+		return {
+			present: true,
+			value: value[fieldName]
+		};
+	} catch {
+		throw extractionError(context, path, "the declared field cannot be read");
+	}
+}
+function extractValue(plan, value, path, context, refs, seenRefs, activeObjects) {
+	if (value === null || value === void 0) {
+		if (plan.required) throw extractionError(context, path, "a required value is missing or null");
+		return;
+	}
+	if (plan.kind === "attachment") {
+		if (typeof value !== "string") throw extractionError(context, path, "expected an AttachmentRef string");
+		try {
+			parseRef(value);
+		} catch {
+			throw extractionError(context, path, "the AttachmentRef is malformed");
+		}
+		if (!seenRefs.has(value)) {
+			seenRefs.add(value);
+			refs.push(value);
+		}
+		return;
+	}
+	if (plan.kind === "list") {
+		if (!Array.isArray(value)) throw extractionError(context, path, "expected a list");
+		for (let index = 0; index < value.length; index += 1) extractValue(plan.item, value[index], `${path}[${index}]`, context, refs, seenRefs, activeObjects);
+		return;
+	}
+	if (typeof value !== "object" || Array.isArray(value)) throw extractionError(context, path, "expected an input object");
+	if (activeObjects.has(value)) throw extractionError(context, path, "the input value contains a cycle");
+	activeObjects.add(value);
+	try {
+		const record = value;
+		for (const field of plan.body.fields) {
+			const fieldPath = `${path}.${field.name}`;
+			const result = readOwnField(record, field.name, context, fieldPath);
+			if ((!result.present || result.value === void 0) && field.hasDefault) continue;
+			extractValue(field.value, result.value, fieldPath, context, refs, seenRefs, activeObjects);
+		}
+	} finally {
+		activeObjects.delete(value);
+	}
+}
+var SchemaCompiledAttachmentExtractor = class {
+	constructor(context, rootPlan) {
+		this.context = context;
+		this.rootPlan = rootPlan;
+	}
+	extract(action) {
+		if (action.type !== this.context.actionType) throw extractionError(this.context, "input", "the action type does not match the compiled schema");
+		if (!this.rootPlan) return [];
+		if (action.input === null || typeof action.input !== "object" || Array.isArray(action.input)) throw extractionError(this.context, "input", "expected an input object");
+		const refs = [];
+		const seenRefs = /* @__PURE__ */ new Set();
+		const activeObjects = /* @__PURE__ */ new WeakSet();
+		activeObjects.add(action.input);
+		try {
+			const input = action.input;
+			for (const field of this.rootPlan.fields) {
+				const path = `input.${field.name}`;
+				const result = readOwnField(input, field.name, this.context, path);
+				if ((!result.present || result.value === void 0) && field.hasDefault) continue;
+				extractValue(field.value, result.value, path, this.context, refs, seenRefs, activeObjects);
+			}
+		} finally {
+			activeObjects.delete(action.input);
+		}
+		return refs;
+	}
+};
+function compileExtractor(module, actionType) {
+	const context = {
+		actionType,
+		documentType: module.documentModel.global.id,
+		version: module.version ?? 1
+	};
+	const specification = applicableSpecification(module, context);
+	const selected = selectOperation(parseOperations(specification, context), context);
+	if (selected === null || selected.operation.schema === null) return new SchemaCompiledAttachmentExtractor(context, null);
+	const effectiveSchema = buildEffectiveSchema(specification, context);
+	const operationName = selected.operation.name;
+	if (operationName === null) throw compilationError(context, "the operation has no name");
+	const rootName = `${pascalCase(operationName)}Input`;
+	const definitions = /* @__PURE__ */ new Map();
+	for (const type of Object.values(effectiveSchema.getTypeMap())) if (isInputObjectType(type) && !type.name.startsWith("__")) definitions.set(type.name, type);
+	if (!(selected.document?.definitions.filter((definition) => (definition.kind === Kind.INPUT_OBJECT_TYPE_DEFINITION || definition.kind === Kind.INPUT_OBJECT_TYPE_EXTENSION) && definition.name.value === rootName))?.length || !definitions.has(rootName)) throw compilationError(context, `the operation does not declare its expected root input "${rootName}"`);
+	return new SchemaCompiledAttachmentExtractor(context, compileRootPlan(rootName, definitions));
+}
+var AttachmentSchemaCompiler = class {
+	cache = /* @__PURE__ */ new WeakMap();
+	forModuleAction(module, actionType) {
+		let moduleCache = this.cache.get(module);
+		if (!moduleCache) {
+			moduleCache = /* @__PURE__ */ new Map();
+			this.cache.set(module, moduleCache);
+		}
+		const cached = moduleCache.get(actionType);
+		if (cached) return cached;
+		const compiled = compileExtractor(module, actionType);
+		moduleCache.set(actionType, compiled);
+		return compiled;
+	}
+};
+//#endregion
+//#region src/read-models/attachment-reference/kysely-attachment-reference-store.ts
+var KyselyAttachmentReferenceStore = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async hasReference(documentId, ref) {
+		return await this.db.selectFrom("attachment_reference").select("document_id").where("document_id", "=", documentId).where("attachment_ref", "=", ref).executeTakeFirst() !== void 0;
+	}
+	async addReferences(references) {
+		if (references.length === 0) return;
+		await this.db.insertInto("attachment_reference").values(references.map((reference) => ({
+			document_id: reference.documentId,
+			attachment_ref: reference.ref,
+			attachment_hash: parseRef(reference.ref).hash,
+			first_operation_id: reference.operationId,
+			branch: reference.branch,
+			scope: reference.scope,
+			first_seen_ordinal: reference.ordinal,
+			created_at_utc: (/* @__PURE__ */ new Date()).toISOString()
+		}))).onConflict((oc) => oc.columns(["document_id", "attachment_ref"]).doNothing()).execute();
+	}
+};
+//#endregion
+//#region src/read-models/attachment-reference/storage/migrations/001_create_attachment_reference_table.ts
+var _001_create_attachment_reference_table_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+async function up(db) {
+	await db.schema.createTable("attachment_reference").addColumn("document_id", "text", (col) => col.notNull()).addColumn("attachment_ref", "text", (col) => col.notNull()).addColumn("attachment_hash", "text", (col) => col.notNull()).addColumn("first_operation_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("first_seen_ordinal", "integer", (col) => col.notNull()).addColumn("created_at_utc", "text", (col) => col.notNull()).addUniqueConstraint("unique_attachment_reference_document_ref", ["document_id", "attachment_ref"]).execute();
+	await db.schema.createIndex("idx_attachment_reference_ref").on("attachment_reference").column("attachment_ref").execute();
+	await db.schema.createIndex("idx_attachment_reference_hash").on("attachment_reference").column("attachment_hash").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("attachment_reference").ifExists().execute();
+}
+//#endregion
+//#region src/read-models/attachment-reference/storage/migrations/migrator.ts
+const ATTACHMENT_REFERENCE_SCHEMA = "attachment_reference_read_model";
+const ATTACHMENT_REFERENCE_MIGRATION_TABLE = "kysely_migration_attachment_reference_read_model";
+const ATTACHMENT_REFERENCE_MIGRATION_LOCK_TABLE = "kysely_migration_attachment_reference_read_model_lock";
+const migrations = { "001_create_attachment_reference_table": _001_create_attachment_reference_table_exports };
+var ProgrammaticMigrationProvider = class {
+	getMigrations() {
+		return Promise.resolve(migrations);
+	}
+};
+function createMigrator(db, schema) {
+	return new Migrator({
+		db: db.withSchema(schema),
+		provider: new ProgrammaticMigrationProvider(),
+		migrationTableSchema: schema,
+		migrationTableName: ATTACHMENT_REFERENCE_MIGRATION_TABLE,
+		migrationLockTableName: ATTACHMENT_REFERENCE_MIGRATION_LOCK_TABLE
+	});
+}
+function toResult(error, results) {
+	const migrationsExecuted = results?.map((result) => result.migrationName) ?? [];
+	if (error) return {
+		success: false,
+		migrationsExecuted,
+		error: error instanceof Error ? error : /* @__PURE__ */ new Error("Unknown migration error")
+	};
+	return {
+		success: true,
+		migrationsExecuted
+	};
+}
+async function runAttachmentReferenceMigrations(db, schema = ATTACHMENT_REFERENCE_SCHEMA) {
+	try {
+		await sql`CREATE SCHEMA IF NOT EXISTS ${sql.id(schema)}`.execute(db);
+	} catch (error) {
+		return {
+			success: false,
+			migrationsExecuted: [],
+			error: error instanceof Error ? error : /* @__PURE__ */ new Error("Failed to create schema")
+		};
+	}
+	try {
+		const { error, results } = await createMigrator(db, schema).migrateToLatest();
+		return toResult(error, results);
+	} catch (error) {
+		return toResult(error, []);
+	}
+}
+async function rollbackAttachmentReferenceMigration(db, schema = ATTACHMENT_REFERENCE_SCHEMA) {
+	try {
+		const { error, results } = await createMigrator(db, schema).migrateDown();
+		return toResult(error, results);
+	} catch (error) {
+		return toResult(error, []);
+	}
+}
+async function getAttachmentReferenceMigrationStatus(db, schema = ATTACHMENT_REFERENCE_SCHEMA) {
+	return await createMigrator(db, schema).getMigrations();
+}
+//#endregion
+//#region src/read-models/attachment-reference/index-builder.ts
+var AttachmentReferenceIndexBuilder = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async build() {
+		const result = await runAttachmentReferenceMigrations(this.db);
+		if (!result.success && result.error) throw result.error;
+		return { store: new KyselyAttachmentReferenceStore(this.db.withSchema(ATTACHMENT_REFERENCE_SCHEMA)) };
+	}
+};
+//#endregion
+//#region src/read-models/attachment-reference/attachment-reference-read-model.ts
+const ATTACHMENT_REFERENCE_READ_MODEL_ID = "attachment-reference-read-model";
+var AttachmentReferenceReadModel = class extends BaseReadModel {
+	indexingQueue = Promise.resolve();
+	constructor(db, operationIndex, writeCache, consistencyTracker, documentModelRegistry, schemaCompiler, referenceWriter) {
+		super(db, operationIndex, writeCache, consistencyTracker, {
+			readModelId: ATTACHMENT_REFERENCE_READ_MODEL_ID,
+			rebuildStateOnInit: false
+		});
+		this.documentModelRegistry = documentModelRegistry;
+		this.schemaCompiler = schemaCompiler;
+		this.referenceWriter = referenceWriter;
+	}
+	indexOperations(items) {
+		return this.enqueue(() => this.indexOperationsInOrdinalOrder(items));
+	}
+	init() {
+		return this.enqueue(async () => {
+			const viewState = await this.loadState();
+			if (viewState !== void 0) this.lastOrdinal = viewState;
+			else await this.initializeState();
+			let page = await this.operationIndex.getSinceOrdinal(this.lastOrdinal);
+			while (page.results.length > 0) {
+				await this.indexOperationsInOrdinalOrder(page.results);
+				if (!page.next) break;
+				page = await page.next();
+			}
+		});
+	}
+	enqueue(work) {
+		const result = this.indexingQueue.then(work);
+		this.indexingQueue = result.catch(() => void 0);
+		return result;
+	}
+	async commitOperations(items) {
+		const references = [];
+		for (const { operation, context } of items) {
+			if (operation.error !== void 0) continue;
+			const module = this.documentModelRegistry.getModule(context.documentType);
+			const refs = this.schemaCompiler.forModuleAction(module, operation.action.type).extract(operation.action);
+			for (const ref of refs) references.push({
+				documentId: context.documentId,
+				ref,
+				operationId: operation.id,
+				branch: context.branch,
+				scope: context.scope,
+				ordinal: context.ordinal
+			});
+		}
+		if (references.length > 0) await this.referenceWriter.addReferences(references);
+	}
+	async indexOperationsInOrdinalOrder(incoming) {
+		const pending = this.sortAndDedupe(incoming.filter(({ context }) => context.ordinal > this.lastOrdinal));
+		if (pending.length === 0) return;
+		const incomingMax = pending[pending.length - 1].context.ordinal;
+		let candidates = pending;
+		if (!this.isContiguousThrough(candidates, incomingMax)) {
+			const replayed = await this.loadThroughOrdinal(incomingMax);
+			candidates = this.sortAndDedupe([...replayed, ...pending]);
+		}
+		const contiguous = [];
+		let expectedOrdinal = this.lastOrdinal + 1;
+		for (const item of candidates) {
+			const ordinal = item.context.ordinal;
+			if (ordinal < expectedOrdinal) continue;
+			if (ordinal > expectedOrdinal || ordinal > incomingMax) break;
+			contiguous.push(item);
+			expectedOrdinal++;
+		}
+		if (expectedOrdinal <= incomingMax) throw new Error(`Attachment reference read model cannot advance past missing ordinal ${expectedOrdinal}`);
+		const previousOrdinal = this.lastOrdinal;
+		try {
+			await super.indexOperations(contiguous);
+		} catch (error) {
+			this.lastOrdinal = previousOrdinal;
+			throw error;
+		}
+	}
+	isContiguousThrough(items, maxOrdinal) {
+		let expectedOrdinal = this.lastOrdinal + 1;
+		for (const item of items) {
+			if (item.context.ordinal !== expectedOrdinal) return false;
+			expectedOrdinal++;
+		}
+		return expectedOrdinal > maxOrdinal;
+	}
+	async loadThroughOrdinal(maxOrdinal) {
+		const operations = [];
+		let page = await this.operationIndex.getSinceOrdinal(this.lastOrdinal);
+		for (;;) {
+			for (const item of page.results) if (item.context.ordinal <= maxOrdinal) operations.push(item);
+			if (page.results.some(({ context }) => context.ordinal >= maxOrdinal) || !page.next) break;
+			page = await page.next();
+		}
+		return operations;
+	}
+	sortAndDedupe(items) {
+		const byOrdinal = /* @__PURE__ */ new Map();
+		for (const item of items) byOrdinal.set(item.context.ordinal, item);
+		return [...byOrdinal.values()].sort((left, right) => left.context.ordinal - right.context.ordinal);
+	}
+};
+//#endregion
+//#region src/storage/s3/config.ts
+const DEFAULT_S3_ATTACHMENT_PREFIX = "attachments";
+const DEFAULT_S3_UPLOAD_TTL_SECONDS = 900;
+const DEFAULT_S3_DOWNLOAD_TTL_SECONDS = 300;
+const MAX_S3_PRESIGN_TTL_SECONDS = 604800;
+function required(env, name) {
+	const value = env[name];
+	if (value === void 0 || value.trim().length === 0) throw new Error(`${name} is required and must not be blank`);
+	if (value.trim() !== value) throw new Error(`${name} must not have leading or trailing whitespace`);
+	return value;
+}
+const LOOPBACK_HOSTNAMES = new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/** Plain HTTP is allowed only for loopback hosts (local S3 emulators). */
+function isLoopbackHost(endpoint) {
+	return LOOPBACK_HOSTNAMES.has(endpoint.hostname.toLowerCase());
+}
+function parseEndpoint(value) {
+	const message = "PH_ATTACHMENT_S3_ENDPOINT must be a valid HTTPS URL (HTTP is allowed only for loopback hosts)";
+	let endpoint;
+	try {
+		endpoint = new URL(value);
+	} catch {
+		throw new Error(message);
+	}
+	const protocolAllowed = endpoint.protocol === "https:" || endpoint.protocol === "http:" && isLoopbackHost(endpoint);
+	if (value.trim() !== value || !protocolAllowed || endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "") throw new Error(message);
+	return endpoint.toString().replace(/\/$/, "");
+}
+function parseBoolean(env, name, defaultValue) {
+	const value = env[name];
+	if (value === void 0) return defaultValue;
+	if (value === "true") return true;
+	if (value === "false") return false;
+	throw new Error(`${name} must be either true or false`);
+}
+function parseTtl(env, name, defaultValue) {
+	const value = env[name];
+	if (value === void 0) return defaultValue;
+	if (!/^[1-9]\d*$/.test(value)) throw new Error(`${name} must be a positive integer`);
+	const seconds = Number(value);
+	if (!Number.isSafeInteger(seconds) || seconds > 604800) throw new Error(`${name} must be between 1 and ${MAX_S3_PRESIGN_TTL_SECONDS}`);
+	return seconds;
+}
+function normalizeS3AttachmentPrefix(prefix) {
+	if (prefix.trim() !== prefix || prefix.startsWith("/") || prefix.includes("\\")) throw new Error("S3_ATTACHMENT_PREFIX is unsafe");
+	const normalized = prefix.replace(/\/+$/, "");
+	if (normalized.length === 0) throw new Error("S3_ATTACHMENT_PREFIX must not be blank");
+	const segments = normalized.split("/");
+	if (segments.some((segment) => segment.length === 0 || segment === "." || segment === ".." || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(segment))) throw new Error("S3_ATTACHMENT_PREFIX contains an unsafe segment");
+	return segments.join("/");
+}
+function parseAttachmentStorageConfig(env = process.env) {
+	const selector = env.PH_ATTACHMENT_STORAGE;
+	if (selector === void 0 || selector === "filesystem") return { kind: "filesystem" };
+	if (selector !== "s3") throw new Error("PH_ATTACHMENT_STORAGE must be either filesystem or s3");
+	return {
+		kind: "s3",
+		s3: {
+			endpoint: parseEndpoint(required(env, "PH_ATTACHMENT_S3_ENDPOINT")),
+			region: required(env, "PH_ATTACHMENT_S3_REGION"),
+			bucket: required(env, "PH_ATTACHMENT_S3_BUCKET"),
+			accessKeyId: required(env, "PH_ATTACHMENT_S3_ACCESS_KEY_ID"),
+			secretAccessKey: required(env, "PH_ATTACHMENT_S3_SECRET_ACCESS_KEY"),
+			prefix: normalizeS3AttachmentPrefix(env.S3_ATTACHMENT_PREFIX ?? "attachments"),
+			forcePathStyle: parseBoolean(env, "PH_ATTACHMENT_S3_FORCE_PATH_STYLE", false),
+			uploadTtlSeconds: parseTtl(env, "PH_ATTACHMENT_S3_UPLOAD_TTL_SECONDS", 900),
+			downloadTtlSeconds: parseTtl(env, "PH_ATTACHMENT_S3_DOWNLOAD_TTL_SECONDS", 300)
+		}
+	};
+}
+//#endregion
+//#region src/storage/s3/keying.ts
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+function validateHash(hash) {
+	if (!SHA256_HEX.test(hash)) throw new Error("Attachment hash must be 64 lowercase hexadecimal characters");
+}
+function deriveS3AttachmentKey(hash, prefix) {
+	validateHash(hash);
+	if (prefix.startsWith("/") || prefix.endsWith("/") || prefix.includes("\\") || prefix.split("/").some((segment) => segment.length === 0 || segment === "." || segment === ".." || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(segment))) throw new Error("S3 attachment prefix must be normalized and safe");
+	return `${prefix}/${hash.slice(0, 2)}/${hash.slice(2, 4)}/${hash}`;
+}
+function sha256HexToBase64(hash) {
+	validateHash(hash);
+	return Buffer$1.from(hash, "hex").toString("base64");
+}
+//#endregion
+//#region src/storage/s3/primitives.ts
+const defaultPresigner = (client, command, expiresInSeconds) => getSignedUrl(client, command, {
+	expiresIn: expiresInSeconds,
+	unhoistableHeaders: new Set(["x-amz-checksum-sha256"])
+});
+var S3AttachmentPrimitives = class {
+	client;
+	presign;
+	now;
+	constructor(config, dependencies = {}) {
+		this.config = config;
+		this.client = dependencies.client ?? new S3Client({
+			endpoint: config.endpoint,
+			region: config.region,
+			forcePathStyle: config.forcePathStyle,
+			credentials: {
+				accessKeyId: config.accessKeyId,
+				secretAccessKey: config.secretAccessKey
+			}
+		});
+		this.presign = dependencies.presign ?? defaultPresigner;
+		this.now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+	}
+	buildHeadObjectCommand(hash) {
+		return new HeadObjectCommand({
+			Bucket: this.config.bucket,
+			Key: deriveS3AttachmentKey(hash, this.config.prefix)
+		});
+	}
+	buildPutObjectCommand(hash, mimeType) {
+		if (mimeType.trim().length === 0 || mimeType.includes("\r") || mimeType.includes("\n")) throw new Error("Attachment MIME type must not be blank or contain newlines");
+		return new PutObjectCommand({
+			Bucket: this.config.bucket,
+			Key: deriveS3AttachmentKey(hash, this.config.prefix),
+			ContentType: mimeType,
+			ChecksumSHA256: sha256HexToBase64(hash)
+		});
+	}
+	buildGetObjectCommand(hash) {
+		return new GetObjectCommand({
+			Bucket: this.config.bucket,
+			Key: deriveS3AttachmentKey(hash, this.config.prefix)
+		});
+	}
+	headObject(hash) {
+		return this.client.send(this.buildHeadObjectCommand(hash));
+	}
+	async createUploadTarget(hash, mimeType, ttlSeconds = this.config.uploadTtlSeconds) {
+		const checksum = sha256HexToBase64(hash);
+		return {
+			kind: "presigned-put",
+			method: "PUT",
+			url: await this.presign(this.client, this.buildPutObjectCommand(hash, mimeType), ttlSeconds),
+			headers: {
+				"content-type": mimeType,
+				"x-amz-checksum-sha256": checksum
+			},
+			expiresAtUtc: new Date(this.now().getTime() + ttlSeconds * 1e3).toISOString()
+		};
+	}
+	async createDownloadTarget(hash, ttlSeconds = this.config.downloadTtlSeconds) {
+		return {
+			kind: "presigned-get",
+			method: "GET",
+			url: await this.presign(this.client, this.buildGetObjectCommand(hash), ttlSeconds),
+			headers: {},
+			expiresAtUtc: new Date(this.now().getTime() + ttlSeconds * 1e3).toISOString()
+		};
+	}
+};
+function createS3AttachmentPrimitives(config, dependencies = {}) {
+	return new S3AttachmentPrimitives(config, dependencies);
+}
+//#endregion
+//#region src/storage/s3/backend.ts
+const READINESS_PROBE_HASH = "0".repeat(64);
+const OBJECT_NOT_FOUND_NAMES = new Set([
+	"NotFound",
+	"NoSuchKey",
+	"NoSuchObject"
+]);
+function isObjectNotFound(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const providerError = error;
+	if (providerError.$metadata?.httpStatusCode !== 404) return false;
+	return [providerError.name, providerError.code].some((code) => typeof code === "string" && OBJECT_NOT_FOUND_NAMES.has(code));
+}
+function requireHashFirstReservation(reservation) {
+	if (reservation.clientHash === null) throw new Error("S3 attachment reservations require a client hash");
+	deriveS3AttachmentKey(reservation.clientHash, "validation");
+	if (reservation.sizeBytes === null || !Number.isSafeInteger(reservation.sizeBytes) || reservation.sizeBytes <= 0) throw new Error("S3 attachment reservation sizeBytes must be a positive safe integer");
+}
+/** Server-only S3 capability. Callers complete authorization before download. */
+var S3AttachmentBackend = class {
+	kind = "s3";
+	primitives;
+	now;
+	uploadTtlSeconds;
+	downloadTtlSeconds;
+	constructor(db, config, dependencies = {}) {
+		this.db = db;
+		this.config = config;
+		this.primitives = new S3AttachmentPrimitives(config, dependencies);
+		this.now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+		this.uploadTtlSeconds = dependencies.uploadTtlSeconds ?? config.uploadTtlSeconds;
+		this.downloadTtlSeconds = dependencies.downloadTtlSeconds ?? config.downloadTtlSeconds;
+	}
+	async prepareUploadTarget(reservation) {
+		requireHashFirstReservation(reservation);
+		const hash = reservation.clientHash;
+		const now = this.now().toISOString();
+		const storagePath = deriveS3AttachmentKey(hash, this.config.prefix);
+		try {
+			await this.db.insertInto("attachment").values({
+				hash,
+				mime_type: reservation.mimeType,
+				file_name: reservation.fileName,
+				size_bytes: reservation.sizeBytes,
+				extension: reservation.extension,
+				status: "available",
+				storage_path: storagePath,
+				source: "local",
+				created_at_utc: reservation.createdAtUtc,
+				last_accessed_at_utc: now
+			}).onConflict((conflict) => conflict.column("hash").doUpdateSet({
+				mime_type: reservation.mimeType,
+				file_name: reservation.fileName,
+				size_bytes: reservation.sizeBytes,
+				extension: reservation.extension,
+				status: "available",
+				storage_path: storagePath,
+				last_accessed_at_utc: now
+			})).execute();
+		} catch {
+			throw new Error("S3 attachment metadata registration failed");
+		}
+		let target;
+		try {
+			target = await this.primitives.createUploadTarget(hash, reservation.mimeType, this.uploadTtlSeconds);
+		} catch {
+			throw new Error("S3 attachment upload target preparation failed");
+		}
+		return target;
+	}
+	async prepareDownloadTarget(hash, ttlSeconds) {
+		try {
+			return await this.primitives.createDownloadTarget(hash, ttlSeconds ?? this.downloadTtlSeconds);
+		} catch {
+			throw new Error("S3 attachment download target preparation failed");
+		}
+	}
+	async exists(hash) {
+		if (!await this.db.selectFrom("attachment").select("hash").where("hash", "=", hash).executeTakeFirst()) return false;
+		try {
+			await this.primitives.headObject(hash);
+			return true;
+		} catch (error) {
+			if (isObjectNotFound(error)) return false;
+			throw new Error("S3 attachment existence check failed");
+		}
+	}
+	async health() {
+		try {
+			await this.primitives.headObject(READINESS_PROBE_HASH);
+			return {
+				kind: this.kind,
+				ready: true
+			};
+		} catch (error) {
+			return {
+				kind: this.kind,
+				ready: isObjectNotFound(error)
+			};
+		}
+	}
+};
+function createS3AttachmentBackend(db, config, dependencies = {}) {
+	return new S3AttachmentBackend(db, config, dependencies);
+}
+//#endregion
+export { ATTACHMENT_REFERENCE_MIGRATION_LOCK_TABLE, ATTACHMENT_REFERENCE_MIGRATION_TABLE, ATTACHMENT_REFERENCE_READ_MODEL_ID, ATTACHMENT_REFERENCE_SCHEMA, ATTACHMENT_SCHEMA, AttachmentAlreadyExists, AttachmentBuilder, AttachmentNotFound, AttachmentPending, AttachmentReferenceIndexBuilder, AttachmentReferenceReadModel, AttachmentSchemaCompiler, AttachmentService, AttachmentTransferError, DEFAULT_RESERVATION_TTL_MS, DEFAULT_S3_ATTACHMENT_PREFIX, DEFAULT_S3_DOWNLOAD_TTL_SECONDS, DEFAULT_S3_UPLOAD_TTL_SECONDS, DirectAttachmentUpload, DirectAttachmentUploadFactory, FilesystemAttachmentBackend, HashMismatch, InvalidAttachmentRef, KyselyAttachmentReferenceStore, KyselyAttachmentStore, KyselyReservationStore, MAX_S3_PRESIGN_TTL_SECONDS, NullAttachmentTransport, RemoteAttachmentStore, RemoteAttachmentUpload, RemoteAttachmentUploadFactory, RemoteReservationStore, ReservationNotFound, S3AttachmentBackend, S3AttachmentPrimitives, S3AttachmentUploadFactory, SizeMismatch, SwitchboardAttachmentTransport, UploadTooLarge, createRef, createRemoteAttachmentService, createS3AttachmentBackend, createS3AttachmentPrimitives, deriveS3AttachmentKey, getAttachmentReferenceMigrationStatus, normalizeS3AttachmentPrefix, parseAttachmentDownloadTarget, parseAttachmentStorageConfig, parseAttachmentUploadTarget, parseRef, rollbackAttachmentReferenceMigration, runAttachmentMigrations, runAttachmentReferenceMigrations, sha256HexToBase64 };
 
 //# sourceMappingURL=index.js.map