@powerhousedao/reactor-attachments 6.2.3-dev.5 → 6.2.3-dev.51

package/dist/index.js

@@ -1,4 +1,6 @@
-import { C as UploadTooLarge, S as SizeMismatch, _ as AttachmentPending, a as RemoteAttachmentUpload, b as InvalidAttachmentRef, c as createFetchUploadTransport, d as createRef, f as parseRef, g as AttachmentNotFound, h as AttachmentAlreadyExists, i as RemoteAttachmentUploadFactory, l as SwitchboardAttachmentTransport, m as parseAttachmentUploadTarget, n as createRemoteAttachmentService, o as RemoteReservationStore, p as parseAttachmentDownloadTarget, r as RemoteAttachmentStore, s as createXhrUploadTransport, t as NullAttachmentTransport, u as AttachmentService, v as AttachmentTransferError, x as ReservationNotFound, y as HashMismatch } from "./null-attachment-transport-CrsUafCi.js";
+import { a as parseRef, c as AttachmentPending, d as InvalidAttachmentMetadata, f as InvalidAttachmentRef, h as UploadTooLarge, i as createRef, l as AttachmentTransferError, m as SizeMismatch, o as AttachmentAlreadyExists, p as ReservationNotFound, s as AttachmentNotFound, t as SwitchboardAttachmentTransport, u as HashMismatch } from "./switchboard-attachment-transport-BH3ZAmxE.js";
+import { a as RemoteAttachmentUpload, c as createFetchUploadTransport, d as parseAttachmentUploadTarget, i as RemoteAttachmentUploadFactory, l as AttachmentService, n as createRemoteAttachmentService, o as RemoteReservationStore, r as RemoteAttachmentStore, s as createXhrUploadTransport, t as NullAttachmentTransport, u as parseAttachmentDownloadTarget } from "./null-attachment-transport-BGG9cRC-.js";
+import { t as AttachmentSchemaCompiler } from "./attachment-schema-compiler-rIaJpiHO.js";
 import { dirname, join } from "node:path";
 import { Migrator, sql } from "kysely";
 import { mkdir, rename, rm } from "node:fs/promises";
@@ -6,10 +8,8 @@ import { createReadStream, createWriteStream } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { Readable } from "node:stream";
 import { finished } from "node:stream/promises";
-import { generatorTypeDefs } from "@powerhousedao/document-engineering/graphql";
-import { constantCase, pascalCase } from "change-case";
-import { Kind, buildASTSchema, getNamedType, isInputObjectType, isListType, isNonNullType, parse, print } from "graphql";
-import { BaseReadModel } from "@powerhousedao/reactor";
+import { BaseReadModel, defaultReadModelIndexingConfig } from "@powerhousedao/reactor";
+import { isPurgeMarker } from "@powerhousedao/shared/document-model";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -25,6 +25,27 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/reserve-metadata.ts
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+const NON_HEADER_CHARS = /[^\t\x20-\x7e\x80-\xff]/;
+const MIME_TYPE_PATTERN = /^[!#$%&'*+\-.^_`|~\w]+\/[!#$%&'*+\-.^_`|~\w]+(?:[ \t]*;[ \t]*[!#$%&'*+\-.^_`|~\w]+=(?:[!#$%&'*+\-.^_`|~\w]+|"(?:[^"\\\r\n]|\\[^\r\n])*"))*$/;
+const MAX_FILENAME_LEN = 255;
+const MAX_MIMETYPE_LEN = 255;
+/**
+* Validates reserve metadata with the rules the switchboard reserve route
+* applies.
+*
+* @throws InvalidAttachmentMetadata naming the first field that fails.
+*/
+function validateReserveMetadata(meta) {
+	const { mimeType, fileName, extension } = meta;
+	if (typeof mimeType !== "string" || mimeType.length === 0 || mimeType.length > MAX_MIMETYPE_LEN || NON_HEADER_CHARS.test(mimeType) || !MIME_TYPE_PATTERN.test(mimeType)) throw new InvalidAttachmentMetadata("mimeType");
+	if (typeof fileName !== "string" || fileName.length === 0 || fileName.length > MAX_FILENAME_LEN || CONTROL_CHARS.test(fileName)) throw new InvalidAttachmentMetadata("fileName");
+	if (typeof extension === "string") {
+		if (extension.length === 0 || /[\\/]/.test(extension)) throw new InvalidAttachmentMetadata("extension");
+	} else if (extension !== void 0 && extension !== null) throw new InvalidAttachmentMetadata("extension");
+}
+//#endregion
 //#region src/storage/fs/attachment-fs.ts
 /**
 * Compute the relative storage path for an attachment hash.
@@ -262,6 +283,9 @@ function wrapStreamWithCleanup(source, cleanup) {
 	});
 }
 var KyselyAttachmentStore = class {
+	db;
+	transport;
+	basePath;
 	activeReaders = /* @__PURE__ */ new Map();
 	constructor(db, transport, basePath) {
 		this.db = db;
@@ -290,18 +314,10 @@ var KyselyAttachmentStore = class {
 	async has(hash) {
 		return (await this.db.selectFrom("attachment").select("status").where("hash", "=", hash).executeTakeFirst())?.status === "available";
 	}
-	async get(hash, signal) {
+	async get(hash, signal, documentId) {
 		const row = await this.db.selectFrom("attachment").selectAll().where("hash", "=", hash).executeTakeFirst();
 		if (row) {
-			if (row.status === "evicted") {
-				const remote = await this.transport.fetch(hash, signal);
-				if (remote.kind === "data") {
-					await this.put(hash, remote.response.metadata, remote.response.body);
-					return this.get(hash, signal);
-				}
-				if (remote.kind === "pending") throw new AttachmentPending(hash, remote.expiresAtUtc);
-				throw new AttachmentNotFound(hash);
-			}
+			if (row.status === "evicted") return this.fetchRemote(hash, signal, documentId);
 			const now = (/* @__PURE__ */ new Date()).toISOString();
 			await this.db.updateTable("attachment").set({ last_accessed_at_utc: now }).where("hash", "=", hash).execute();
 			const header = rowToHeader$1(row);
@@ -319,13 +335,7 @@ var KyselyAttachmentStore = class {
 			fileName: pending.file_name,
 			sizeBytes: pending.size_bytes
 		});
-		const remote = await this.transport.fetch(hash, signal);
-		if (remote.kind === "data") {
-			await this.put(hash, remote.response.metadata, remote.response.body);
-			return this.get(hash, signal);
-		}
-		if (remote.kind === "pending") throw new AttachmentPending(hash, remote.expiresAtUtc);
-		throw new AttachmentNotFound(hash);
+		return this.fetchRemote(hash, signal, documentId);
 	}
 	async put(hash, metadata, data) {
 		const existing = await this.db.selectFrom("attachment").select(["hash", "status"]).where("hash", "=", hash).executeTakeFirst();
@@ -365,6 +375,16 @@ var KyselyAttachmentStore = class {
 		const result = await this.db.selectFrom("attachment").select(sql`COALESCE(SUM(size_bytes), 0)`.as("total")).where("status", "=", "available").executeTakeFirst();
 		return Number(result?.total ?? 0);
 	}
+	async fetchRemote(hash, signal, documentId) {
+		if (documentId === void 0) throw new AttachmentNotFound(hash);
+		const remote = await this.transport.fetch(hash, documentId, signal);
+		if (remote.kind === "data") {
+			await this.put(hash, remote.response.metadata, remote.response.body);
+			return this.get(hash, signal);
+		}
+		if (remote.kind === "pending") throw new AttachmentPending(hash, remote.expiresAtUtc);
+		throw new AttachmentNotFound(hash);
+	}
 	async findPendingReservation(hash, now) {
 		const row = await this.db.selectFrom("attachment_reservation as r").leftJoin("attachment as a", "a.hash", "r.client_hash").select([
 			"r.mime_type",
@@ -398,7 +418,7 @@ var KyselyAttachmentStore = class {
 };
 //#endregion
 //#region src/storage/kysely/reservation-store.ts
-const DEFAULT_RESERVATION_TTL_MS = 1440 * 60 * 1e3;
+const DEFAULT_RESERVATION_TTL_MS = 864e5;
 function rowToReservation(row) {
 	return {
 		reservationId: row.reservation_id,
@@ -412,6 +432,7 @@ function rowToReservation(row) {
 	};
 }
 var KyselyReservationStore = class {
+	db;
 	ttlMs;
 	constructor(db, ttlMs = DEFAULT_RESERVATION_TTL_MS) {
 		this.db = db;
@@ -601,6 +622,11 @@ function rowToHeader(row) {
 	};
 }
 var DirectAttachmentUpload = class {
+	reservation;
+	db;
+	basePath;
+	reservations;
+	maxBytes;
 	reservationId;
 	ref;
 	expiresAtUtc;
@@ -670,6 +696,10 @@ var DirectAttachmentUpload = class {
 //#endregion
 //#region src/direct/direct-attachment-upload-factory.ts
 var DirectAttachmentUploadFactory = class {
+	db;
+	basePath;
+	reservations;
+	maxBytes;
 	constructor(db, basePath, reservations, maxBytes) {
 		this.db = db;
 		this.basePath = basePath;
@@ -688,6 +718,8 @@ var DirectAttachmentUploadFactory = class {
 * can never accidentally return a direct-provider target.
 */
 var FilesystemAttachmentBackend = class {
+	store;
+	config;
 	kind = "filesystem";
 	constructor(store, config) {
 		this.store = store;
@@ -739,6 +771,8 @@ var S3AttachmentUploadFactory = class {
 //#endregion
 //#region src/attachment-builder.ts
 var AttachmentBuilder = class {
+	db;
+	storagePath;
 	transport = new NullAttachmentTransport();
 	customUploadFactory;
 	maxUploadBytes;
@@ -809,266 +843,59 @@ var AttachmentBuilder = class {
 	}
 };
 //#endregion
-//#region src/reference-index/attachment-schema-compiler.ts
-const ATTACHMENT_REF_TYPE = "AttachmentRef";
-const CODEGEN_SCALAR_NAMES = new Set([
-	"Unknown",
-	"DateTime",
-	"Address",
-	ATTACHMENT_REF_TYPE,
-	...Object.keys(generatorTypeDefs)
-]);
-function describeContext(context) {
-	return `document type "${context.documentType}", version ${context.version}, action "${context.actionType}"`;
-}
-function compilationError(context, reason) {
-	return /* @__PURE__ */ new Error(`Attachment schema compilation failed for ${describeContext(context)}: ${reason}`);
-}
-function extractionError(context, path, reason) {
-	return /* @__PURE__ */ new Error(`Attachment extraction failed for ${describeContext(context)} at ${path}: ${reason}`);
-}
-function applicableSpecification(module, context) {
-	const matches = module.documentModel.global.specifications.filter((specification) => specification.version === context.version);
-	if (matches.length !== 1) throw compilationError(context, matches.length === 0 ? "the module has no matching specification" : "the module has multiple matching specifications");
-	return matches[0];
-}
-function parseOperations(specification, context) {
-	return specification.modules.flatMap((moduleSpecification) => moduleSpecification.operations.map((operation) => {
-		if (operation.schema === null) return {
-			document: null,
-			operation
-		};
-		try {
-			return {
-				document: parse(operation.schema),
-				operation
-			};
-		} catch {
-			throw compilationError(context, "an operation has invalid GraphQL SDL");
-		}
-	}));
-}
-function selectOperation(operations, context) {
-	const matches = operations.filter(({ operation }) => operation.name !== null && constantCase(operation.name) === context.actionType);
-	if (matches.length > 1) throw compilationError(context, "multiple operations map to the action");
-	if (matches.length === 0) return null;
-	return matches[0];
+//#region src/read-models/attachment-reference/kysely-attachment-reference-store.ts
+function encodeCursor(cursor) {
+	return JSON.stringify([cursor.documentId, cursor.ref]);
 }
-function buildEffectiveSchema(specification, context) {
-	const scalarSchemas = Array.from(CODEGEN_SCALAR_NAMES, (name) => `scalar ${name}`);
-	const stateSchemas = Object.values(specification.state).map((state) => state.schema);
-	const operationSchemas = specification.modules.flatMap((moduleSpecification) => moduleSpecification.operations.flatMap((operation) => operation.schema === null ? [] : [operation.schema]));
+function decodeCursor(cursor) {
+	let parsed;
 	try {
-		return buildASTSchema(dedupeTypeDefinitions(parse([
-			...scalarSchemas,
-			...stateSchemas,
-			...operationSchemas
-		].filter(Boolean).join("\n\n"))));
+		parsed = JSON.parse(cursor);
 	} catch {
-		throw compilationError(context, "the effective GraphQL schema is invalid");
+		throw new Error(`Invalid attachment reference scan cursor: ${JSON.stringify(cursor)}`);
 	}
-}
-function dedupeTypeDefinitions(document) {
-	const seen = /* @__PURE__ */ new Map();
-	const definitions = document.definitions.filter((definition) => {
-		if (!("name" in definition) || definition.name?.value === void 0 || definition.kind === Kind.SCALAR_TYPE_DEFINITION) return true;
-		const name = definition.name.value;
-		const printed = print(definition);
-		const existing = seen.get(name);
-		if (existing === void 0) {
-			seen.set(name, printed);
-			return true;
-		}
-		return existing !== printed;
-	});
-	return {
-		...document,
-		definitions
-	};
-}
-function attachmentReachableTypes(definitions) {
-	const reachable = /* @__PURE__ */ new Set();
-	let changed = true;
-	while (changed) {
-		changed = false;
-		for (const [name, definition] of definitions) {
-			if (reachable.has(name)) continue;
-			if (Object.values(definition.getFields()).some((field) => {
-				const typeName = getNamedType(field.type).name;
-				return typeName === ATTACHMENT_REF_TYPE || definitions.has(typeName) && reachable.has(typeName);
-			})) {
-				reachable.add(name);
-				changed = true;
-			}
-		}
-	}
-	return reachable;
-}
-function compileValuePlan(type, objectPlans) {
-	if (isNonNullType(type)) return {
-		...compileValuePlan(type.ofType, objectPlans),
-		required: true
-	};
-	if (isListType(type)) return {
-		item: compileValuePlan(type.ofType, objectPlans),
-		kind: "list",
-		required: false
-	};
-	const typeName = type.name;
-	if (typeName === ATTACHMENT_REF_TYPE) return {
-		kind: "attachment",
-		required: false
-	};
-	const body = objectPlans.get(typeName);
-	if (!body) throw new Error(`Internal attachment schema plan error for ${typeName}`);
+	if (!Array.isArray(parsed) || parsed.length !== 2 || typeof parsed[0] !== "string" || parsed[0] === "" || typeof parsed[1] !== "string" || parsed[1] === "") throw new Error(`Invalid attachment reference scan cursor: ${JSON.stringify(cursor)}`);
 	return {
-		body,
-		kind: "object",
-		required: false
-	};
-}
-function compileRootPlan(rootName, definitions) {
-	const reachable = attachmentReachableTypes(definitions);
-	if (!reachable.has(rootName)) return null;
-	const objectPlans = /* @__PURE__ */ new Map();
-	for (const name of reachable) objectPlans.set(name, { fields: [] });
-	for (const name of reachable) {
-		const definition = definitions.get(name);
-		const body = objectPlans.get(name);
-		if (!definition || !body) continue;
-		for (const field of Object.values(definition.getFields())) {
-			const typeName = getNamedType(field.type).name;
-			if (typeName !== ATTACHMENT_REF_TYPE && !reachable.has(typeName)) continue;
-			body.fields.push({
-				hasDefault: field.defaultValue !== void 0,
-				name: field.name,
-				value: compileValuePlan(field.type, objectPlans)
-			});
-		}
-	}
-	return objectPlans.get(rootName) ?? null;
-}
-function readOwnField(value, fieldName, context, path) {
-	try {
-		if (!Object.prototype.hasOwnProperty.call(value, fieldName)) return {
-			present: false,
-			value: void 0
-		};
-		return {
-			present: true,
-			value: value[fieldName]
-		};
-	} catch {
-		throw extractionError(context, path, "the declared field cannot be read");
-	}
-}
-function extractValue(plan, value, path, context, refs, seenRefs, activeObjects) {
-	if (value === null || value === void 0) {
-		if (plan.required) throw extractionError(context, path, "a required value is missing or null");
-		return;
-	}
-	if (plan.kind === "attachment") {
-		if (typeof value !== "string") throw extractionError(context, path, "expected an AttachmentRef string");
-		try {
-			parseRef(value);
-		} catch {
-			throw extractionError(context, path, "the AttachmentRef is malformed");
-		}
-		if (!seenRefs.has(value)) {
-			seenRefs.add(value);
-			refs.push(value);
-		}
-		return;
-	}
-	if (plan.kind === "list") {
-		if (!Array.isArray(value)) throw extractionError(context, path, "expected a list");
-		for (let index = 0; index < value.length; index += 1) extractValue(plan.item, value[index], `${path}[${index}]`, context, refs, seenRefs, activeObjects);
-		return;
-	}
-	if (typeof value !== "object" || Array.isArray(value)) throw extractionError(context, path, "expected an input object");
-	if (activeObjects.has(value)) throw extractionError(context, path, "the input value contains a cycle");
-	activeObjects.add(value);
-	try {
-		const record = value;
-		for (const field of plan.body.fields) {
-			const fieldPath = `${path}.${field.name}`;
-			const result = readOwnField(record, field.name, context, fieldPath);
-			if ((!result.present || result.value === void 0) && field.hasDefault) continue;
-			extractValue(field.value, result.value, fieldPath, context, refs, seenRefs, activeObjects);
-		}
-	} finally {
-		activeObjects.delete(value);
-	}
-}
-var SchemaCompiledAttachmentExtractor = class {
-	constructor(context, rootPlan) {
-		this.context = context;
-		this.rootPlan = rootPlan;
-	}
-	extract(action) {
-		if (action.type !== this.context.actionType) throw extractionError(this.context, "input", "the action type does not match the compiled schema");
-		if (!this.rootPlan) return [];
-		if (action.input === null || typeof action.input !== "object" || Array.isArray(action.input)) throw extractionError(this.context, "input", "expected an input object");
-		const refs = [];
-		const seenRefs = /* @__PURE__ */ new Set();
-		const activeObjects = /* @__PURE__ */ new WeakSet();
-		activeObjects.add(action.input);
-		try {
-			const input = action.input;
-			for (const field of this.rootPlan.fields) {
-				const path = `input.${field.name}`;
-				const result = readOwnField(input, field.name, this.context, path);
-				if ((!result.present || result.value === void 0) && field.hasDefault) continue;
-				extractValue(field.value, result.value, path, this.context, refs, seenRefs, activeObjects);
-			}
-		} finally {
-			activeObjects.delete(action.input);
-		}
-		return refs;
-	}
-};
-function compileExtractor(module, actionType) {
-	const context = {
-		actionType,
-		documentType: module.documentModel.global.id,
-		version: module.version ?? 1
+		documentId: parsed[0],
+		ref: parsed[1]
 	};
-	const specification = applicableSpecification(module, context);
-	const selected = selectOperation(parseOperations(specification, context), context);
-	if (selected === null || selected.operation.schema === null) return new SchemaCompiledAttachmentExtractor(context, null);
-	const effectiveSchema = buildEffectiveSchema(specification, context);
-	const operationName = selected.operation.name;
-	if (operationName === null) throw compilationError(context, "the operation has no name");
-	const rootName = `${pascalCase(operationName)}Input`;
-	const definitions = /* @__PURE__ */ new Map();
-	for (const type of Object.values(effectiveSchema.getTypeMap())) if (isInputObjectType(type) && !type.name.startsWith("__")) definitions.set(type.name, type);
-	if (!(selected.document?.definitions.filter((definition) => (definition.kind === Kind.INPUT_OBJECT_TYPE_DEFINITION || definition.kind === Kind.INPUT_OBJECT_TYPE_EXTENSION) && definition.name.value === rootName))?.length || !definitions.has(rootName)) throw compilationError(context, `the operation does not declare its expected root input "${rootName}"`);
-	return new SchemaCompiledAttachmentExtractor(context, compileRootPlan(rootName, definitions));
 }
-var AttachmentSchemaCompiler = class {
-	cache = /* @__PURE__ */ new WeakMap();
-	forModuleAction(module, actionType) {
-		let moduleCache = this.cache.get(module);
-		if (!moduleCache) {
-			moduleCache = /* @__PURE__ */ new Map();
-			this.cache.set(module, moduleCache);
-		}
-		const cached = moduleCache.get(actionType);
-		if (cached) return cached;
-		const compiled = compileExtractor(module, actionType);
-		moduleCache.set(actionType, compiled);
-		return compiled;
-	}
-};
-//#endregion
-//#region src/read-models/attachment-reference/kysely-attachment-reference-store.ts
 var KyselyAttachmentReferenceStore = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
 	async hasReference(documentId, ref) {
 		return await this.db.selectFrom("attachment_reference").select("document_id").where("document_id", "=", documentId).where("attachment_ref", "=", ref).executeTakeFirst() !== void 0;
 	}
+	async referencingScopes(documentId, ref) {
+		return (await this.db.selectFrom("attachment_reference").select("scope").distinct().where("document_id", "=", documentId).where("attachment_ref", "=", ref).execute()).map((row) => row.scope);
+	}
+	/**
+	* Keyset paging over the unique `(document_id, attachment_ref)` constraint,
+	* rather than OFFSET: a scan that runs while the read model is still
+	* indexing must not skip or repeat a row because rows appeared behind the
+	* cursor. That is exactly the boot case the replicator's re-scan runs in.
+	*/
+	async listReferences(cursor, limit) {
+		let query = this.db.selectFrom("attachment_reference").select(["document_id", "attachment_ref"]).orderBy("document_id", "asc").orderBy("attachment_ref", "asc").limit(limit);
+		if (cursor !== void 0) {
+			const after = decodeCursor(cursor);
+			query = query.where((eb) => eb.or([eb("document_id", ">", after.documentId), eb.and([eb("document_id", "=", after.documentId), eb("attachment_ref", ">", after.ref)])]));
+		}
+		const rows = await query.execute();
+		const last = rows.at(-1);
+		return {
+			references: rows.map((row) => ({
+				documentId: row.document_id,
+				ref: row.attachment_ref
+			})),
+			nextCursor: rows.length === limit && last ? encodeCursor({
+				documentId: last.document_id,
+				ref: last.attachment_ref
+			}) : void 0
+		};
+	}
 	async addReferences(references) {
 		if (references.length === 0) return;
 		await this.db.insertInto("attachment_reference").values(references.map((reference) => ({
@@ -1082,6 +909,10 @@ var KyselyAttachmentReferenceStore = class {
 			created_at_utc: (/* @__PURE__ */ new Date()).toISOString()
 		}))).onConflict((oc) => oc.columns(["document_id", "attachment_ref"]).doNothing()).execute();
 	}
+	async removeDocuments(documentIds) {
+		if (documentIds.length === 0) return;
+		await this.db.deleteFrom("attachment_reference").where("document_id", "in", [...documentIds]).execute();
+	}
 };
 //#endregion
 //#region src/read-models/attachment-reference/storage/migrations/001_create_attachment_reference_table.ts
@@ -1160,6 +991,7 @@ async function getAttachmentReferenceMigrationStatus(db, schema = ATTACHMENT_REF
 //#endregion
 //#region src/read-models/attachment-reference/index-builder.ts
 var AttachmentReferenceIndexBuilder = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -1172,52 +1004,40 @@ var AttachmentReferenceIndexBuilder = class {
 //#endregion
 //#region src/read-models/attachment-reference/attachment-reference-read-model.ts
 const ATTACHMENT_REFERENCE_READ_MODEL_ID = "attachment-reference-read-model";
+/**
+* Indexes attachment references in chunks.
+*
+* Each reference row stands on its own and is written insert-or-do-nothing, so
+* a batch that commits in pieces exposes no partial structure, and re-indexing
+* the same range writes nothing new: the catch-up sweep needs no stream suffix.
+*
+* The rows live on another handle, so the purge fence is "skip": a tombstoned
+* id's operations are dropped at commit and its marker deletes its rows.
+*/
 var AttachmentReferenceReadModel = class extends BaseReadModel {
-	indexingQueue = Promise.resolve();
-	checkpointTarget;
-	/**
-	* How far a replay may skip ahead of the cursor: the highest ordinal already
-	* pulled from the index while the cursor was parked.
-	*
-	* NOT a claim that every ordinal below it committed -- the parked ordinal is
-	* precisely the one that did not -- so it is a hint, and {@link replayFrom}
-	* re-probes the gap before honouring it.
-	*/
-	replayedThrough;
-	warnedCheckpoint;
+	documentModelRegistry;
+	schemaCompiler;
+	referenceWriter;
 	constructor(db, operationIndex, writeCache, consistencyTracker, documentModelRegistry, schemaCompiler, referenceWriter) {
 		super(db, operationIndex, writeCache, consistencyTracker, {
 			readModelId: ATTACHMENT_REFERENCE_READ_MODEL_ID,
-			rebuildStateOnInit: false
+			rebuildStateOnInit: false,
+			indexing: defaultReadModelIndexingConfig,
+			replayStreamSuffix: false,
+			purgeFence: "skip"
 		});
 		this.documentModelRegistry = documentModelRegistry;
 		this.schemaCompiler = schemaCompiler;
 		this.referenceWriter = referenceWriter;
 	}
-	indexOperations(items) {
-		return this.enqueue(() => this.indexOperationsInOrdinalOrder(items));
-	}
-	init() {
-		return this.enqueue(async () => {
-			const viewState = await this.loadState();
-			if (viewState !== void 0) this.lastOrdinal = viewState;
-			else await this.initializeState();
-			let page = await this.operationIndex.getSinceOrdinal(this.lastOrdinal);
-			while (page.results.length > 0) {
-				await this.indexOperationsInOrdinalOrder(page.results);
-				if (!page.next) break;
-				page = await page.next();
-			}
-		});
-	}
-	enqueue(work) {
-		const result = this.indexingQueue.then(work);
-		this.indexingQueue = result.catch(() => void 0);
-		return result;
-	}
 	async commitOperations(items) {
 		const references = [];
+		const purged = /* @__PURE__ */ new Set();
 		for (const { operation, context } of items) {
+			if (isPurgeMarker(operation)) {
+				purged.add(context.documentId);
+				continue;
+			}
 			if (operation.error !== void 0) continue;
 			const module = this.documentModelRegistry.getModule(context.documentType);
 			const refs = this.schemaCompiler.forModuleAction(module, operation.action.type).extract(operation.action);
@@ -1231,102 +1051,7 @@ var AttachmentReferenceReadModel = class extends BaseReadModel {
 			});
 		}
 		if (references.length > 0) await this.referenceWriter.addReferences(references);
-	}
-	async indexOperationsInOrdinalOrder(incoming) {
-		let candidates = this.sortAndDedupe(incoming);
-		if (candidates.length === 0) return;
-		const incomingMax = candidates[candidates.length - 1].context.ordinal;
-		if (this.contiguousEnd(candidates) < incomingMax) {
-			const replayed = await this.loadThroughOrdinal(incomingMax);
-			candidates = this.sortAndDedupe([...replayed, ...candidates]);
-		}
-		const checkpoint = this.contiguousEnd(candidates);
-		if (checkpoint < incomingMax && checkpoint !== this.warnedCheckpoint) {
-			this.warnedCheckpoint = checkpoint;
-			console.warn(`[${this.config.readModelId}] indexed through ordinal ${incomingMax} but parked the cursor at ${checkpoint}: ordinal ${checkpoint + 1} is missing`);
-		}
-		const previousOrdinal = this.lastOrdinal;
-		this.checkpointTarget = checkpoint;
-		try {
-			await super.indexOperations(candidates);
-		} catch (error) {
-			this.lastOrdinal = previousOrdinal;
-			this.replayedThrough = void 0;
-			throw error;
-		} finally {
-			this.checkpointTarget = void 0;
-		}
-		if (checkpoint > previousOrdinal) this.replayedThrough = void 0;
-		else if (checkpoint < incomingMax) this.replayedThrough = Math.max(this.replayedThrough ?? checkpoint, incomingMax);
-	}
-	/**
-	* Writes the cursor parked by indexOperationsInOrdinalOrder instead of the
-	* batch maximum, so indexing an operation above a gap never advances past it.
-	*/
-	async saveState(trx, items) {
-		const target = this.checkpointTarget;
-		if (target === void 0) {
-			await super.saveState(trx, items);
-			return;
-		}
-		this.lastOrdinal = target;
-		await trx.updateTable("ViewState").set({
-			lastOrdinal: target,
-			lastOperationTimestamp: /* @__PURE__ */ new Date()
-		}).where("readModelId", "=", this.config.readModelId).execute();
-	}
-	/** Last ordinal of the contiguous run starting at lastOrdinal + 1. */
-	contiguousEnd(items) {
-		let expectedOrdinal = this.lastOrdinal + 1;
-		for (const item of items) {
-			const ordinal = item.context.ordinal;
-			if (ordinal < expectedOrdinal) continue;
-			if (ordinal > expectedOrdinal) break;
-			expectedOrdinal++;
-		}
-		return expectedOrdinal - 1;
-	}
-	/**
-	* Opens a replay at the lowest ordinal still worth reading.
-	*
-	* {@link replayedThrough} is what keeps a permanently held hole -- a
-	* rolled-back insert, which never fills -- from re-reading the whole tail on
-	* every batch. It cannot be trusted on its own: a hole that fills without
-	* being delivered here is visible only in the index, and a mark that is
-	* never questioned would hide that operation for the life of the process.
-	* That happens whenever another writer commits the gap (a second reactor on
-	* the same database), and it leaves the cursor parked below an operation
-	* whose references were never written -- `hasReference` then answers false
-	* for an attachment that is genuinely referenced.
-	*
-	* So a parked batch spends one page probing the gap: the first row above the
-	* cursor is the missing ordinal itself once it commits. Finding it drops the
-	* mark and replays from the cursor; not finding it leaves the mark standing,
-	* which is the cheap path and the common one.
-	*/
-	async replayFrom() {
-		const fromCursor = await this.operationIndex.getSinceOrdinal(this.lastOrdinal);
-		if (this.replayedThrough === void 0) return fromCursor;
-		if (fromCursor.results[0]?.context.ordinal === this.lastOrdinal + 1) {
-			this.replayedThrough = void 0;
-			return fromCursor;
-		}
-		return this.operationIndex.getSinceOrdinal(this.replayedThrough);
-	}
-	async loadThroughOrdinal(maxOrdinal) {
-		const operations = [];
-		let page = await this.replayFrom();
-		for (;;) {
-			for (const item of page.results) if (item.context.ordinal <= maxOrdinal) operations.push(item);
-			if (page.results.some(({ context }) => context.ordinal >= maxOrdinal) || !page.next) break;
-			page = await page.next();
-		}
-		return operations;
-	}
-	sortAndDedupe(items) {
-		const byOrdinal = /* @__PURE__ */ new Map();
-		for (const item of items) byOrdinal.set(item.context.ordinal, item);
-		return [...byOrdinal.values()].sort((left, right) => left.context.ordinal - right.context.ordinal);
+		if (purged.size > 0) await this.referenceWriter.removeDocuments([...purged]);
 	}
 };
 //#endregion
@@ -1341,7 +1066,7 @@ function required(env, name) {
 	if (value.trim() !== value) throw new Error(`${name} must not have leading or trailing whitespace`);
 	return value;
 }
-const LOOPBACK_HOSTNAMES = new Set([
+const LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"localhost",
 	"[::1]"
@@ -1423,9 +1148,10 @@ function sha256HexToBase64(hash) {
 //#region src/storage/s3/primitives.ts
 const defaultPresigner = (client, command, expiresInSeconds) => getSignedUrl(client, command, {
 	expiresIn: expiresInSeconds,
-	unhoistableHeaders: new Set(["x-amz-checksum-sha256"])
+	unhoistableHeaders: /* @__PURE__ */ new Set(["x-amz-checksum-sha256"])
 });
 var S3AttachmentPrimitives = class {
+	config;
 	client;
 	presign;
 	now;
@@ -1496,7 +1222,7 @@ function createS3AttachmentPrimitives(config, dependencies = {}) {
 //#endregion
 //#region src/storage/s3/backend.ts
 const READINESS_PROBE_HASH = "0".repeat(64);
-const OBJECT_NOT_FOUND_NAMES = new Set([
+const OBJECT_NOT_FOUND_NAMES = /* @__PURE__ */ new Set([
 	"NotFound",
 	"NoSuchKey",
 	"NoSuchObject"
@@ -1514,6 +1240,8 @@ function requireHashFirstReservation(reservation) {
 }
 /** Server-only S3 capability. Callers complete authorization before download. */
 var S3AttachmentBackend = class {
+	db;
+	config;
 	kind = "s3";
 	primitives;
 	now;
@@ -1600,6 +1328,6 @@ function createS3AttachmentBackend(db, config, dependencies = {}) {
 	return new S3AttachmentBackend(db, config, dependencies);
 }
 //#endregion
-export { ATTACHMENT_REFERENCE_MIGRATION_LOCK_TABLE, ATTACHMENT_REFERENCE_MIGRATION_TABLE, ATTACHMENT_REFERENCE_READ_MODEL_ID, ATTACHMENT_REFERENCE_SCHEMA, ATTACHMENT_SCHEMA, AttachmentAlreadyExists, AttachmentBuilder, AttachmentNotFound, AttachmentPending, AttachmentReferenceIndexBuilder, AttachmentReferenceReadModel, AttachmentSchemaCompiler, AttachmentService, AttachmentTransferError, DEFAULT_RESERVATION_TTL_MS, DEFAULT_S3_ATTACHMENT_PREFIX, DEFAULT_S3_DOWNLOAD_TTL_SECONDS, DEFAULT_S3_UPLOAD_TTL_SECONDS, DirectAttachmentUpload, DirectAttachmentUploadFactory, FilesystemAttachmentBackend, HashMismatch, InvalidAttachmentRef, KyselyAttachmentReferenceStore, KyselyAttachmentStore, KyselyReservationStore, MAX_S3_PRESIGN_TTL_SECONDS, NullAttachmentTransport, RemoteAttachmentStore, RemoteAttachmentUpload, RemoteAttachmentUploadFactory, RemoteReservationStore, ReservationNotFound, S3AttachmentBackend, S3AttachmentPrimitives, S3AttachmentUploadFactory, SizeMismatch, SwitchboardAttachmentTransport, UploadTooLarge, createFetchUploadTransport, createRef, createRemoteAttachmentService, createS3AttachmentBackend, createS3AttachmentPrimitives, createXhrUploadTransport, deriveS3AttachmentKey, getAttachmentReferenceMigrationStatus, normalizeS3AttachmentPrefix, parseAttachmentDownloadTarget, parseAttachmentStorageConfig, parseAttachmentUploadTarget, parseRef, rollbackAttachmentReferenceMigration, runAttachmentMigrations, runAttachmentReferenceMigrations, sha256HexToBase64 };
+export { ATTACHMENT_REFERENCE_MIGRATION_LOCK_TABLE, ATTACHMENT_REFERENCE_MIGRATION_TABLE, ATTACHMENT_REFERENCE_READ_MODEL_ID, ATTACHMENT_REFERENCE_SCHEMA, ATTACHMENT_SCHEMA, AttachmentAlreadyExists, AttachmentBuilder, AttachmentNotFound, AttachmentPending, AttachmentReferenceIndexBuilder, AttachmentReferenceReadModel, AttachmentSchemaCompiler, AttachmentService, AttachmentTransferError, DEFAULT_RESERVATION_TTL_MS, DEFAULT_S3_ATTACHMENT_PREFIX, DEFAULT_S3_DOWNLOAD_TTL_SECONDS, DEFAULT_S3_UPLOAD_TTL_SECONDS, DirectAttachmentUpload, DirectAttachmentUploadFactory, FilesystemAttachmentBackend, HashMismatch, InvalidAttachmentMetadata, InvalidAttachmentRef, KyselyAttachmentReferenceStore, KyselyAttachmentStore, KyselyReservationStore, MAX_S3_PRESIGN_TTL_SECONDS, NullAttachmentTransport, RemoteAttachmentStore, RemoteAttachmentUpload, RemoteAttachmentUploadFactory, RemoteReservationStore, ReservationNotFound, S3AttachmentBackend, S3AttachmentPrimitives, S3AttachmentUploadFactory, SizeMismatch, SwitchboardAttachmentTransport, UploadTooLarge, createFetchUploadTransport, createRef, createRemoteAttachmentService, createS3AttachmentBackend, createS3AttachmentPrimitives, createXhrUploadTransport, deriveS3AttachmentKey, getAttachmentReferenceMigrationStatus, normalizeS3AttachmentPrefix, parseAttachmentDownloadTarget, parseAttachmentStorageConfig, parseAttachmentUploadTarget, parseRef, rollbackAttachmentReferenceMigration, runAttachmentMigrations, runAttachmentReferenceMigrations, sha256HexToBase64, validateReserveMetadata };
 
 //# sourceMappingURL=index.js.map