@tangle-network/agent-app 0.45.57 → 0.45.59

package/dist/chat-routes/index.js

@@ -1,3 +1,6 @@
+import {
+  redactErrorMessage
+} from "../chunk-CDC5HFKL.js";
 import {
   createSandboxFileIndexRoute
 } from "../chunk-QY4BRKRJ.js";
@@ -2262,6 +2265,21 @@ function createUploadRoute(options) {
   };
 }
 
+// src/chat-routes/attachment-store.ts
+var ATTACHMENT_STORAGE_FAILURE_MESSAGE = "Attachment storage is temporarily unavailable. Please try again.";
+function immutableAttachmentPath(logicalPath, ownershipId) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(ownershipId)) {
+    throw new Error("attachment ownership id must be a path-safe identifier");
+  }
+  return `${logicalPath}--${ownershipId}`;
+}
+function createAtomicAttachmentWriter(input) {
+  return {
+    write: input.write.bind(input),
+    abort: input.abort.bind(input)
+  };
+}
+
 // src/chat-routes/resolve-attachments.ts
 var MAX_ATTACHMENT_NAME_LENGTH = 256;
 function isAttachmentKind(value) {
@@ -2357,6 +2375,47 @@ async function resolveChatAttachments(value, options) {
   return { succeeded: true, value: inputs.map(attachmentInputToPart) };
 }
 
+// src/chat-routes/attachment-write-safety.ts
+function objectLike(value) {
+  return value !== null && (typeof value === "object" || typeof value === "function");
+}
+function inspectLegacyAttachmentWriteResult(value) {
+  try {
+    if (!objectLike(value)) return void 0;
+    const ok = value.ok;
+    if (ok === true) return { ok: true };
+    if (ok === false && typeof value.reason === "string") {
+      return { ok: false, reason: value.reason };
+    }
+  } catch {
+  }
+  return void 0;
+}
+function inspectAtomicAttachmentWriteResult(value, ownership) {
+  try {
+    if (!objectLike(value)) return void 0;
+    const receiptValue = value.receipt;
+    if (!objectLike(receiptValue)) return void 0;
+    const receiptOwnership = receiptValue.ownership;
+    if (!objectLike(receiptOwnership)) return void 0;
+    if (receiptOwnership.id !== ownership.id || receiptOwnership.path !== ownership.path || typeof receiptOwnership.id !== "string" || typeof receiptOwnership.path !== "string" || typeof receiptValue.rollback !== "function") {
+      return void 0;
+    }
+    if (value.ok === true) {
+      return { ok: true, receipt: receiptValue };
+    }
+    if (value.ok === false && typeof value.reason === "string") {
+      return {
+        ok: false,
+        reason: value.reason,
+        receipt: receiptValue
+      };
+    }
+  } catch {
+  }
+  return void 0;
+}
+
 // src/chat-routes/promote-file-part.ts
 var PROMOTE_MAX_FILE_BYTES = 10 * 1024 * 1024;
 var EXT_TO_MIME = {
@@ -2484,11 +2543,41 @@ function defaultBuildAttachmentPath(args) {
   const base = extension ? args.filename.slice(0, -extension.length) : args.filename;
   return `uploads/agent/${args.date}/${base}-${args.hash8}${extension}`;
 }
+function logPromotionStorageError(logger, message, fields) {
+  try {
+    logger.error(message, fields);
+  } catch {
+  }
+}
+async function compensatePromotionWrite(writer, scopeId, ownership, receipt) {
+  try {
+    await receipt.rollback();
+    return {};
+  } catch (rollbackError) {
+    try {
+      await writer.abort(scopeId, ownership);
+      return { rollbackError };
+    } catch (abortError) {
+      return { rollbackError, abortError };
+    }
+  }
+}
+function isAtomicPromotionOptions(options) {
+  return "attachmentWriter" in options;
+}
 async function promoteAgentFilePart(options) {
+  const atomic = isAtomicPromotionOptions(options);
   const maxBytes = options.maxBytes ?? PROMOTE_MAX_FILE_BYTES;
   const sniffMime = options.sniffMime ?? sniffMimeFromName;
   const buildAttachmentPath = options.buildAttachmentPath ?? defaultBuildAttachmentPath;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const logger = options.logger ?? console;
+  const createWriteId = atomic ? options.createWriteId ?? (() => {
+    if (typeof crypto === "undefined" || typeof crypto.randomUUID !== "function") {
+      throw new Error("attachment promotion requires crypto.randomUUID");
+    }
+    return crypto.randomUUID();
+  }) : void 0;
   const filename = sanitizeAttachmentFileName(
     options.raw.filename ?? basenameFromUrl(options.raw.url) ?? "agent-file"
   );
@@ -2504,19 +2593,118 @@ async function promoteAgentFilePart(options) {
   const kind = attachmentKindForMime(mediaType);
   const digest = await hash8(options.raw.id ?? options.raw.url ?? filename);
   const date = now().toISOString().split("T")[0] ?? "";
-  const path = buildAttachmentPath({ filename, hash8: digest, date, mediaType, kind });
+  const logicalPath = buildAttachmentPath({ filename, hash8: digest, date, mediaType, kind });
+  if (!atomic) {
+    let written2;
+    try {
+      written2 = await options.writeAttachment(options.scopeId, logicalPath, resolved.bytes, {
+        mediaType,
+        name: filename,
+        originalName: options.raw.filename ?? filename,
+        size: resolved.bytes.byteLength
+      });
+    } catch (error) {
+      const reason = redactErrorMessage(error);
+      logPromotionStorageError(logger, "[promote-file-part] legacy writer failed", {
+        path: logicalPath,
+        error: reason
+      });
+      return { succeeded: false, filename, reason };
+    }
+    const result2 = inspectLegacyAttachmentWriteResult(written2);
+    if (!result2) {
+      logPromotionStorageError(logger, "[promote-file-part] legacy writer returned an invalid result", {
+        path: logicalPath
+      });
+      return { succeeded: false, filename, reason: ATTACHMENT_STORAGE_FAILURE_MESSAGE };
+    }
+    if (!result2.ok) {
+      const reason = redactErrorMessage(result2.reason);
+      logPromotionStorageError(logger, "[promote-file-part] legacy write rejected", {
+        path: logicalPath,
+        error: reason
+      });
+      return { succeeded: false, filename, reason };
+    }
+    return {
+      succeeded: true,
+      part: {
+        type: kind,
+        path: logicalPath,
+        name: filename,
+        size: resolved.bytes.byteLength,
+        mediaType
+      }
+    };
+  }
+  let ownershipId;
+  let path;
+  try {
+    ownershipId = createWriteId();
+    path = immutableAttachmentPath(logicalPath, ownershipId);
+  } catch (error) {
+    logPromotionStorageError(logger, "[promote-file-part] could not allocate ownership key", {
+      path: logicalPath,
+      error: redactErrorMessage(error)
+    });
+    return { succeeded: false, filename, reason: ATTACHMENT_STORAGE_FAILURE_MESSAGE };
+  }
+  const ownership = { id: ownershipId, path };
   let written;
   try {
-    written = await options.writeAttachment(options.scopeId, path, resolved.bytes, {
+    written = await options.attachmentWriter.write(options.scopeId, path, resolved.bytes, {
       mediaType,
       name: filename,
       originalName: options.raw.filename ?? filename,
-      size: resolved.bytes.byteLength
+      size: resolved.bytes.byteLength,
+      ownership
     });
   } catch (err) {
-    return { succeeded: false, filename, reason: err instanceof Error ? err.message : String(err) };
+    let abortError;
+    try {
+      await options.attachmentWriter.abort(options.scopeId, ownership);
+    } catch (error) {
+      abortError = error;
+    }
+    logPromotionStorageError(logger, "[promote-file-part] write failed", {
+      path,
+      ownershipId: ownership.id,
+      error: redactErrorMessage(err),
+      ...abortError === void 0 ? {} : { abortError: redactErrorMessage(abortError) }
+    });
+    return { succeeded: false, filename, reason: ATTACHMENT_STORAGE_FAILURE_MESSAGE };
+  }
+  const result = inspectAtomicAttachmentWriteResult(written, ownership);
+  if (!result) {
+    let abortError;
+    try {
+      await options.attachmentWriter.abort(options.scopeId, ownership);
+    } catch (error) {
+      abortError = error;
+    }
+    logPromotionStorageError(logger, "[promote-file-part] writer returned a mismatched ownership receipt", {
+      path,
+      ownershipId: ownership.id,
+      ...abortError === void 0 ? {} : { abortError: redactErrorMessage(abortError) }
+    });
+    return { succeeded: false, filename, reason: ATTACHMENT_STORAGE_FAILURE_MESSAGE };
+  }
+  if (!result.ok) {
+    const compensation = await compensatePromotionWrite(
+      options.attachmentWriter,
+      options.scopeId,
+      ownership,
+      result.receipt
+    );
+    logPromotionStorageError(logger, "[promote-file-part] write rejected", {
+      path,
+      ownershipId: ownership.id,
+      error: redactErrorMessage(result.reason),
+      ...compensation.rollbackError === void 0 ? {} : { rollbackError: redactErrorMessage(compensation.rollbackError) },
+      ...compensation.abortError === void 0 ? {} : { abortError: redactErrorMessage(compensation.abortError) }
+    });
+    return { succeeded: false, filename, reason: ATTACHMENT_STORAGE_FAILURE_MESSAGE };
   }
-  if (!written.ok) return { succeeded: false, filename, reason: written.reason };
   return {
     succeeded: true,
     part: {
@@ -2530,13 +2718,54 @@ async function promoteAgentFilePart(options) {
 }
 
 // src/chat-routes/attachment-upload.ts
+function logAttachmentUploadError(logger, message, fields) {
+  try {
+    logger.error(message, fields);
+  } catch {
+  }
+}
 function attachmentUploadError(status, code, message, path) {
   return Response.json(
     { error: path === void 0 ? { code, message } : { code, message, path } },
     { status }
   );
 }
+async function rollbackSuccessfulWrites(writes, scopeId, writer, logger) {
+  let failures = 0;
+  for (let index = writes.length - 1; index >= 0; index -= 1) {
+    const write = writes[index];
+    try {
+      await write.receipt.rollback();
+    } catch (error) {
+      failures += 1;
+      logAttachmentUploadError(logger, "[attachment-upload] cleanup failed", {
+        path: write.path,
+        ownershipId: write.ownership.id,
+        error: redactErrorMessage(error)
+      });
+      failures += await abortOwnership(writer, scopeId, write.ownership, logger);
+    }
+  }
+  return failures;
+}
+async function abortOwnership(writer, scopeId, ownership, logger) {
+  try {
+    await writer.abort(scopeId, ownership);
+    return 0;
+  } catch (error) {
+    logAttachmentUploadError(logger, "[attachment-upload] ambiguous write cleanup failed", {
+      path: ownership.path,
+      ownershipId: ownership.id,
+      error: redactErrorMessage(error)
+    });
+    return 1;
+  }
+}
+function isAtomicRouteOptions(options) {
+  return "attachmentWriter" in options;
+}
 function createAttachmentUploadRoute(options) {
+  const atomic = isAtomicRouteOptions(options);
   const maxCount = options.limits?.maxCount ?? ATTACHMENT_MAX_COUNT;
   const maxBinaryBytes = options.limits?.maxBinaryBytes ?? MAX_BINARY_ATTACHMENT_BYTES;
   const maxBytesBySniffedMime = options.limits?.maxBytesBySniffedMime;
@@ -2547,10 +2776,21 @@ function createAttachmentUploadRoute(options) {
   const pathFor = options.pathFor ?? ((name) => name);
   const validatePath = options.validatePath ?? defaultValidateAttachmentPath;
   const sniffMime = options.sniffMime ?? sniffMimeFromName;
+  const createWriteId = atomic ? options.createWriteId ?? (() => {
+    if (typeof crypto === "undefined" || typeof crypto.randomUUID !== "function") {
+      throw new Error("attachment upload requires crypto.randomUUID");
+    }
+    return crypto.randomUUID();
+  }) : void 0;
+  const logger = options.logger ?? console;
   return async function attachmentUpload(request) {
     const auth = await options.authorize({ request });
     if (!auth.ok) return auth.response;
-    const write = auth.writeAttachment ?? options.writeAttachment;
+    const atomicWriter = atomic ? auth.attachmentWriter ?? options.attachmentWriter : void 0;
+    const legacyWriter = atomic ? void 0 : auth.writeAttachment ?? options.writeAttachment;
+    if (atomic && !atomicWriter) {
+      return attachmentUploadError(503, "attachment_store_unavailable", ATTACHMENT_STORAGE_FAILURE_MESSAGE);
+    }
     let form;
     try {
       form = await request.formData();
@@ -2580,7 +2820,7 @@ function createAttachmentUploadRoute(options) {
       );
     }
     const prepared = [];
-    const seenPaths = /* @__PURE__ */ new Set();
+    const seenLogicalPaths = /* @__PURE__ */ new Set();
     let totalBytes = 0;
     for (const file of files) {
       const bytes = new Uint8Array(await file.arrayBuffer());
@@ -2613,20 +2853,40 @@ function createAttachmentUploadRoute(options) {
           attachmentSizeErrorMessage(name, bytes.length, limit)
         );
       }
-      const path = pathFor(name);
+      const logicalPath = pathFor(name);
+      let ownershipId;
+      let path = logicalPath;
+      if (atomic) {
+        try {
+          ownershipId = createWriteId();
+          path = immutableAttachmentPath(logicalPath, ownershipId);
+        } catch (error) {
+          logAttachmentUploadError(logger, "[attachment-upload] could not allocate ownership key", {
+            path: logicalPath,
+            error: redactErrorMessage(error)
+          });
+          return attachmentUploadError(
+            503,
+            "attachment_store_unavailable",
+            ATTACHMENT_STORAGE_FAILURE_MESSAGE,
+            logicalPath
+          );
+        }
+      }
       const pathCheck = validatePath(path);
       if (!pathCheck.succeeded) {
         return attachmentUploadError(400, "invalid_attachment_path", pathCheck.error, path);
       }
-      if (seenPaths.has(path)) {
+      const duplicatePath = atomic ? logicalPath : path;
+      if (seenLogicalPaths.has(duplicatePath)) {
         return attachmentUploadError(
           400,
           "attachment_duplicate_path",
-          `attachments must not repeat a path within one upload: ${path}`,
+          `attachments must not repeat a path within one upload: ${duplicatePath}`,
           path
         );
       }
-      seenPaths.add(path);
+      seenLogicalPaths.add(duplicatePath);
       totalBytes += bytes.length;
       if (totalBytes > maxTotalBytes) {
         return attachmentUploadError(
@@ -2636,19 +2896,123 @@ function createAttachmentUploadRoute(options) {
         );
       }
       const mediaType = sniff.mime ?? sniffMime(name);
-      prepared.push({ path, name, bytes, originalName: file.name, size: bytes.length, mediaType, kind });
+      prepared.push({ path, ownershipId, name, bytes, originalName: file.name, size: bytes.length, mediaType, kind });
     }
     const uploaded = [];
+    const successfulWrites = [];
     for (const input of prepared) {
-      const written = await write(auth.scopeId, input.path, input.bytes, {
-        mediaType: input.mediaType,
-        name: input.name,
-        originalName: input.originalName,
-        size: input.size
-      });
-      if (!written.ok) {
-        return attachmentUploadError(413, "attachment_write_failed", written.reason, input.path);
+      if (!atomic) {
+        let written2;
+        try {
+          written2 = await legacyWriter(auth.scopeId, input.path, input.bytes, {
+            mediaType: input.mediaType,
+            name: input.name,
+            originalName: input.originalName,
+            size: input.size
+          });
+        } catch (error) {
+          logAttachmentUploadError(logger, "[attachment-upload] legacy writer failed", {
+            path: input.path,
+            error: redactErrorMessage(error)
+          });
+          return attachmentUploadError(
+            503,
+            "attachment_store_unavailable",
+            ATTACHMENT_STORAGE_FAILURE_MESSAGE,
+            input.path
+          );
+        }
+        const result2 = inspectLegacyAttachmentWriteResult(written2);
+        if (!result2) {
+          logAttachmentUploadError(logger, "[attachment-upload] legacy writer returned an invalid result", {
+            path: input.path
+          });
+          return attachmentUploadError(
+            503,
+            "attachment_store_unavailable",
+            ATTACHMENT_STORAGE_FAILURE_MESSAGE,
+            input.path
+          );
+        }
+        if (!result2.ok) {
+          const reason = redactErrorMessage(result2.reason);
+          logAttachmentUploadError(logger, "[attachment-upload] legacy write rejected", {
+            path: input.path,
+            error: reason
+          });
+          return attachmentUploadError(413, "attachment_write_failed", reason, input.path);
+        }
+        uploaded.push({
+          path: input.path,
+          name: input.name,
+          size: input.size,
+          mediaType: input.mediaType,
+          kind: input.kind
+        });
+        continue;
+      }
+      const ownershipId = input.ownershipId;
+      if (!ownershipId) {
+        return attachmentUploadError(503, "attachment_store_unavailable", ATTACHMENT_STORAGE_FAILURE_MESSAGE, input.path);
+      }
+      const ownership = { id: ownershipId, path: input.path };
+      let written;
+      try {
+        written = await atomicWriter.write(auth.scopeId, input.path, input.bytes, {
+          mediaType: input.mediaType,
+          name: input.name,
+          originalName: input.originalName,
+          size: input.size,
+          ownership
+        });
+      } catch (error) {
+        const cleanupFailures = await abortOwnership(atomicWriter, auth.scopeId, ownership, logger) + await rollbackSuccessfulWrites(successfulWrites, auth.scopeId, atomicWriter, logger);
+        logAttachmentUploadError(logger, "[attachment-upload] write failed", {
+          path: input.path,
+          ownershipId: ownership.id,
+          cleanupFailures,
+          error: redactErrorMessage(error)
+        });
+        return attachmentUploadError(
+          503,
+          "attachment_store_unavailable",
+          ATTACHMENT_STORAGE_FAILURE_MESSAGE,
+          input.path
+        );
+      }
+      const result = inspectAtomicAttachmentWriteResult(written, ownership);
+      if (!result) {
+        const cleanupFailures = await abortOwnership(atomicWriter, auth.scopeId, ownership, logger) + await rollbackSuccessfulWrites(successfulWrites, auth.scopeId, atomicWriter, logger);
+        logAttachmentUploadError(logger, "[attachment-upload] writer returned a mismatched ownership receipt", {
+          path: input.path,
+          ownershipId: ownership.id,
+          cleanupFailures
+        });
+        return attachmentUploadError(503, "attachment_store_unavailable", ATTACHMENT_STORAGE_FAILURE_MESSAGE, input.path);
+      }
+      if (!result.ok) {
+        const cleanupFailures = await rollbackSuccessfulWrites([
+          { path: input.path, ownership, receipt: result.receipt }
+        ], auth.scopeId, atomicWriter, logger) + await rollbackSuccessfulWrites(
+          successfulWrites,
+          auth.scopeId,
+          atomicWriter,
+          logger
+        );
+        logAttachmentUploadError(logger, "[attachment-upload] write rejected", {
+          path: input.path,
+          ownershipId: ownership.id,
+          cleanupFailures,
+          error: redactErrorMessage(result.reason)
+        });
+        return attachmentUploadError(
+          503,
+          "attachment_store_unavailable",
+          ATTACHMENT_STORAGE_FAILURE_MESSAGE,
+          input.path
+        );
       }
+      successfulWrites.push({ path: input.path, ownership, receipt: result.receipt });
       uploaded.push({
         path: input.path,
         name: input.name,
@@ -2881,6 +3245,7 @@ export {
   ALLOWED_ATTACHMENT_SNIFFED_MIMES,
   ATTACHMENT_ACCEPT,
   ATTACHMENT_MAX_COUNT,
+  ATTACHMENT_STORAGE_FAILURE_MESSAGE,
   ChatTurnInputError,
   DEFAULT_MODEL_FIRST_RESPONSE_TIMEOUT_MS,
   DEFAULT_MODEL_STREAM_OPEN_TIMEOUT_MS,
@@ -2920,6 +3285,7 @@ export {
   checkAttachmentType,
   classifyTerminalFailure,
   createAssistantDraftWriter,
+  createAtomicAttachmentWriter,
   createAttachmentUploadRoute,
   createChatTurnRoutes,
   createSandboxChatProducer,
@@ -2928,6 +3294,7 @@ export {
   defaultValidateAttachmentPath,
   fileMentionsToParts,
   formatBytes,
+  immutableAttachmentPath,
   isCommittingSandboxEvent,
   isDraftContentEvent,
   mediaTypeForMentionPath,