@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/stores/container-contents/systemContainerPromotion.js

@@ -0,0 +1,49 @@
+import { base64ToBytes } from "../../internal/encoding/index.js";
+export function hasAdvancedManagedPrincipalReference(containerState) {
+    return (containerState.metadataReferencedPrincipals?.some((principal) => principal.version > 1) ?? false);
+}
+export async function promoteExistingLocalSystemContainerSync(input) {
+    const { containerState, options, rootState, state, syncAgent } = input;
+    const isCurrent = input.isCurrent ?? (() => true);
+    const parentContainerId = containerState.container.parentId;
+    if (options.deferRemoteSync ||
+        !state.runtime.auth.isAuthenticated ||
+        !parentContainerId ||
+        containerState.record.documentId) {
+        return true;
+    }
+    if (options.skipAdvancedManagedRoot &&
+        rootState &&
+        hasAdvancedManagedPrincipalReference(rootState)) {
+        return true;
+    }
+    const execSql = state.runtime.infra.execSql;
+    const [pendingCreateIntents, pendingUpdates] = await Promise.all([
+        state.persistence.listPendingCreateIntents(execSql),
+        state.persistence.listPendingUpdates(execSql, containerState.container.id),
+    ]);
+    if (!isCurrent())
+        return false;
+    const hasPendingCreateIntent = pendingCreateIntents.some((intent) => intent.containerId === containerState.container.id);
+    const shouldQueueCreateIntent = !hasPendingCreateIntent;
+    const shouldQueueMetadataUpdate = pendingUpdates.length === 0;
+    if (!shouldQueueCreateIntent && !shouldQueueMetadataUpdate) {
+        return true;
+    }
+    const persisted = await input.persistPromotion(containerState, {
+        ...(shouldQueueMetadataUpdate
+            ? {
+                metadataUpdate: base64ToBytes(containerState.record.metadataUpdates),
+            }
+            : {}),
+        parentContainerId,
+        queueCreateIntent: shouldQueueCreateIntent,
+    });
+    if (!persisted || !isCurrent()) {
+        return false;
+    }
+    syncAgent.scheduleSync();
+    state.runtime.util.log(`${input.logLabel}: queued system container "${containerState.container.systemSlot ?? containerState.container.id}" for remote sync`);
+    return true;
+}
+//# sourceMappingURL=systemContainerPromotion.js.map

package/stores/container-contents/systemContainerPromotion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemContainerPromotion.js","sourceRoot":"","sources":["systemContainerPromotion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWpD,MAAM,UAAU,oCAAoC,CAClD,cAA8B;IAE9B,OAAO,CACL,cAAc,CAAC,4BAA4B,EAAE,IAAI,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CACrC,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAgB7D;IACC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC5D,IACE,OAAO,CAAC,eAAe;QACvB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,iBAAiB;QAClB,cAAc,CAAC,MAAM,CAAC,UAAU,EAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,OAAO,CAAC,uBAAuB;QAC/B,SAAS;QACT,oCAAoC,CAAC,SAAS,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,CAAC,oBAAoB,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/D,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC;QACnD,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,IAAI,CACtD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,KAAK,cAAc,CAAC,SAAS,CAAC,EAAE,CAC/D,CAAC;IACF,MAAM,uBAAuB,GAAG,CAAC,sBAAsB,CAAC;IACxD,MAAM,yBAAyB,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,uBAAuB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE;QAC7D,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE,cAAc,EAAE,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,iBAAiB;QACjB,iBAAiB,EAAE,uBAAuB;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,YAAY,EAAE,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,GAAG,KAAK,CAAC,QAAQ,8BAA8B,cAAc,CAAC,SAAS,CAAC,UAAU,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,mBAAmB,CACrI,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type {\n  ContainerContentsStoreSyncAgent,\n  ContainerState,\n} from \"./syncAgent\";\nimport type {\n  ContainerContentsStoreState,\n  EnsureSystemContainerOptions,\n} from \"./types\";\nimport type { ContainerWriteGuard } from \"./writeGeneration\";\n\nexport function hasAdvancedManagedPrincipalReference(\n  containerState: ContainerState,\n): boolean {\n  return (\n    containerState.metadataReferencedPrincipals?.some(\n      (principal) => principal.version > 1,\n    ) ?? false\n  );\n}\n\nexport async function promoteExistingLocalSystemContainerSync(input: {\n  containerState: ContainerState;\n  logLabel: string;\n  options: EnsureSystemContainerOptions;\n  persistPromotion: (\n    containerState: ContainerState,\n    promotion: {\n      metadataUpdate?: Uint8Array | undefined;\n      parentContainerId: string;\n      queueCreateIntent: boolean;\n    },\n  ) => Promise<boolean>;\n  rootState: ContainerState | null;\n  state: ContainerContentsStoreState;\n  syncAgent: ContainerContentsStoreSyncAgent;\n  isCurrent?: ContainerWriteGuard | undefined;\n}): Promise<boolean> {\n  const { containerState, options, rootState, state, syncAgent } = input;\n  const isCurrent = input.isCurrent ?? (() => true);\n  const parentContainerId = containerState.container.parentId;\n  if (\n    options.deferRemoteSync ||\n    !state.runtime.auth.isAuthenticated ||\n    !parentContainerId ||\n    containerState.record.documentId\n  ) {\n    return true;\n  }\n\n  if (\n    options.skipAdvancedManagedRoot &&\n    rootState &&\n    hasAdvancedManagedPrincipalReference(rootState)\n  ) {\n    return true;\n  }\n\n  const execSql = state.runtime.infra.execSql;\n  const [pendingCreateIntents, pendingUpdates] = await Promise.all([\n    state.persistence.listPendingCreateIntents(execSql),\n    state.persistence.listPendingUpdates(execSql, containerState.container.id),\n  ]);\n  if (!isCurrent()) return false;\n  const hasPendingCreateIntent = pendingCreateIntents.some(\n    (intent) => intent.containerId === containerState.container.id,\n  );\n  const shouldQueueCreateIntent = !hasPendingCreateIntent;\n  const shouldQueueMetadataUpdate = pendingUpdates.length === 0;\n  if (!shouldQueueCreateIntent && !shouldQueueMetadataUpdate) {\n    return true;\n  }\n\n  const persisted = await input.persistPromotion(containerState, {\n    ...(shouldQueueMetadataUpdate\n      ? {\n          metadataUpdate: base64ToBytes(containerState.record.metadataUpdates),\n        }\n      : {}),\n    parentContainerId,\n    queueCreateIntent: shouldQueueCreateIntent,\n  });\n  if (!persisted || !isCurrent()) {\n    return false;\n  }\n\n  syncAgent.scheduleSync();\n  state.runtime.util.log(\n    `${input.logLabel}: queued system container \"${containerState.container.systemSlot ?? containerState.container.id}\" for remote sync`,\n  );\n  return true;\n}\n"]}

package/stores/container-contents/types.d.ts

@@ -0,0 +1,88 @@
+import type { ContainerAccessLevel, ReferencedPrincipalHead } from "../../internal/crypto/index.js";
+import type { ContainerSystemSlot } from "../../internal/validators/containerSystemSlot.js";
+import type { ContainerWriterProjectionResponse } from "../../internal/validators/response/index.js";
+import type { PurgeOptions } from "../../workflows/container-contents/container-state/purgeProgress.js";
+import type { ContainerContentsPersistence } from "../../workflows/container-contents/containerPersistence.js";
+import type { ContainerDocumentObjectSyncState } from "../../workflows/container-contents/syncState.js";
+import type { ContainerContentsStoreRuntime, ContainerContentsStoreSyncState, RefreshRootLaneOptions } from "./syncAgentTypes.js";
+export type ContainerContentsShareAccessLevel = ContainerAccessLevel;
+export interface ContainerContentsStoreOptions {
+    logLabel?: string | undefined;
+    persistence?: ContainerContentsPersistence | undefined;
+}
+export interface ContainerNode {
+    systemSlot?: ContainerSystemSlot | null;
+    createdAt?: string | null;
+    effectiveAccessLevel?: ContainerAccessLevel | undefined;
+    id: string;
+    icon?: string | null;
+    metadataDocumentId?: string | null;
+    organizationId: string;
+    name: string;
+    parentId: string | null;
+    syncState: ContainerDocumentObjectSyncState;
+    kind: "container";
+    updatedAt?: string | null;
+}
+export type ContainerContentsContextValue = ContainerContentsSnapshot & Pick<ContainerContentsStore, "createChild" | "deleteContainer" | "emptyTrash" | "ensureSystemContainer" | "moveContainer" | "purgeContainer" | "refresh" | "refreshRootLane" | "renameContainer" | "requestSync" | "setContainerIcon" | "shareWithGroup" | "shareWithUser">;
+export interface ContainerContentsSnapshot {
+    nodes: ReadonlyArray<ContainerNode>;
+    ready: boolean;
+}
+export type ContainerGroupRewrapPreparation = {
+    status: "not-granted";
+} | {
+    isCurrent(expectedGroupHead: ReferencedPrincipalHead, expectedContainerId: string, expectedOrganizationId: string): Promise<boolean>;
+    rewrap(): Promise<boolean>;
+    status: "prepared";
+};
+/**
+ * Shared per-scope container tree and mutation store.
+ *
+ * Ordinary metadata/topology writes (`createChild`, `moveContainer`,
+ * `renameContainer`, and `setContainerIcon`) commit to local persistence and
+ * update subscribers before their queued remote sync converges. Destructive
+ * and access-control operations retain their explicit remote-authority gates.
+ */
+export interface ContainerContentsStore {
+    createChild: (parentId: string, name: string) => Promise<ContainerNode | null>;
+    deleteContainer: (containerId: string) => Promise<boolean>;
+    ensureSystemContainer: (systemSlot: ContainerSystemSlot, name: string, options?: EnsureSystemContainerOptions | undefined) => Promise<ContainerNode | null>;
+    moveContainer: (containerId: string, parentId: string) => Promise<ContainerNode | null>;
+    purgeContainer: (containerId: string, options?: PurgeOptions) => Promise<boolean>;
+    emptyTrash: (trashContainerId: string, options?: PurgeOptions) => Promise<boolean>;
+    prepareGroupRewrap: (containerId: string, groupId: string, accessLevel: ContainerContentsShareAccessLevel, options?: {
+        requireExistingGrant?: boolean;
+    } | undefined) => Promise<ContainerGroupRewrapPreparation | null>;
+    refresh: () => Promise<boolean>;
+    refreshRootLane: (options?: RefreshRootLaneOptions) => Promise<boolean>;
+    refreshLocalContainers: () => Promise<void>;
+    requestSync: () => void;
+    renameContainer: (containerId: string, name: string) => Promise<ContainerNode | null>;
+    setContainerIcon: (containerId: string, icon: string | null) => Promise<ContainerNode | null>;
+    shareWithGroup: (containerId: string, groupId: string, accessLevel: ContainerContentsShareAccessLevel, options: {
+        /**
+         * The display name the group was chosen by. Required: the share fails
+         * closed if the verified group policy commits a different name. Signed
+         * names are unique within an organization by construction (enforced at
+         * group creation), so the target's own name identifies it.
+         */
+        expectedGroupName: string;
+    }) => Promise<boolean>;
+    shareWithUser: (containerId: string, userId: string) => Promise<boolean>;
+    getCachedContainerWriterProjection: (containerId: string) => ContainerWriterProjectionResponse | null;
+    getSnapshot: () => ContainerContentsSnapshot;
+    subscribe: (listener: () => void) => () => void;
+    updateRuntime: (runtime: ContainerContentsStoreRuntime) => void;
+}
+export interface EnsureSystemContainerOptions {
+    icon?: string | null | undefined;
+    skipAdvancedManagedRoot?: boolean | undefined;
+    deferRemoteBootstrap?: boolean | undefined;
+    deferRemoteSync?: boolean | undefined;
+}
+export interface ContainerContentsStoreState extends ContainerContentsStoreSyncState {
+    listeners: Set<() => void>;
+    snapshot: ContainerContentsSnapshot;
+    writeChain: Promise<ContainerNode | null>;
+}

package/stores/container-contents/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/stores/container-contents/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  ContainerAccessLevel,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { PurgeOptions } from \"../../workflows/container-contents/container-state/purgeProgress\";\nimport type { ContainerContentsPersistence } from \"../../workflows/container-contents/containerPersistence\";\nimport type { ContainerDocumentObjectSyncState } from \"../../workflows/container-contents/syncState\";\nimport type {\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreSyncState,\n  RefreshRootLaneOptions,\n} from \"./syncAgentTypes\";\n\n// Reuse the canonical access-level union from the crypto layer (the same source\n// `ContainerShareAccessLevel` chains to) rather than re-spelling the literals,\n// so the two can't drift.\nexport type ContainerContentsShareAccessLevel = ContainerAccessLevel;\n\nexport interface ContainerContentsStoreOptions {\n  logLabel?: string | undefined;\n  persistence?: ContainerContentsPersistence | undefined;\n}\n\nexport interface ContainerNode {\n  systemSlot?: ContainerSystemSlot | null;\n  createdAt?: string | null;\n  effectiveAccessLevel?: ContainerAccessLevel | undefined;\n  id: string;\n  icon?: string | null;\n  metadataDocumentId?: string | null;\n  organizationId: string;\n  name: string;\n  parentId: string | null;\n  syncState: ContainerDocumentObjectSyncState;\n  kind: \"container\";\n  updatedAt?: string | null;\n}\n\n// The store surface exposed through context: the snapshot fields plus the\n// store's mutation/refresh methods, spelled as a Pick so the two can't drift.\nexport type ContainerContentsContextValue = ContainerContentsSnapshot &\n  Pick<\n    ContainerContentsStore,\n    | \"createChild\"\n    | \"deleteContainer\"\n    | \"emptyTrash\"\n    | \"ensureSystemContainer\"\n    | \"moveContainer\"\n    | \"purgeContainer\"\n    | \"refresh\"\n    | \"refreshRootLane\"\n    | \"renameContainer\"\n    | \"requestSync\"\n    | \"setContainerIcon\"\n    | \"shareWithGroup\"\n    | \"shareWithUser\"\n  >;\n\nexport interface ContainerContentsSnapshot {\n  nodes: ReadonlyArray<ContainerNode>;\n  ready: boolean;\n}\n\nexport type ContainerGroupRewrapPreparation =\n  | {\n      status: \"not-granted\";\n    }\n  | {\n      isCurrent(\n        expectedGroupHead: ReferencedPrincipalHead,\n        expectedContainerId: string,\n        expectedOrganizationId: string,\n      ): Promise<boolean>;\n      rewrap(): Promise<boolean>;\n      status: \"prepared\";\n    };\n\n/**\n * Shared per-scope container tree and mutation store.\n *\n * Ordinary metadata/topology writes (`createChild`, `moveContainer`,\n * `renameContainer`, and `setContainerIcon`) commit to local persistence and\n * update subscribers before their queued remote sync converges. Destructive\n * and access-control operations retain their explicit remote-authority gates.\n */\nexport interface ContainerContentsStore {\n  createChild: (\n    parentId: string,\n    name: string,\n  ) => Promise<ContainerNode | null>;\n  deleteContainer: (containerId: string) => Promise<boolean>;\n  ensureSystemContainer: (\n    systemSlot: ContainerSystemSlot,\n    name: string,\n    options?: EnsureSystemContainerOptions | undefined,\n  ) => Promise<ContainerNode | null>;\n  moveContainer: (\n    containerId: string,\n    parentId: string,\n  ) => Promise<ContainerNode | null>;\n  purgeContainer: (\n    containerId: string,\n    options?: PurgeOptions,\n  ) => Promise<boolean>;\n  emptyTrash: (\n    trashContainerId: string,\n    options?: PurgeOptions,\n  ) => Promise<boolean>;\n  // `options.requireExistingGrant` gates the preparation check only. The\n  // prepared `rewrap` is always grant-preserving: it re-wraps a signed grant\n  // and never mints one, so it carries no chosen group name, and it throws\n  // (rather than healing through a policy mutation) when the container\n  // manifest grants the group but the verified policy has no matching grant.\n  prepareGroupRewrap: (\n    containerId: string,\n    groupId: string,\n    accessLevel: ContainerContentsShareAccessLevel,\n    options?: { requireExistingGrant?: boolean } | undefined,\n  ) => Promise<ContainerGroupRewrapPreparation | null>;\n  refresh: () => Promise<boolean>;\n  refreshRootLane: (options?: RefreshRootLaneOptions) => Promise<boolean>;\n  // Re-read root-lane containers from local SQLite into the snapshot with NO\n  // server round-trip. Surfaces a just-persisted container — e.g. the Trash bin\n  // that registration/org-creation provisioned server-side and wrote to SQLite\n  // via persistRegistrationBootstrap — instantly, instead of waiting for the\n  // remote root-lane pull. Idempotent with a later remote pull: the merge is\n  // keyed by container id, so the pull reconciles in place rather than duplicating.\n  refreshLocalContainers: () => Promise<void>;\n  requestSync: () => void;\n  renameContainer: (\n    containerId: string,\n    name: string,\n  ) => Promise<ContainerNode | null>;\n  setContainerIcon: (\n    containerId: string,\n    icon: string | null,\n  ) => Promise<ContainerNode | null>;\n  shareWithGroup: (\n    containerId: string,\n    groupId: string,\n    accessLevel: ContainerContentsShareAccessLevel,\n    options: {\n      /**\n       * The display name the group was chosen by. Required: the share fails\n       * closed if the verified group policy commits a different name. Signed\n       * names are unique within an organization by construction (enforced at\n       * group creation), so the target's own name identifies it.\n       */\n      expectedGroupName: string;\n    },\n  ) => Promise<boolean>;\n  shareWithUser: (containerId: string, userId: string) => Promise<boolean>;\n  getCachedContainerWriterProjection: (\n    containerId: string,\n  ) => ContainerWriterProjectionResponse | null;\n  getSnapshot: () => ContainerContentsSnapshot;\n  subscribe: (listener: () => void) => () => void;\n  updateRuntime: (runtime: ContainerContentsStoreRuntime) => void;\n}\n\nexport interface EnsureSystemContainerOptions {\n  icon?: string | null | undefined;\n  skipAdvancedManagedRoot?: boolean | undefined;\n  // For local-first bootstrap paths where slow remote I/O must not block the\n  // caller from creating the deterministic local system container.\n  deferRemoteBootstrap?: boolean | undefined;\n  // Create the deterministic local system container without queuing the remote\n  // create. A later ensureSystemContainer call without this flag promotes the\n  // local slot into the sync queue.\n  deferRemoteSync?: boolean | undefined;\n}\n\nexport interface ContainerContentsStoreState\n  extends ContainerContentsStoreSyncState {\n  listeners: Set<() => void>;\n  snapshot: ContainerContentsSnapshot;\n  writeChain: Promise<ContainerNode | null>;\n}\n"]}

package/stores/container-contents/utils.js

@@ -0,0 +1,63 @@
+import { normalizeEffectiveAccessLevel } from "../../data/accessLevel.js";
+import { createContainerDocumentObjectSyncState } from "../../workflows/container-contents/syncState.js";
+function hasPendingContainerTimestamp(container) {
+    const localUpdatedAt = container.localUpdatedAt ?? null;
+    const serverUpdatedAt = container.serverUpdatedAt ?? null;
+    return (localUpdatedAt !== null &&
+        (serverUpdatedAt === null ||
+            localUpdatedAt.localeCompare(serverUpdatedAt) > 0));
+}
+export function toContainerNode(containerState) {
+    const { container, record } = containerState;
+    const systemSlot = container.systemSlot ?? null;
+    const node = {
+        effectiveAccessLevel: normalizeEffectiveAccessLevel(container.effectiveAccessLevel),
+        id: container.id,
+        kind: "container",
+        metadataDocumentId: container.metadataDocumentId ?? record.documentId,
+        name: container.name,
+        organizationId: container.organizationId,
+        parentId: container.parentId,
+        syncState: createContainerDocumentObjectSyncState({
+            localOnly: !container.serverCreatedAt ||
+                !container.metadataDocumentId ||
+                !record.documentId,
+            pendingUpdateCount: hasPendingContainerTimestamp(container) ? 1 : 0,
+        }),
+    };
+    if (systemSlot) {
+        node.systemSlot = systemSlot;
+    }
+    if (container.icon) {
+        node.icon = container.icon;
+    }
+    if (container.createdAt) {
+        node.createdAt = container.createdAt;
+    }
+    if (container.updatedAt) {
+        node.updatedAt = container.updatedAt;
+    }
+    return node;
+}
+export function isContainerInSubtree(containersById, containerId, rootContainerId) {
+    let currentContainerId = containerId;
+    const visitedContainerIds = new Set();
+    while (currentContainerId !== null) {
+        if (currentContainerId === rootContainerId) {
+            return true;
+        }
+        if (visitedContainerIds.has(currentContainerId)) {
+            return false;
+        }
+        visitedContainerIds.add(currentContainerId);
+        const currentContainerState = containersById.get(currentContainerId);
+        currentContainerId = currentContainerState?.container.parentId ?? null;
+    }
+    return false;
+}
+export function getSnapshotNodes(containersById) {
+    return Array.from(containersById.values(), (containerState) => toContainerNode(containerState)).sort((left, right) => left.name.localeCompare(right.name, undefined, {
+        sensitivity: "base",
+    }));
+}
+//# sourceMappingURL=utils.js.map

package/stores/container-contents/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAGvE,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAGtG,SAAS,4BAA4B,CAAC,SAA0B;IAC9D,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,IAAI,IAAI,CAAC;IACxD,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC;IAE1D,OAAO,CACL,cAAc,KAAK,IAAI;QACvB,CAAC,eAAe,KAAK,IAAI;YACvB,cAAc,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,cAA8B;IAC5D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC;IAChD,MAAM,IAAI,GAAkB;QAC1B,oBAAoB,EAAE,6BAA6B,CACjD,SAAS,CAAC,oBAAoB,CAC/B;QACD,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,IAAI,EAAE,WAAW;QACjB,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU;QACrE,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,SAAS,EAAE,sCAAsC,CAAC;YAChD,SAAS,EACP,CAAC,SAAS,CAAC,eAAe;gBAC1B,CAAC,SAAS,CAAC,kBAAkB;gBAC7B,CAAC,MAAM,CAAC,UAAU;YACpB,kBAAkB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpE,CAAC;KACH,CAAC;IAEF,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACvC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,cAAmD,EACnD,WAAmB,EACnB,eAAuB;IAEvB,IAAI,kBAAkB,GAAkB,WAAW,CAAC;IACpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,OAAO,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,kBAAkB,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAE5C,MAAM,qBAAqB,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACrE,kBAAkB,GAAG,qBAAqB,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC;IACzE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,cAAmD;IAEnD,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5D,eAAe,CAAC,cAAc,CAAC,CAChC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE;QAC7C,WAAW,EAAE,MAAM;KACpB,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { normalizeEffectiveAccessLevel } from \"../../data/accessLevel\";\nimport type { ContainerRecord } from \"../../workflows/container-contents/containerPersistence\";\nimport type { ContainerState } from \"../../workflows/container-contents/remoteHydration\";\nimport { createContainerDocumentObjectSyncState } from \"../../workflows/container-contents/syncState\";\nimport type { ContainerNode } from \"./types\";\n\nfunction hasPendingContainerTimestamp(container: ContainerRecord): boolean {\n  const localUpdatedAt = container.localUpdatedAt ?? null;\n  const serverUpdatedAt = container.serverUpdatedAt ?? null;\n\n  return (\n    localUpdatedAt !== null &&\n    (serverUpdatedAt === null ||\n      localUpdatedAt.localeCompare(serverUpdatedAt) > 0)\n  );\n}\n\nexport function toContainerNode(containerState: ContainerState): ContainerNode {\n  const { container, record } = containerState;\n  const systemSlot = container.systemSlot ?? null;\n  const node: ContainerNode = {\n    effectiveAccessLevel: normalizeEffectiveAccessLevel(\n      container.effectiveAccessLevel,\n    ),\n    id: container.id,\n    kind: \"container\",\n    metadataDocumentId: container.metadataDocumentId ?? record.documentId,\n    name: container.name,\n    organizationId: container.organizationId,\n    parentId: container.parentId,\n    syncState: createContainerDocumentObjectSyncState({\n      localOnly:\n        !container.serverCreatedAt ||\n        !container.metadataDocumentId ||\n        !record.documentId,\n      pendingUpdateCount: hasPendingContainerTimestamp(container) ? 1 : 0,\n    }),\n  };\n\n  if (systemSlot) {\n    node.systemSlot = systemSlot;\n  }\n\n  if (container.icon) {\n    node.icon = container.icon;\n  }\n\n  if (container.createdAt) {\n    node.createdAt = container.createdAt;\n  }\n  if (container.updatedAt) {\n    node.updatedAt = container.updatedAt;\n  }\n\n  return node;\n}\n\nexport function isContainerInSubtree(\n  containersById: ReadonlyMap<string, ContainerState>,\n  containerId: string,\n  rootContainerId: string,\n): boolean {\n  let currentContainerId: string | null = containerId;\n  const visitedContainerIds = new Set<string>();\n\n  while (currentContainerId !== null) {\n    if (currentContainerId === rootContainerId) {\n      return true;\n    }\n\n    if (visitedContainerIds.has(currentContainerId)) {\n      return false;\n    }\n    visitedContainerIds.add(currentContainerId);\n\n    const currentContainerState = containersById.get(currentContainerId);\n    currentContainerId = currentContainerState?.container.parentId ?? null;\n  }\n\n  return false;\n}\n\nexport function getSnapshotNodes(\n  containersById: ReadonlyMap<string, ContainerState>,\n): ReadonlyArray<ContainerNode> {\n  return Array.from(containersById.values(), (containerState) =>\n    toContainerNode(containerState),\n  ).sort((left, right) =>\n    left.name.localeCompare(right.name, undefined, {\n      sensitivity: \"base\",\n    }),\n  );\n}\n"]}

package/stores/container-contents/writeGeneration.js

@@ -0,0 +1,37 @@
+export function didContainerWriteRuntimeChange(previousRuntime, currentRuntime) {
+    return (previousRuntime.adoptRootContainer !== currentRuntime.adoptRootContainer ||
+        previousRuntime.apiClient !== currentRuntime.apiClient ||
+        previousRuntime.auth.defaultOrganizationId !==
+            currentRuntime.auth.defaultOrganizationId ||
+        previousRuntime.auth.isAuthenticated !==
+            currentRuntime.auth.isAuthenticated ||
+        previousRuntime.auth.organizationId !==
+            currentRuntime.auth.organizationId ||
+        previousRuntime.auth.userId !== currentRuntime.auth.userId ||
+        previousRuntime.crypto.encapsulationKeyPair !==
+            currentRuntime.crypto.encapsulationKeyPair ||
+        previousRuntime.crypto.signingFingerprint !==
+            currentRuntime.crypto.signingFingerprint ||
+        previousRuntime.crypto.signingKeyPair !==
+            currentRuntime.crypto.signingKeyPair ||
+        previousRuntime.infra.blobStore !== currentRuntime.infra.blobStore ||
+        previousRuntime.infra.dbStatus !== currentRuntime.infra.dbStatus ||
+        previousRuntime.infra.documentProjectors !==
+            currentRuntime.infra.documentProjectors ||
+        previousRuntime.infra.execSql !== currentRuntime.infra.execSql ||
+        previousRuntime.resolveTrustedUserIdentity !==
+            currentRuntime.resolveTrustedUserIdentity ||
+        previousRuntime.state.containerId !== currentRuntime.state.containerId ||
+        previousRuntime.state.domainScope !== currentRuntime.state.domainScope);
+}
+export function captureContainerWriteGeneration(state) {
+    const lifecycleGeneration = state.lifecycleGeneration;
+    const persistence = state.persistence;
+    const runtime = state.runtime;
+    const writeGeneration = state.writeGeneration;
+    return () => state.lifecycleGeneration === lifecycleGeneration &&
+        state.persistence === persistence &&
+        state.writeGeneration === writeGeneration &&
+        !didContainerWriteRuntimeChange(runtime, state.runtime);
+}
+//# sourceMappingURL=writeGeneration.js.map

package/stores/container-contents/writeGeneration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeGeneration.js","sourceRoot":"","sources":["writeGeneration.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,8BAA8B,CAC5C,eAA8C,EAC9C,cAA6C;IAE7C,OAAO,CACL,eAAe,CAAC,kBAAkB,KAAK,cAAc,CAAC,kBAAkB;QACxE,eAAe,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS;QACtD,eAAe,CAAC,IAAI,CAAC,qBAAqB;YACxC,cAAc,CAAC,IAAI,CAAC,qBAAqB;QAC3C,eAAe,CAAC,IAAI,CAAC,eAAe;YAClC,cAAc,CAAC,IAAI,CAAC,eAAe;QACrC,eAAe,CAAC,IAAI,CAAC,cAAc;YACjC,cAAc,CAAC,IAAI,CAAC,cAAc;QACpC,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,MAAM;QAC1D,eAAe,CAAC,MAAM,CAAC,oBAAoB;YACzC,cAAc,CAAC,MAAM,CAAC,oBAAoB;QAC5C,eAAe,CAAC,MAAM,CAAC,kBAAkB;YACvC,cAAc,CAAC,MAAM,CAAC,kBAAkB;QAC1C,eAAe,CAAC,MAAM,CAAC,cAAc;YACnC,cAAc,CAAC,MAAM,CAAC,cAAc;QACtC,eAAe,CAAC,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,KAAK,CAAC,SAAS;QAClE,eAAe,CAAC,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,QAAQ;QAChE,eAAe,CAAC,KAAK,CAAC,kBAAkB;YACtC,cAAc,CAAC,KAAK,CAAC,kBAAkB;QACzC,eAAe,CAAC,KAAK,CAAC,OAAO,KAAK,cAAc,CAAC,KAAK,CAAC,OAAO;QAC9D,eAAe,CAAC,0BAA0B;YACxC,cAAc,CAAC,0BAA0B;QAC3C,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW;QACtE,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAkC;IAElC,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,OAAO,GAAG,EAAE,CACV,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACjD,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,eAAe,KAAK,eAAe;QACzC,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC","sourcesContent":["import type { ContainerContentsStoreRuntime } from \"./syncAgentTypes\";\nimport type { ContainerContentsStoreState } from \"./types\";\n\nexport type ContainerWriteGuard = () => boolean;\n\nexport function didContainerWriteRuntimeChange(\n  previousRuntime: ContainerContentsStoreRuntime,\n  currentRuntime: ContainerContentsStoreRuntime,\n): boolean {\n  return (\n    previousRuntime.adoptRootContainer !== currentRuntime.adoptRootContainer ||\n    previousRuntime.apiClient !== currentRuntime.apiClient ||\n    previousRuntime.auth.defaultOrganizationId !==\n      currentRuntime.auth.defaultOrganizationId ||\n    previousRuntime.auth.isAuthenticated !==\n      currentRuntime.auth.isAuthenticated ||\n    previousRuntime.auth.organizationId !==\n      currentRuntime.auth.organizationId ||\n    previousRuntime.auth.userId !== currentRuntime.auth.userId ||\n    previousRuntime.crypto.encapsulationKeyPair !==\n      currentRuntime.crypto.encapsulationKeyPair ||\n    previousRuntime.crypto.signingFingerprint !==\n      currentRuntime.crypto.signingFingerprint ||\n    previousRuntime.crypto.signingKeyPair !==\n      currentRuntime.crypto.signingKeyPair ||\n    previousRuntime.infra.blobStore !== currentRuntime.infra.blobStore ||\n    previousRuntime.infra.dbStatus !== currentRuntime.infra.dbStatus ||\n    previousRuntime.infra.documentProjectors !==\n      currentRuntime.infra.documentProjectors ||\n    previousRuntime.infra.execSql !== currentRuntime.infra.execSql ||\n    previousRuntime.resolveTrustedUserIdentity !==\n      currentRuntime.resolveTrustedUserIdentity ||\n    previousRuntime.state.containerId !== currentRuntime.state.containerId ||\n    previousRuntime.state.domainScope !== currentRuntime.state.domainScope\n  );\n}\n\nexport function captureContainerWriteGeneration(\n  state: ContainerContentsStoreState,\n): ContainerWriteGuard {\n  const lifecycleGeneration = state.lifecycleGeneration;\n  const persistence = state.persistence;\n  const runtime = state.runtime;\n  const writeGeneration = state.writeGeneration;\n  return () =>\n    state.lifecycleGeneration === lifecycleGeneration &&\n    state.persistence === persistence &&\n    state.writeGeneration === writeGeneration &&\n    !didContainerWriteRuntimeChange(runtime, state.runtime);\n}\n"]}

package/stores/documents/documentStore/ancestorRepairPark.js

@@ -0,0 +1,29 @@
+/** The abandon reason for a stale ancestor only another member can re-key. */
+const INACCESSIBLE_ANCESTOR_REPAIR = "inaccessible";
+/**
+ * Park queued writes behind an ancestor repair this writer cannot perform. The
+ * repairing member's rekey reaches this client only as a projection
+ * invalidation hint, which drops caches but schedules nothing, so a parked
+ * document would otherwise wait for an unrelated trigger.
+ *
+ * Returns true when a hint already landed while the pass was in flight: that
+ * pass may have judged a projection fetched before the repair, and the hint it
+ * would wait for has come and gone, so the caller re-runs instead of parking.
+ */
+export function parkForAncestorRepair(state, reason, writerProjectionGenerationAtStart) {
+    if (reason !== INACCESSIBLE_ANCESTOR_REPAIR)
+        return false;
+    if (state.writerProjectionGeneration !== writerProjectionGenerationAtStart) {
+        return true;
+    }
+    state.awaitingAncestorRepair = true;
+    return false;
+}
+/** Consume the park on a projection invalidation hint; true means re-run. */
+export function resumeAfterAncestorRepairHint(state) {
+    if (!state.awaitingAncestorRepair)
+        return false;
+    state.awaitingAncestorRepair = false;
+    return true;
+}
+//# sourceMappingURL=ancestorRepairPark.js.map

package/stores/documents/documentStore/ancestorRepairPark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ancestorRepairPark.js","sourceRoot":"","sources":["ancestorRepairPark.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,4BAA4B,GAAG,cAAc,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyB,EACzB,MAAc,EACd,iCAAyC;IAEzC,IAAI,MAAM,KAAK,4BAA4B;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,KAAK,CAAC,0BAA0B,KAAK,iCAAiC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,6BAA6B,CAC3C,KAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,sBAAsB;QAAE,OAAO,KAAK,CAAC;IAChD,KAAK,CAAC,sBAAsB,GAAG,KAAK,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { DocumentStoreState } from \"./state\";\n\n/** The abandon reason for a stale ancestor only another member can re-key. */\nconst INACCESSIBLE_ANCESTOR_REPAIR = \"inaccessible\";\n\n/**\n * Park queued writes behind an ancestor repair this writer cannot perform. The\n * repairing member's rekey reaches this client only as a projection\n * invalidation hint, which drops caches but schedules nothing, so a parked\n * document would otherwise wait for an unrelated trigger.\n *\n * Returns true when a hint already landed while the pass was in flight: that\n * pass may have judged a projection fetched before the repair, and the hint it\n * would wait for has come and gone, so the caller re-runs instead of parking.\n */\nexport function parkForAncestorRepair(\n  state: DocumentStoreState,\n  reason: string,\n  writerProjectionGenerationAtStart: number,\n): boolean {\n  if (reason !== INACCESSIBLE_ANCESTOR_REPAIR) return false;\n  if (state.writerProjectionGeneration !== writerProjectionGenerationAtStart) {\n    return true;\n  }\n  state.awaitingAncestorRepair = true;\n  return false;\n}\n\n/** Consume the park on a projection invalidation hint; true means re-run. */\nexport function resumeAfterAncestorRepairHint(\n  state: DocumentStoreState,\n): boolean {\n  if (!state.awaitingAncestorRepair) return false;\n  state.awaitingAncestorRepair = false;\n  return true;\n}\n"]}

package/stores/documents/documentStore/attachmentDetachState.js

@@ -0,0 +1,54 @@
+/**
+ * Keeps a local attachment row's detach marker consistent with the document.
+ *
+ * The invariant is one line: a local blob row is marked detached exactly when
+ * its slot is no longer in the document. The read models trust that marker to
+ * decide whether a blob is still referenced, so anything that writes these rows
+ * has to preserve it rather than restate what it believed the slots were.
+ *
+ * Two writers can otherwise clear a marker they never meant to touch: an upload
+ * that settles after the user removed its slot, and a hydration that captured
+ * the attachment list before an unlink and writes it back after. Both read the
+ * slot list, await, then save — so the slot they save may already be gone.
+ */
+import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
+function getLiveSlotIds(doc) {
+    return new Set(getDocumentAttachments(doc).map((attachment) => attachment.slotId));
+}
+/**
+ * Stamp records being written for slots the document no longer has as detached.
+ *
+ * The document is read here, at write time, rather than trusted from the
+ * caller's earlier snapshot — the Loro document is mutated in place, so this
+ * sees any unlink that landed while the caller was awaiting.
+ */
+export function withLocalAttachmentDetachState(attachments, doc) {
+    if (!doc) {
+        return [...attachments];
+    }
+    const detachedAt = new Date().toISOString();
+    const liveSlotIds = getLiveSlotIds(doc);
+    return attachments.map((attachment) => attachment.detachedAt === null && !liveSlotIds.has(attachment.slotId)
+        ? { ...attachment, detachedAt }
+        : attachment);
+}
+/**
+ * Report the loaded rows whose marker disagrees with the loaded document.
+ *
+ * A write can only be interrupted between marking the row and persisting the
+ * document, so a restart can find either half applied. Reconciling against the
+ * durable document at load makes the marker mean what it claims again: a slot
+ * the document still has is live, and a slot it dropped is detached.
+ */
+export function reconcileLocalAttachmentDetachState(attachments, doc) {
+    const detachedAt = new Date().toISOString();
+    const liveSlotIds = getLiveSlotIds(doc);
+    return attachments.flatMap((attachment) => {
+        const slotIsLive = liveSlotIds.has(attachment.slotId);
+        if (slotIsLive === (attachment.detachedAt === null)) {
+            return [];
+        }
+        return [{ ...attachment, detachedAt: slotIsLive ? null : detachedAt }];
+    });
+}
+//# sourceMappingURL=attachmentDetachState.js.map

package/stores/documents/documentStore/attachmentDetachState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentDetachState.js","sourceRoot":"","sources":["attachmentDetachState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAIjF,SAAS,cAAc,CAAC,GAAkB;IACxC,OAAO,IAAI,GAAG,CACZ,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAiD,EACjD,GAAyB;IAEzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QACnE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE;QAC/B,CAAC,CAAC,UAAU,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAiD,EACjD,GAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Keeps a local attachment row's detach marker consistent with the document.\n *\n * The invariant is one line: a local blob row is marked detached exactly when\n * its slot is no longer in the document. The read models trust that marker to\n * decide whether a blob is still referenced, so anything that writes these rows\n * has to preserve it rather than restate what it believed the slots were.\n *\n * Two writers can otherwise clear a marker they never meant to touch: an upload\n * that settles after the user removed its slot, and a hydration that captured\n * the attachment list before an unlink and writes it back after. Both read the\n * slot list, await, then save — so the slot they save may already be gone.\n */\nimport { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport type { LocalAttachmentRecord } from \"../../../workflows/documents\";\nimport type { DocumentState } from \"./state\";\n\nfunction getLiveSlotIds(doc: DocumentState): ReadonlySet<string> {\n  return new Set(\n    getDocumentAttachments(doc).map((attachment) => attachment.slotId),\n  );\n}\n\n/**\n * Stamp records being written for slots the document no longer has as detached.\n *\n * The document is read here, at write time, rather than trusted from the\n * caller's earlier snapshot — the Loro document is mutated in place, so this\n * sees any unlink that landed while the caller was awaiting.\n */\nexport function withLocalAttachmentDetachState(\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n  doc: DocumentState | null,\n): LocalAttachmentRecord[] {\n  if (!doc) {\n    return [...attachments];\n  }\n\n  const detachedAt = new Date().toISOString();\n  const liveSlotIds = getLiveSlotIds(doc);\n  return attachments.map((attachment) =>\n    attachment.detachedAt === null && !liveSlotIds.has(attachment.slotId)\n      ? { ...attachment, detachedAt }\n      : attachment,\n  );\n}\n\n/**\n * Report the loaded rows whose marker disagrees with the loaded document.\n *\n * A write can only be interrupted between marking the row and persisting the\n * document, so a restart can find either half applied. Reconciling against the\n * durable document at load makes the marker mean what it claims again: a slot\n * the document still has is live, and a slot it dropped is detached.\n */\nexport function reconcileLocalAttachmentDetachState(\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n  doc: DocumentState,\n): LocalAttachmentRecord[] {\n  const detachedAt = new Date().toISOString();\n  const liveSlotIds = getLiveSlotIds(doc);\n  return attachments.flatMap((attachment) => {\n    const slotIsLive = liveSlotIds.has(attachment.slotId);\n    if (slotIsLive === (attachment.detachedAt === null)) {\n      return [];\n    }\n\n    return [{ ...attachment, detachedAt: slotIsLive ? null : detachedAt }];\n  });\n}\n"]}

package/stores/documents/documentStore/attachmentHydration.js

@@ -0,0 +1,54 @@
+/** Hydrate only bytes matching the current document's authenticated attachment intent. */
+import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
+import { hydrateDocumentAttachmentBlobs } from "../../../workflows/blobs/index.js";
+import { reclaimDocumentOrphanBlobs, } from "../../../workflows/documents/index.js";
+import { commitHydratedAttachment } from "./attachmentHydrationCommit.js";
+import { isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent, } from "./syncGeneration.js";
+export async function hydrateAttachmentBlobs(state, currentDoc, currentRecord, expectedGeneration) {
+    const generationIsCurrent = () => !expectedGeneration || isSyncGenerationCurrent(state, expectedGeneration);
+    if (!generationIsCurrent())
+        return;
+    const runtime = state.runtime;
+    const encapsulationKeyPair = runtime.crypto.encapsulationKeyPair;
+    if (!encapsulationKeyPair ||
+        !runtime.auth.isAuthenticated ||
+        !runtime.state.online ||
+        !currentRecord?.documentId) {
+        return;
+    }
+    const attachments = getDocumentAttachments(currentDoc);
+    if (attachments.length === 0) {
+        return;
+    }
+    const expectedStorageKeys = { ...state.attachmentStorageKeyBySlotId };
+    const hydratedBlobs = await hydrateDocumentAttachmentBlobs({
+        apiClient: runtime.apiClient,
+        attachments,
+        documentId: currentRecord.documentId,
+        execSql: runtime.infra.execSql,
+        localBlobIdBySlotId: state.attachmentBlobIdBySlotId,
+        localStorageKeyBySlotId: state.attachmentStorageKeyBySlotId,
+        log: runtime.util.log,
+        rejectedServedBindings: state.rejectedServedAttachmentBindings,
+        reportSecurityIncident: runtime.util.reportSecurityIncident,
+        resolveProjectionUserKey: expectedGeneration?.resolveProjectionUserKey ??
+            state.resolveProjectionUserKey,
+        targetSecretKey: encapsulationKeyPair.secretKey,
+    });
+    if (!generationIsCurrent())
+        return;
+    if (!hydratedBlobs) {
+        return;
+    }
+    for (const hydratedBlob of hydratedBlobs) {
+        await commitHydratedAttachment({
+            state,
+            currentDoc,
+            hydratedBlob,
+            generationIsCurrent,
+            expectedStorageKey: expectedStorageKeys[hydratedBlob.attachment.slotId] ?? null,
+        });
+    }
+    await reclaimDocumentOrphanBlobs(runtime);
+}
+//# sourceMappingURL=attachmentHydration.js.map

package/stores/documents/documentStore/attachmentHydration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentHydration.js","sourceRoot":"","sources":["attachmentHydration.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAEL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAEL,oCAAoC,IAAI,uBAAuB,GAChE,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB,EACzB,UAAyB,EACzB,aAAoC,EACpC,kBAAgD;IAEhD,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACjE,IACE,CAAC,oBAAoB;QACrB,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QACrB,CAAC,aAAa,EAAE,UAAU,EAC1B,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,mBAAmB,EAAE,KAAK,CAAC,wBAAwB;QACnD,uBAAuB,EAAE,KAAK,CAAC,4BAA4B;QAC3D,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,sBAAsB,EAAE,KAAK,CAAC,gCAAgC;QAC9D,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,wBAAwB,EACtB,kBAAkB,EAAE,wBAAwB;YAC5C,KAAK,CAAC,wBAAwB;QAChC,eAAe,EAAE,oBAAoB,CAAC,SAAS;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IACnC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,wBAAwB,CAAC;YAC7B,KAAK;YACL,UAAU;YACV,YAAY;YACZ,mBAAmB;YACnB,kBAAkB,EAChB,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["/** Hydrate only bytes matching the current document's authenticated attachment intent. */\nimport { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport { hydrateDocumentAttachmentBlobs } from \"../../../workflows/blobs\";\nimport {\n  type DocumentRecord,\n  reclaimDocumentOrphanBlobs,\n} from \"../../../workflows/documents\";\nimport { commitHydratedAttachment } from \"./attachmentHydrationCommit\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\nexport async function hydrateAttachmentBlobs(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord | null,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  const generationIsCurrent = () =>\n    !expectedGeneration || isSyncGenerationCurrent(state, expectedGeneration);\n  if (!generationIsCurrent()) return;\n\n  const runtime = state.runtime;\n  const encapsulationKeyPair = runtime.crypto.encapsulationKeyPair;\n  if (\n    !encapsulationKeyPair ||\n    !runtime.auth.isAuthenticated ||\n    !runtime.state.online ||\n    !currentRecord?.documentId\n  ) {\n    return;\n  }\n\n  const attachments = getDocumentAttachments(currentDoc);\n  if (attachments.length === 0) {\n    return;\n  }\n\n  const expectedStorageKeys = { ...state.attachmentStorageKeyBySlotId };\n  const hydratedBlobs = await hydrateDocumentAttachmentBlobs({\n    apiClient: runtime.apiClient,\n    attachments,\n    documentId: currentRecord.documentId,\n    execSql: runtime.infra.execSql,\n    localBlobIdBySlotId: state.attachmentBlobIdBySlotId,\n    localStorageKeyBySlotId: state.attachmentStorageKeyBySlotId,\n    log: runtime.util.log,\n    rejectedServedBindings: state.rejectedServedAttachmentBindings,\n    reportSecurityIncident: runtime.util.reportSecurityIncident,\n    resolveProjectionUserKey:\n      expectedGeneration?.resolveProjectionUserKey ??\n      state.resolveProjectionUserKey,\n    targetSecretKey: encapsulationKeyPair.secretKey,\n  });\n  if (!generationIsCurrent()) return;\n  if (!hydratedBlobs) {\n    return;\n  }\n\n  for (const hydratedBlob of hydratedBlobs) {\n    await commitHydratedAttachment({\n      state,\n      currentDoc,\n      hydratedBlob,\n      generationIsCurrent,\n      expectedStorageKey:\n        expectedStorageKeys[hydratedBlob.attachment.slotId] ?? null,\n    });\n  }\n  await reclaimDocumentOrphanBlobs(runtime);\n}\n"]}

package/stores/documents/documentStore/attachmentHydrationCommit.js

@@ -0,0 +1,53 @@
+import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
+import { runSerializedDocumentBlobMutation, } from "../../../workflows/documents/index.js";
+import { saveHydratedDocumentAttachment } from "../../../workflows/documents/attachmentPersistence.js";
+import { installLocalAttachmentRecords, removeLocalAttachmentSlot, } from "./attachmentPersistence.js";
+export async function commitHydratedAttachment(input) {
+    const { state, currentDoc, hydratedBlob, expectedStorageKey, generationIsCurrent, } = input;
+    const runtime = state.runtime;
+    const expectedSnapshotEndVersion = state.record?.snapshotEndVersion ?? null;
+    const stillCurrent = () => generationIsCurrent() &&
+        state.doc === currentDoc &&
+        getDocumentAttachments(currentDoc).some((attachment) => attachment.slotId === hydratedBlob.attachment.slotId &&
+            attachment.contentSha256 === hydratedBlob.attachment.contentSha256);
+    await runSerializedDocumentBlobMutation(runtime.infra.execSql, hydratedBlob.storageKey, async () => {
+        if (!stillCurrent())
+            return;
+        await runtime.infra.blobStore.writeBytes(hydratedBlob.storageKey, hydratedBlob.bytes);
+        const attachment = {
+            blobId: hydratedBlob.binding.blobId,
+            // The held bytes' own size, not the document intent's: a served
+            // binding the intent has not recorded yet may differ in length, and
+            // preview gating reads the local record.
+            byteLength: hydratedBlob.bytes.byteLength,
+            contentSha256: hydratedBlob.contentSha256,
+            detachedAt: null,
+            localId: state.localId,
+            mimeType: hydratedBlob.attachment.mimeType,
+            slotId: hydratedBlob.attachment.slotId,
+            storageKey: hydratedBlob.storageKey,
+        };
+        const committed = await saveHydratedDocumentAttachment({
+            execSql: runtime.infra.execSql,
+            persistence: state.persistence,
+            attachment,
+            expectedStorageKey,
+            expectedSnapshotEndVersion,
+            stillCurrent,
+        });
+        if (committed && stillCurrent())
+            installLocalAttachmentRecords(state, [attachment], currentDoc);
+        else if (!committed && stillCurrent())
+            await refreshRefusedAttachmentSlot(input, stillCurrent);
+    });
+}
+async function refreshRefusedAttachmentSlot(input, stillCurrent) {
+    const { state, currentDoc, hydratedBlob } = input;
+    const rows = await state.persistence.listLocalAttachments(state.runtime.infra.execSql, state.localId);
+    if (!stillCurrent())
+        return;
+    const slotId = hydratedBlob.attachment.slotId;
+    removeLocalAttachmentSlot(state, slotId);
+    installLocalAttachmentRecords(state, rows.filter((row) => row.slotId === slotId), currentDoc);
+}
+//# sourceMappingURL=attachmentHydrationCommit.js.map

package/stores/documents/documentStore/attachmentHydrationCommit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentHydrationCommit.js","sourceRoot":"","sources":["attachmentHydrationCommit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAEL,iCAAiC,GAClC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAOjC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAW9C;IACC,MAAM,EACJ,KAAK,EACL,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,GACpB,GAAG,KAAK,CAAC;IACV,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,IAAI,IAAI,CAAC;IAC5E,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,mBAAmB,EAAE;QACrB,KAAK,CAAC,GAAG,KAAK,UAAU;QACxB,sBAAsB,CAAC,UAAU,CAAC,CAAC,IAAI,CACrC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,UAAU,CAAC,MAAM;YACpD,UAAU,CAAC,aAAa,KAAK,YAAY,CAAC,UAAU,CAAC,aAAa,CACrE,CAAC;IACJ,MAAM,iCAAiC,CACrC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CACtC,YAAY,CAAC,UAAU,EACvB,YAAY,CAAC,KAAK,CACnB,CAAC;QACF,MAAM,UAAU,GAA0B;YACxC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM;YACnC,gEAAgE;YAChE,oEAAoE;YACpE,yCAAyC;YACzC,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU;YACzC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,QAAQ;YAC1C,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM;YACtC,UAAU,EAAE,YAAY,CAAC,UAAU;SACpC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU;YACV,kBAAkB;YAClB,0BAA0B;YAC1B,YAAY;SACb,CAAC,CAAC;QACH,IAAI,SAAS,IAAI,YAAY,EAAE;YAC7B,6BAA6B,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;aAC5D,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE;YACnC,MAAM,4BAA4B,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAqD,EACrD,YAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,oBAAoB,CACvD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;IAC9C,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,6BAA6B,CAC3B,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAC3C,UAAU,CACX,CAAC;AACJ,CAAC","sourcesContent":["import { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport type { hydrateDocumentAttachmentBlobs } from \"../../../workflows/blobs\";\nimport {\n  type LocalAttachmentRecord,\n  runSerializedDocumentBlobMutation,\n} from \"../../../workflows/documents\";\nimport { saveHydratedDocumentAttachment } from \"../../../workflows/documents/attachmentPersistence\";\nimport {\n  installLocalAttachmentRecords,\n  removeLocalAttachmentSlot,\n} from \"./attachmentPersistence\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\n\ntype HydratedBlob = NonNullable<\n  Awaited<ReturnType<typeof hydrateDocumentAttachmentBlobs>>\n>[number];\n\nexport async function commitHydratedAttachment(input: {\n  state: DocumentStoreState;\n  currentDoc: DocumentState;\n  hydratedBlob: Pick<\n    HydratedBlob,\n    \"attachment\" | \"bytes\" | \"contentSha256\" | \"storageKey\"\n  > & {\n    binding: Pick<HydratedBlob[\"binding\"], \"blobId\">;\n  };\n  expectedStorageKey: string | null;\n  generationIsCurrent: () => boolean;\n}): Promise<void> {\n  const {\n    state,\n    currentDoc,\n    hydratedBlob,\n    expectedStorageKey,\n    generationIsCurrent,\n  } = input;\n  const runtime = state.runtime;\n  const expectedSnapshotEndVersion = state.record?.snapshotEndVersion ?? null;\n  const stillCurrent = () =>\n    generationIsCurrent() &&\n    state.doc === currentDoc &&\n    getDocumentAttachments(currentDoc).some(\n      (attachment) =>\n        attachment.slotId === hydratedBlob.attachment.slotId &&\n        attachment.contentSha256 === hydratedBlob.attachment.contentSha256,\n    );\n  await runSerializedDocumentBlobMutation(\n    runtime.infra.execSql,\n    hydratedBlob.storageKey,\n    async () => {\n      if (!stillCurrent()) return;\n      await runtime.infra.blobStore.writeBytes(\n        hydratedBlob.storageKey,\n        hydratedBlob.bytes,\n      );\n      const attachment: LocalAttachmentRecord = {\n        blobId: hydratedBlob.binding.blobId,\n        // The held bytes' own size, not the document intent's: a served\n        // binding the intent has not recorded yet may differ in length, and\n        // preview gating reads the local record.\n        byteLength: hydratedBlob.bytes.byteLength,\n        contentSha256: hydratedBlob.contentSha256,\n        detachedAt: null,\n        localId: state.localId,\n        mimeType: hydratedBlob.attachment.mimeType,\n        slotId: hydratedBlob.attachment.slotId,\n        storageKey: hydratedBlob.storageKey,\n      };\n      const committed = await saveHydratedDocumentAttachment({\n        execSql: runtime.infra.execSql,\n        persistence: state.persistence,\n        attachment,\n        expectedStorageKey,\n        expectedSnapshotEndVersion,\n        stillCurrent,\n      });\n      if (committed && stillCurrent())\n        installLocalAttachmentRecords(state, [attachment], currentDoc);\n      else if (!committed && stillCurrent())\n        await refreshRefusedAttachmentSlot(input, stillCurrent);\n    },\n  );\n}\n\nasync function refreshRefusedAttachmentSlot(\n  input: Parameters<typeof commitHydratedAttachment>[0],\n  stillCurrent: () => boolean,\n): Promise<void> {\n  const { state, currentDoc, hydratedBlob } = input;\n  const rows = await state.persistence.listLocalAttachments(\n    state.runtime.infra.execSql,\n    state.localId,\n  );\n  if (!stillCurrent()) return;\n  const slotId = hydratedBlob.attachment.slotId;\n  removeLocalAttachmentSlot(state, slotId);\n  installLocalAttachmentRecords(\n    state,\n    rows.filter((row) => row.slotId === slotId),\n    currentDoc,\n  );\n}\n"]}

package/stores/documents/documentStore/attachmentIntents.js

@@ -0,0 +1,39 @@
+import { blobByteSourceInputLength } from "../../../data/blobContracts.js";
+import { attachmentContentSha256 } from "../../../data/documents/attachmentContentIdentity.js";
+export async function buildPendingAttachments(localId, files) {
+    const nextPendingAttachments = [];
+    const nextAttachments = [];
+    for (const file of files) {
+        const slotId = crypto.randomUUID();
+        const storageKey = `${localId}-${slotId}`;
+        const byteLength = blobByteSourceInputLength(file.bytes);
+        const contentSha256 = await attachmentContentSha256(file.bytes);
+        nextPendingAttachments.push({
+            byteLength,
+            contentSha256,
+            localId,
+            mimeType: file.mimeType,
+            name: file.name,
+            slotId,
+            storageKey,
+        });
+        nextAttachments.push({
+            contentSha256,
+            byteLength,
+            mimeType: file.mimeType,
+            name: file.name,
+            slotId,
+        });
+    }
+    return { nextAttachments, nextPendingAttachments };
+}
+export async function buildAttachmentIntent(slotId, file) {
+    return {
+        contentSha256: await attachmentContentSha256(file.bytes),
+        byteLength: blobByteSourceInputLength(file.bytes),
+        mimeType: file.mimeType,
+        name: file.name,
+        slotId,
+    };
+}
+//# sourceMappingURL=attachmentIntents.js.map

package/stores/documents/documentStore/attachmentIntents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentIntents.js","sourceRoot":"","sources":["attachmentIntents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAK5F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAA8C;IAK9C,MAAM,sBAAsB,GAA8B,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAyB,EAAE,CAAC;IAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,sBAAsB,CAAC,IAAI,CAAC;YAC1B,UAAU;YACV,aAAa;YACb,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QACH,eAAe,CAAC,IAAI,CAAC;YACnB,aAAa;YACb,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAA8B;IAE9B,OAAO;QACL,aAAa,EAAE,MAAM,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QACxD,UAAU,EAAE,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import { blobByteSourceInputLength } from \"../../../data/blobContracts\";\nimport { attachmentContentSha256 } from \"../../../data/documents/attachmentContentIdentity\";\nimport type { DocumentAttachment } from \"../../../data/documents/documentContent\";\nimport type { PendingAttachmentRecord } from \"../../../workflows/documents\";\nimport type { DocumentAttachmentUpload } from \"../types\";\n\nexport async function buildPendingAttachments(\n  localId: string,\n  files: ReadonlyArray<DocumentAttachmentUpload>,\n): Promise<{\n  nextAttachments: DocumentAttachment[];\n  nextPendingAttachments: PendingAttachmentRecord[];\n}> {\n  const nextPendingAttachments: PendingAttachmentRecord[] = [];\n  const nextAttachments: DocumentAttachment[] = [];\n\n  for (const file of files) {\n    const slotId = crypto.randomUUID();\n    const storageKey = `${localId}-${slotId}`;\n    const byteLength = blobByteSourceInputLength(file.bytes);\n    const contentSha256 = await attachmentContentSha256(file.bytes);\n    nextPendingAttachments.push({\n      byteLength,\n      contentSha256,\n      localId,\n      mimeType: file.mimeType,\n      name: file.name,\n      slotId,\n      storageKey,\n    });\n    nextAttachments.push({\n      contentSha256,\n      byteLength,\n      mimeType: file.mimeType,\n      name: file.name,\n      slotId,\n    });\n  }\n\n  return { nextAttachments, nextPendingAttachments };\n}\n\nexport async function buildAttachmentIntent(\n  slotId: string,\n  file: DocumentAttachmentUpload,\n): Promise<DocumentAttachment> {\n  return {\n    contentSha256: await attachmentContentSha256(file.bytes),\n    byteLength: blobByteSourceInputLength(file.bytes),\n    mimeType: file.mimeType,\n    name: file.name,\n    slotId,\n  };\n}\n"]}

package/stores/documents/documentStore/attachmentMutationPersistence.js

@@ -0,0 +1,37 @@
+import { createPendingUpdateFields } from "../../../data/documents/documentSync.js";
+import { deleteUnreferencedStagedAttachmentBytes, } from "./attachmentStaging.js";
+import { reloadDocumentFromDurableHistory } from "./durableDocumentReload.js";
+import { persistDocument } from "./persistence.js";
+export async function restoreFailedAttachmentMutation(input) {
+    await reloadDocumentFromDurableHistory({
+        expectedGeneration: input.generation,
+        preserveQueuedWritesWhenIdentityMatches: true,
+        sameIdentitySnapshot: input.rollbackSnapshot,
+        state: input.state,
+    });
+}
+export async function persistStagedAttachmentMutation(input) {
+    const { staged, state } = input;
+    try {
+        return await persistDocument(state, input.currentDoc, { snapshotEndVersion: input.coveredVersion }, {
+            attachmentStaging: staged,
+            pendingUpdate: createPendingUpdateFields(input.attachmentUpdate) ?? undefined,
+            preserveSnapshotStructuredFields: true,
+            preserveSnapshotText: true,
+        }, input.generation);
+    }
+    catch (error) {
+        await deleteUnreferencedStagedAttachmentBytes({
+            generation: input.generation,
+            pendingAttachments: staged.pendingAttachments,
+            state,
+        });
+        await restoreFailedAttachmentMutation({
+            generation: input.generation,
+            rollbackSnapshot: input.rollbackSnapshot,
+            state,
+        });
+        throw error;
+    }
+}
+//# sourceMappingURL=attachmentMutationPersistence.js.map