@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/stores/documents/documentStore/attachmentUploadResume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentUploadResume.js","sourceRoot":"","sources":["attachmentUploadResume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAE1B,SAAS,2BAA2B,CAClC,eAAuB;IAEvB,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;QAC3B,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC;QAC1C,QAAQ,EAAE,IAAI;QACd,eAAe;QACf,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyB,EACzB,iBAA0C,EAC1C,eAAuB,EACvB,oBAAiD;IAEjD,IAAI,cAAc,GAChB,iBAAiB,CAAC,MAAM,EAAE,eAAe,KAAK,eAAe;QAC3D,CAAC,CAAC,iBAAiB,CAAC,MAAM;QAC1B,CAAC,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC;IACnD,IACE,iBAAiB,CAAC,MAAM,KAAK,cAAc;QAC3C,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EACjE,CAAC;QACD,MAAM,2BAA2B,CAC/B,KAAK,EACL,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,EAChD,oBAAoB,CACrB,CAAC;QACF,IAAI,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACtE,iBAAiB,CAAC,MAAM,GAAG,cAAc,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GACb,cAAc,CAAC,OAAO,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,KAAK,IAAI;QACjE,CAAC,CAAC;YACE,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,aAAa,EAAE,cAAc,CAAC,OAAO;SACtC;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,eAAe,GAAmC,KAAK,EAAE,EAC7D,QAAQ,EACR,OAAO,GACR,EAAE,EAAE;QACH,IACE,cAAc,CAAC,OAAO,KAAK,OAAO;YAClC,cAAc,CAAC,QAAQ,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,kBAAkB,GAAG,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpE,MAAM,2BAA2B,CAC/B,KAAK,EACL,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EACpD,oBAAoB,CACrB,CAAC;QACF,IAAI,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACtE,wEAAwE;YACxE,6DAA6D;YAC7D,cAAc,GAAG,kBAAkB,CAAC;YACpC,iBAAiB,CAAC,MAAM,GAAG,kBAAkB,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,MAAM;QAC7B,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;QACpD,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC;QAClD,SAAS;QACT,eAAe;QACf,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAChD,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC;gBAClE,iBAAiB,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO;gBAE7C,OAAO;YACT,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CACpE,UAAU,EACV,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACrE,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC;gBAClE,iBAAiB,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO;gBAC7C,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;oBAC3C,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,CAC3C;gBAED,OAAO;YACT,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,eAAe,CAAC,CAAC;YACxE,MAAM,2BAA2B,CAC/B,KAAK,EACL,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EACpD,oBAAoB,CACrB,CAAC;YACF,IAAI,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBACtE,iBAAiB,CAAC,MAAM,GAAG,kBAAkB,CAAC;YAChD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { createAesGcmIv } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type { MultipartStageResolvedListener } from \"../../../workflows/blobs\";\nimport type {\n  PendingAttachmentRecord,\n  PendingAttachmentUploadIdentity,\n} from \"../../../workflows/documents\";\nimport { savePendingAttachmentUpload } from \"./attachmentPersistence\";\nimport type { DocumentStoreState } from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\nfunction createPendingUploadIdentity(\n  plaintextSha256: string,\n): PendingAttachmentUploadIdentity {\n  // Generated once and persisted before the first upload attempt. The source\n  // digest derives an envelope IV from this seed, then each chunk derives its\n  // IV. Reusing the material for unchanged bytes makes retries byte-identical.\n  return {\n    blobId: crypto.randomUUID(),\n    contentKey: bytesToBase64(crypto.getRandomValues(new Uint8Array(32))),\n    contentKeyEpoch: 1,\n    nonceSeed: bytesToBase64(createAesGcmIv()),\n    partSize: null,\n    plaintextSha256,\n    stageId: null,\n  };\n}\n\nexport interface AttachmentUploadResume {\n  readonly blobId: string;\n  readonly contentKey: Uint8Array;\n  readonly contentKeyEpoch: number;\n  readonly nonceSeed: Uint8Array;\n  readonly multipart: { partSize: number; resumeStageId: string } | undefined;\n  readonly onStageResolved: MultipartStageResolvedListener;\n  readonly onStageUnavailable: (\n    stageId: string,\n    documentId: string,\n  ) => Promise<void>;\n}\n\n/**\n * Resolve and persist stable encryption and multipart inputs across retries.\n *\n * Every persist here is an UPSERT of the pending-attachment row, so each one\n * is generation-gated: a store teardown (reset/discard) deletes that row on\n * purpose, and a stale resume racing it would otherwise re-insert the row it\n * just removed. Skipping the persist only costs retry resumability.\n */\nexport async function resolveAttachmentUploadResume(\n  state: DocumentStoreState,\n  pendingAttachment: PendingAttachmentRecord,\n  plaintextSha256: string,\n  attachmentGeneration: DocumentStoreSyncGeneration,\n): Promise<AttachmentUploadResume> {\n  let uploadIdentity =\n    pendingAttachment.upload?.plaintextSha256 === plaintextSha256\n      ? pendingAttachment.upload\n      : createPendingUploadIdentity(plaintextSha256);\n  if (\n    pendingAttachment.upload !== uploadIdentity &&\n    isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)\n  ) {\n    await savePendingAttachmentUpload(\n      state,\n      { ...pendingAttachment, upload: uploadIdentity },\n      attachmentGeneration,\n    );\n    if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n      pendingAttachment.upload = uploadIdentity;\n    }\n  }\n\n  const multipart =\n    uploadIdentity.stageId !== null && uploadIdentity.partSize !== null\n      ? {\n          partSize: uploadIdentity.partSize,\n          resumeStageId: uploadIdentity.stageId,\n        }\n      : undefined;\n  const onStageResolved: MultipartStageResolvedListener = async ({\n    partSize,\n    stageId,\n  }) => {\n    if (\n      uploadIdentity.stageId === stageId &&\n      uploadIdentity.partSize === partSize\n    ) {\n      return;\n    }\n    if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n      return;\n    }\n    const nextUploadIdentity = { ...uploadIdentity, partSize, stageId };\n    await savePendingAttachmentUpload(\n      state,\n      { ...pendingAttachment, upload: nextUploadIdentity },\n      attachmentGeneration,\n    );\n    if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n      // Publish only after persistence succeeds: a failed save must leave the\n      // next attempt responsible for making this identity durable.\n      uploadIdentity = nextUploadIdentity;\n      pendingAttachment.upload = nextUploadIdentity;\n    }\n  };\n\n  return {\n    blobId: uploadIdentity.blobId,\n    contentKey: base64ToBytes(uploadIdentity.contentKey),\n    contentKeyEpoch: uploadIdentity.contentKeyEpoch,\n    nonceSeed: base64ToBytes(uploadIdentity.nonceSeed),\n    multipart,\n    onStageResolved,\n    onStageUnavailable: async (stageId, documentId) => {\n      if (\n        !isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||\n        pendingAttachment.upload?.stageId !== stageId\n      )\n        return;\n      // Recheck after the ambiguous bind, including an immediate projection\n      // retry in this pass. A still-active commit must retain its identity for\n      // normal adoption on the next pass; a failed read proves nothing.\n      const bindings = await state.runtime.apiClient.listDocumentAttachments(\n        documentId,\n        { refresh: true },\n      );\n      if (!bindings) throw new Error(\"Attachment recovery lookup failed.\");\n      if (\n        !isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||\n        pendingAttachment.upload?.stageId !== stageId ||\n        bindings.some(\n          (binding) =>\n            binding.slotId === pendingAttachment.slotId &&\n            binding.blobId === uploadIdentity.blobId,\n        )\n      )\n        return;\n      // A missing stage may have been consumed by a committed bind whose\n      // response was lost and whose slot was subsequently replaced/detached.\n      // That blob id is permanently reserved, so a replacement stage must use\n      // fresh crypto material and an id persisted before any bytes are sent.\n      const nextUploadIdentity = createPendingUploadIdentity(plaintextSha256);\n      await savePendingAttachmentUpload(\n        state,\n        { ...pendingAttachment, upload: nextUploadIdentity },\n        attachmentGeneration,\n      );\n      if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n        pendingAttachment.upload = nextUploadIdentity;\n      }\n    },\n  };\n}\n"]}

package/stores/documents/documentStore/attachmentWriteGeneration.js

@@ -0,0 +1,32 @@
+import { requestDocumentStoreSync } from "../registry.js";
+import { attachmentPersistNeedsFollowupSync } from "./attachmentPersistFollowup.js";
+import { isDocumentStoreSyncGenerationCurrent, } from "./syncGeneration.js";
+export function captureAttachmentWriteGeneration(state) {
+    if (!state.record)
+        return null;
+    return {
+        documentId: state.record.documentId,
+        localWriteGeneration: state.localWriteGeneration,
+    };
+}
+export function isAttachmentWriteGenerationCurrent(state, generation) {
+    return (state.localWriteGeneration === generation.localWriteGeneration &&
+        state.record?.documentId === generation.documentId);
+}
+export function shouldAbortAttachmentPersistFollowup(state, writeGeneration, syncGeneration, persisted) {
+    if (attachmentPersistNeedsFollowupSync({
+        currentDocumentId: state.record?.documentId,
+        currentLocalWriteGeneration: state.localWriteGeneration,
+        expectedDocumentId: writeGeneration.documentId,
+        expectedLocalWriteGeneration: writeGeneration.localWriteGeneration,
+        persisted,
+    })) {
+        requestDocumentStoreSync(state);
+    }
+    if (!persisted)
+        return true;
+    return (persisted.pullContinuationSuperseded === true ||
+        persisted.syncIdentitySuperseded === true ||
+        !isDocumentStoreSyncGenerationCurrent(state, syncGeneration));
+}
+//# sourceMappingURL=attachmentWriteGeneration.js.map

package/stores/documents/documentStore/attachmentWriteGeneration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentWriteGeneration.js","sourceRoot":"","sources":["attachmentWriteGeneration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAO1B,MAAM,UAAU,gCAAgC,CAC9C,KAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAyB,EACzB,UAAqC;IAErC,OAAO,CACL,KAAK,CAAC,oBAAoB,KAAK,UAAU,CAAC,oBAAoB;QAC9D,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC,UAAU,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAyB,EACzB,eAA0C,EAC1C,cAA2C,EAC3C,SAAyC;IAEzC,IACE,kCAAkC,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU;QAC3C,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,kBAAkB,EAAE,eAAe,CAAC,UAAU;QAC9C,4BAA4B,EAAE,eAAe,CAAC,oBAAoB;QAClE,SAAS;KACV,CAAC,EACF,CAAC;QACD,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,OAAO,CACL,SAAS,CAAC,0BAA0B,KAAK,IAAI;QAC7C,SAAS,CAAC,sBAAsB,KAAK,IAAI;QACzC,CAAC,oCAAoC,CAAC,KAAK,EAAE,cAAc,CAAC,CAC7D,CAAC;AACJ,CAAC","sourcesContent":["import { requestDocumentStoreSync } from \"../registry\";\nimport { attachmentPersistNeedsFollowupSync } from \"./attachmentPersistFollowup\";\nimport type { DocumentStoreState, PersistedDocumentRecord } from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\nexport interface AttachmentWriteGeneration {\n  documentId: string | null;\n  localWriteGeneration: number;\n}\n\nexport function captureAttachmentWriteGeneration(\n  state: DocumentStoreState,\n): AttachmentWriteGeneration | null {\n  if (!state.record) return null;\n  return {\n    documentId: state.record.documentId,\n    localWriteGeneration: state.localWriteGeneration,\n  };\n}\n\nexport function isAttachmentWriteGenerationCurrent(\n  state: DocumentStoreState,\n  generation: AttachmentWriteGeneration,\n): boolean {\n  return (\n    state.localWriteGeneration === generation.localWriteGeneration &&\n    state.record?.documentId === generation.documentId\n  );\n}\n\nexport function shouldAbortAttachmentPersistFollowup(\n  state: DocumentStoreState,\n  writeGeneration: AttachmentWriteGeneration,\n  syncGeneration: DocumentStoreSyncGeneration,\n  persisted: PersistedDocumentRecord | null,\n): boolean {\n  if (\n    attachmentPersistNeedsFollowupSync({\n      currentDocumentId: state.record?.documentId,\n      currentLocalWriteGeneration: state.localWriteGeneration,\n      expectedDocumentId: writeGeneration.documentId,\n      expectedLocalWriteGeneration: writeGeneration.localWriteGeneration,\n      persisted,\n    })\n  ) {\n    requestDocumentStoreSync(state);\n  }\n  if (!persisted) return true;\n\n  return (\n    persisted.pullContinuationSuperseded === true ||\n    persisted.syncIdentitySuperseded === true ||\n    !isDocumentStoreSyncGenerationCurrent(state, syncGeneration)\n  );\n}\n"]}

package/stores/documents/documentStore/attachments.js

@@ -0,0 +1,330 @@
+import { encodeVersionVector, exportFullHistorySnapshot, } from "../../../internal/loro/index.js";
+import { addDocumentAttachments, getDocumentAttachments, removeDocumentAttachment, } from "../../../data/documents/documentContent.js";
+import { createPendingUpdateFields } from "../../../data/documents/documentSync.js";
+import { requestDocumentStoreSync } from "../registry.js";
+import { buildAttachmentIntent, buildPendingAttachments, } from "./attachmentIntents.js";
+import { persistStagedAttachmentMutation, restoreFailedAttachmentMutation, } from "./attachmentMutationPersistence.js";
+import { removeLocalAttachmentSlot } from "./attachmentPersistence.js";
+import { deleteUnreferencedStagedAttachmentBytes, installPendingAttachmentRows, stagePendingAttachments, } from "./attachmentStaging.js";
+import { captureAttachmentWriteGeneration, isAttachmentWriteGenerationCurrent, shouldAbortAttachmentPersistFollowup, } from "./attachmentWriteGeneration.js";
+import { ensureDocumentStoreReady } from "./initialization.js";
+import { advancePendingBaseVersion, pendingDeltaSinceBase, persistDocument, } from "./persistence.js";
+import { reportDocumentStoreWriteFailure } from "./reportWriteFailure.js";
+import { canAttachFiles, canWriteDocument, setReadySnapshot, } from "./state.js";
+import { captureDocumentStoreSyncGeneration } from "./syncGeneration.js";
+// Fixed literal: a reported message must never carry file names or slot ids.
+const ATTACHMENT_FAILURE_MESSAGE = "Documents: attachment mutation failed";
+function logAttachedFiles(state, count) {
+    state.runtime.util.log(state.runtime.state.online && state.runtime.auth.isAuthenticated
+        ? `Attached ${count} file${count === 1 ? "" : "s"} to document ${state.localId}.`
+        : `Stored ${count} attachment${count === 1 ? "" : "s"} locally for document ${state.localId}.`);
+}
+async function persistAttachedFiles(state, files, writeGeneration) {
+    if (!isAttachmentWriteGenerationCurrent(state, writeGeneration))
+        return;
+    const currentDoc = state.doc;
+    if (!currentDoc || !canAttachFiles(state)) {
+        state.runtime.util.log("Documents: attachments require a local key package.");
+        return;
+    }
+    const generation = captureDocumentStoreSyncGeneration(state, currentDoc);
+    if (!generation) {
+        return;
+    }
+    const { nextAttachments, nextPendingAttachments } = await buildPendingAttachments(state.localId, files);
+    if (!isAttachmentWriteGenerationCurrent(state, writeGeneration) ||
+        state.doc !== currentDoc)
+        return;
+    const rollbackSnapshot = exportFullHistorySnapshot(currentDoc).slice();
+    addDocumentAttachments(currentDoc, nextAttachments);
+    const attachmentUpdate = pendingDeltaSinceBase(state, currentDoc);
+    // Captured at delta time: the enqueued row proves coverage up to exactly
+    // this version, so it is the frontier the persist below may publish.
+    const coveredVersion = encodeVersionVector(currentDoc);
+    let staged;
+    try {
+        staged = await stagePendingAttachments({
+            files,
+            generation,
+            pendingAttachments: nextPendingAttachments,
+            state,
+        });
+    }
+    catch (error) {
+        await restoreFailedAttachmentMutation({
+            generation,
+            rollbackSnapshot,
+            state,
+        });
+        throw error;
+    }
+    if (!staged) {
+        await restoreFailedAttachmentMutation({
+            generation,
+            rollbackSnapshot,
+            state,
+        });
+        return;
+    }
+    // This persist changes attachments, not prose. setReadySnapshot always
+    // re-derives attachments from the doc, but preserve the text/structured
+    // fields so an attach that overlaps an in-flight keystroke does not republish
+    // a stale doc read over the live optimistic editor value.
+    const persisted = await persistStagedAttachmentMutation({
+        attachmentUpdate,
+        coveredVersion,
+        currentDoc,
+        generation,
+        rollbackSnapshot,
+        staged,
+        state,
+    });
+    if (shouldAbortAttachmentPersistFollowup(state, writeGeneration, generation, persisted)) {
+        await deleteUnreferencedStagedAttachmentBytes({
+            generation,
+            pendingAttachments: staged.pendingAttachments,
+            state,
+        });
+        return;
+    }
+    installPendingAttachmentRows({ ...staged, state });
+    advancePendingBaseVersion(state, currentDoc);
+    logAttachedFiles(state, files.length);
+    requestDocumentStoreSync(state);
+}
+async function persistSlotAttachmentFile(state, slotId, file, writeGeneration) {
+    if (!isAttachmentWriteGenerationCurrent(state, writeGeneration))
+        return;
+    const currentDoc = state.doc;
+    if (!currentDoc || !canAttachFiles(state)) {
+        state.runtime.util.log("Documents: slot attachments require a local key package.");
+        return;
+    }
+    const generation = captureDocumentStoreSyncGeneration(state, currentDoc);
+    if (!generation) {
+        return;
+    }
+    const replacementAttachment = await buildAttachmentIntent(slotId, file);
+    if (!isAttachmentWriteGenerationCurrent(state, writeGeneration) ||
+        state.doc !== currentDoc)
+        return;
+    const rollbackSnapshot = exportFullHistorySnapshot(currentDoc).slice();
+    addDocumentAttachments(currentDoc, [replacementAttachment]);
+    const attachmentUpdate = pendingDeltaSinceBase(state, currentDoc);
+    const coveredVersion = encodeVersionVector(currentDoc);
+    const storageKey = `${state.localId}-${slotId}-${crypto.randomUUID()}`;
+    const pendingAttachment = {
+        byteLength: replacementAttachment.byteLength,
+        contentSha256: replacementAttachment.contentSha256,
+        localId: state.localId,
+        mimeType: replacementAttachment.mimeType,
+        name: replacementAttachment.name,
+        slotId,
+        storageKey,
+    };
+    let staged;
+    try {
+        staged = await stagePendingAttachments({
+            files: [file],
+            generation,
+            pendingAttachments: [pendingAttachment],
+            state,
+        });
+    }
+    catch (error) {
+        await restoreFailedAttachmentMutation({
+            generation,
+            rollbackSnapshot,
+            state,
+        });
+        throw error;
+    }
+    if (!staged) {
+        await restoreFailedAttachmentMutation({
+            generation,
+            rollbackSnapshot,
+            state,
+        });
+        return;
+    }
+    // Preserve the optimistic text/structured fields (see persistAttachedFiles):
+    // a slot replacement overlapping a keystroke must not regress the editor.
+    const persisted = await persistStagedAttachmentMutation({
+        attachmentUpdate,
+        coveredVersion,
+        currentDoc,
+        generation,
+        rollbackSnapshot,
+        staged,
+        state,
+    });
+    if (shouldAbortAttachmentPersistFollowup(state, writeGeneration, generation, persisted)) {
+        await deleteUnreferencedStagedAttachmentBytes({
+            generation,
+            pendingAttachments: staged.pendingAttachments,
+            state,
+        });
+        return;
+    }
+    installPendingAttachmentRows({ ...staged, state });
+    advancePendingBaseVersion(state, currentDoc);
+    state.runtime.util.log(`Queued attachment ${file.name} for slot ${slotId}.`);
+    requestDocumentStoreSync(state);
+}
+async function installCommittedAttachmentRemoval(input) {
+    const { slotId, state, storageKey } = input;
+    if (!storageKey)
+        return;
+    state.pendingAttachments = state.pendingAttachments.filter((attachment) => attachment.slotId !== slotId || attachment.storageKey !== storageKey);
+    if (input.syncedAttachment ||
+        state.attachmentStorageKeyBySlotId[slotId] !== storageKey) {
+        return;
+    }
+    removeLocalAttachmentSlot(state, slotId);
+    await state.runtime.infra.blobStore
+        .deleteBytes(storageKey)
+        .catch(() => state.runtime.util.log(`Documents: failed to delete detached attachment bytes for ${slotId}.`));
+    setReadySnapshot(state, input.currentDoc, state.snapshot.syncing, state.snapshot.text, state.snapshot.structuredFields);
+}
+async function persistRemovedAttachment(state, slotId, writeGeneration) {
+    if (!isAttachmentWriteGenerationCurrent(state, writeGeneration))
+        return;
+    const currentDoc = state.doc;
+    if (!currentDoc) {
+        return;
+    }
+    const generation = captureDocumentStoreSyncGeneration(state, currentDoc);
+    if (!generation) {
+        return;
+    }
+    const existingAttachment = getDocumentAttachments(currentDoc).find((attachment) => attachment.slotId === slotId);
+    if (!existingAttachment) {
+        return;
+    }
+    const storageKey = state.attachmentStorageKeyBySlotId[slotId];
+    if (!isAttachmentWriteGenerationCurrent(state, writeGeneration) ||
+        state.doc !== currentDoc)
+        return;
+    const rollbackSnapshot = exportFullHistorySnapshot(currentDoc).slice();
+    removeDocumentAttachment(currentDoc, slotId);
+    const attachmentUpdate = pendingDeltaSinceBase(state, currentDoc);
+    const coveredVersion = encodeVersionVector(currentDoc);
+    const pendingUpdate = createPendingUpdateFields(attachmentUpdate);
+    const syncedAttachment = Boolean(state.record?.documentId);
+    // Preserve the optimistic text/structured fields (see persistAttachedFiles):
+    // removing an attachment while typing must not regress the editor.
+    let persisted;
+    try {
+        persisted = await persistDocument(state, currentDoc, { snapshotEndVersion: coveredVersion }, {
+            ...(storageKey
+                ? {
+                    attachmentRemoval: {
+                        mode: syncedAttachment
+                            ? "detach"
+                            : "delete",
+                        slotId,
+                        storageKey,
+                    },
+                }
+                : {}),
+            ...(pendingUpdate ? { pendingUpdate } : {}),
+            preserveSnapshotStructuredFields: true,
+            preserveSnapshotText: true,
+        }, generation);
+    }
+    catch (error) {
+        await restoreFailedAttachmentMutation({
+            generation,
+            rollbackSnapshot,
+            state,
+        });
+        throw error;
+    }
+    if (shouldAbortAttachmentPersistFollowup(state, writeGeneration, generation, persisted)) {
+        // See persistAttachedFiles: only durable same-identity work re-arms sync.
+        return;
+    }
+    await installCommittedAttachmentRemoval({
+        currentDoc,
+        slotId,
+        state,
+        storageKey,
+        syncedAttachment,
+    });
+    advancePendingBaseVersion(state, currentDoc);
+    state.runtime.util.log(`Removed attachment ${existingAttachment.name} from document ${state.localId}.`);
+    requestDocumentStoreSync(state);
+}
+export async function attachFilesToDocumentStore(state, scheduleSync, files) {
+    if (files.length === 0) {
+        return;
+    }
+    let ready;
+    try {
+        ready = await ensureDocumentStoreReady(state, scheduleSync);
+    }
+    catch (error) {
+        reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);
+        return;
+    }
+    if (!ready || !state.doc || !canWriteDocument(state)) {
+        return;
+    }
+    const writeGeneration = captureAttachmentWriteGeneration(state);
+    if (!writeGeneration)
+        return;
+    state.writeChain = state.writeChain
+        .catch(() => undefined)
+        .then(async () => persistAttachedFiles(state, files, writeGeneration))
+        .catch((error) => {
+        reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);
+    });
+    return state.writeChain;
+}
+export async function removeAttachmentFromDocumentStore(state, scheduleSync, slotId) {
+    let ready;
+    try {
+        ready = await ensureDocumentStoreReady(state, scheduleSync);
+    }
+    catch (error) {
+        reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);
+        return;
+    }
+    if (!ready || !state.doc || !canWriteDocument(state)) {
+        return;
+    }
+    const writeGeneration = captureAttachmentWriteGeneration(state);
+    if (!writeGeneration)
+        return;
+    state.writeChain = state.writeChain
+        .catch(() => undefined)
+        .then(async () => persistRemovedAttachment(state, slotId, writeGeneration))
+        .catch((error) => {
+        reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);
+    });
+    return state.writeChain;
+}
+export async function replaceAttachmentInDocumentStore(state, scheduleSync, slotId, file) {
+    let ready;
+    try {
+        ready = await ensureDocumentStoreReady(state, scheduleSync);
+    }
+    catch (error) {
+        reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);
+        return;
+    }
+    if (!ready || !state.doc || !canWriteDocument(state)) {
+        return;
+    }
+    const writeGeneration = captureAttachmentWriteGeneration(state);
+    if (!writeGeneration)
+        return;
+    state.writeChain = state.writeChain
+        .catch(() => undefined)
+        .then(async () => persistSlotAttachmentFile(state, slotId, file, writeGeneration))
+        .catch((error) => {
+        reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);
+    });
+    return state.writeChain;
+}
+//# sourceMappingURL=attachments.js.map

package/stores/documents/documentStore/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EACL,uCAAuC,EACvC,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,gCAAgC,EAChC,kCAAkC,EAClC,oCAAoC,GACrC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EACL,cAAc,EACd,gBAAgB,EAEhB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kCAAkC,EAAE,MAAM,kBAAkB,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAE3E,SAAS,gBAAgB,CAAC,KAAyB,EAAE,KAAa;IAChE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC9D,CAAC,CAAC,YAAY,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gBAAgB,KAAK,CAAC,OAAO,GAAG;QACjF,CAAC,CAAC,UAAU,KAAK,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,yBAAyB,KAAK,CAAC,OAAO,GAAG,CACjG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAyB,EACzB,KAA8C,EAC9C,eAA0C;IAE1C,IAAI,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC;QAAE,OAAO;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,qDAAqD,CACtD,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,EAAE,eAAe,EAAE,sBAAsB,EAAE,GAC/C,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtD,IACE,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3D,KAAK,CAAC,GAAG,KAAK,UAAU;QAExB,OAAO;IACT,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IACvE,sBAAsB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClE,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEvD,IAAI,MAA2D,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC;YACrC,KAAK;YACL,UAAU;YACV,kBAAkB,EAAE,sBAAsB;YAC1C,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,+BAA+B,CAAC;YACpC,UAAU;YACV,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,+BAA+B,CAAC;YACpC,UAAU;YACV,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;QACtD,gBAAgB;QAChB,cAAc;QACd,UAAU;QACV,UAAU;QACV,gBAAgB;QAChB,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IACH,IACE,oCAAoC,CAClC,KAAK,EACL,eAAe,EACf,UAAU,EACV,SAAS,CACV,EACD,CAAC;QACD,MAAM,uCAAuC,CAAC;YAC5C,UAAU;YACV,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,4BAA4B,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7C,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAyB,EACzB,MAAc,EACd,IAA8B,EAC9B,eAA0C;IAE1C,IAAI,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC;QAAE,OAAO;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,0DAA0D,CAC3D,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxE,IACE,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3D,KAAK,CAAC,GAAG,KAAK,UAAU;QAExB,OAAO;IACT,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IACvE,sBAAsB,CAAC,UAAU,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACvE,MAAM,iBAAiB,GAA4B;QACjD,UAAU,EAAE,qBAAqB,CAAC,UAAU;QAC5C,aAAa,EAAE,qBAAqB,CAAC,aAAa;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;QACxC,IAAI,EAAE,qBAAqB,CAAC,IAAI;QAChC,MAAM;QACN,UAAU;KACX,CAAC;IACF,IAAI,MAA2D,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC;YACrC,KAAK,EAAE,CAAC,IAAI,CAAC;YACb,UAAU;YACV,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;YACvC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,+BAA+B,CAAC;YACpC,UAAU;YACV,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,+BAA+B,CAAC;YACpC,UAAU;YACV,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;QACtD,gBAAgB;QAChB,cAAc;QACd,UAAU;QACV,UAAU;QACV,gBAAgB;QAChB,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IACH,IACE,oCAAoC,CAClC,KAAK,EACL,eAAe,EACf,UAAU,EACV,SAAS,CACV,EACD,CAAC;QACD,MAAM,uCAAuC,CAAC;YAC5C,UAAU;YACV,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,4BAA4B,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,IAAI,aAAa,MAAM,GAAG,CAAC,CAAC;IAC7E,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAMhD;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,KAAK,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC,MAAM,CACxD,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,KAAK,UAAU,CACvE,CAAC;IACF,IACE,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,KAAK,UAAU,EACzD,CAAC;QACD,OAAO;IACT,CAAC;IACD,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS;SAChC,WAAW,CAAC,UAAU,CAAC;SACvB,KAAK,CAAC,GAAG,EAAE,CACV,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,MAAM,GAAG,CACvE,CACF,CAAC;IACJ,gBAAgB,CACd,KAAK,EACL,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,QAAQ,CAAC,OAAO,EACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAyB,EACzB,MAAc,EACd,eAA0C;IAE1C,IAAI,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC;QAAE,OAAO;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC,IAAI,CAChE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAC7C,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC9D,IACE,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3D,KAAK,CAAC,GAAG,KAAK,UAAU;QAExB,OAAO;IACT,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IACvE,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE3D,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,SAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,eAAe,CAC/B,KAAK,EACL,UAAU,EACV,EAAE,kBAAkB,EAAE,cAAc,EAAE,EACtC;YACE,GAAG,CAAC,UAAU;gBACZ,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACjB,IAAI,EAAE,gBAAgB;4BACpB,CAAC,CAAE,QAAkB;4BACrB,CAAC,CAAE,QAAkB;wBACvB,MAAM;wBACN,UAAU;qBACX;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,gCAAgC,EAAE,IAAI;YACtC,oBAAoB,EAAE,IAAI;SAC3B,EACD,UAAU,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,+BAA+B,CAAC;YACpC,UAAU;YACV,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IACE,oCAAoC,CAClC,KAAK,EACL,eAAe,EACf,UAAU,EACV,SAAS,CACV,EACD,CAAC;QACD,0EAA0E;QAC1E,OAAO;IACT,CAAC;IACD,MAAM,iCAAiC,CAAC;QACtC,UAAU;QACV,MAAM;QACN,KAAK;QACL,UAAU;QACV,gBAAgB;KACjB,CAAC,CAAC;IACH,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,sBAAsB,kBAAkB,CAAC,IAAI,kBAAkB,KAAK,CAAC,OAAO,GAAG,CAChF,CAAC;IACF,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAyB,EACzB,YAAwB,EACxB,KAA8C;IAE9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+BAA+B,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;SACrE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,+BAA+B,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACL,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAyB,EACzB,YAAwB,EACxB,MAAc;IAEd,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+BAA+B,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,+BAA+B,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACL,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAyB,EACzB,YAAwB,EACxB,MAAc,EACd,IAA8B;IAE9B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+BAA+B,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtB,IAAI,CAAC,KAAK,IAAI,EAAE,CACf,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAChE;SACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,+BAA+B,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACL,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC","sourcesContent":["import {\n  encodeVersionVector,\n  exportFullHistorySnapshot,\n} from \"@tearleads/loro\";\nimport {\n  addDocumentAttachments,\n  getDocumentAttachments,\n  removeDocumentAttachment,\n} from \"../../../data/documents/documentContent\";\nimport { createPendingUpdateFields } from \"../../../data/documents/documentSync\";\nimport type { PendingAttachmentRecord } from \"../../../workflows/documents\";\nimport { requestDocumentStoreSync } from \"../registry\";\nimport type { DocumentAttachmentUpload } from \"../types\";\nimport {\n  buildAttachmentIntent,\n  buildPendingAttachments,\n} from \"./attachmentIntents\";\nimport {\n  persistStagedAttachmentMutation,\n  restoreFailedAttachmentMutation,\n} from \"./attachmentMutationPersistence\";\nimport { removeLocalAttachmentSlot } from \"./attachmentPersistence\";\nimport {\n  deleteUnreferencedStagedAttachmentBytes,\n  installPendingAttachmentRows,\n  stagePendingAttachments,\n} from \"./attachmentStaging\";\nimport {\n  type AttachmentWriteGeneration,\n  captureAttachmentWriteGeneration,\n  isAttachmentWriteGenerationCurrent,\n  shouldAbortAttachmentPersistFollowup,\n} from \"./attachmentWriteGeneration\";\nimport { ensureDocumentStoreReady } from \"./initialization\";\nimport {\n  advancePendingBaseVersion,\n  pendingDeltaSinceBase,\n  persistDocument,\n} from \"./persistence\";\nimport { reportDocumentStoreWriteFailure } from \"./reportWriteFailure\";\nimport {\n  canAttachFiles,\n  canWriteDocument,\n  type DocumentStoreState,\n  setReadySnapshot,\n} from \"./state\";\nimport { captureDocumentStoreSyncGeneration } from \"./syncGeneration\";\n\n// Fixed literal: a reported message must never carry file names or slot ids.\nconst ATTACHMENT_FAILURE_MESSAGE = \"Documents: attachment mutation failed\";\n\nfunction logAttachedFiles(state: DocumentStoreState, count: number) {\n  state.runtime.util.log(\n    state.runtime.state.online && state.runtime.auth.isAuthenticated\n      ? `Attached ${count} file${count === 1 ? \"\" : \"s\"} to document ${state.localId}.`\n      : `Stored ${count} attachment${count === 1 ? \"\" : \"s\"} locally for document ${state.localId}.`,\n  );\n}\n\nasync function persistAttachedFiles(\n  state: DocumentStoreState,\n  files: ReadonlyArray<DocumentAttachmentUpload>,\n  writeGeneration: AttachmentWriteGeneration,\n) {\n  if (!isAttachmentWriteGenerationCurrent(state, writeGeneration)) return;\n  const currentDoc = state.doc;\n\n  if (!currentDoc || !canAttachFiles(state)) {\n    state.runtime.util.log(\n      \"Documents: attachments require a local key package.\",\n    );\n    return;\n  }\n  const generation = captureDocumentStoreSyncGeneration(state, currentDoc);\n  if (!generation) {\n    return;\n  }\n\n  const { nextAttachments, nextPendingAttachments } =\n    await buildPendingAttachments(state.localId, files);\n  if (\n    !isAttachmentWriteGenerationCurrent(state, writeGeneration) ||\n    state.doc !== currentDoc\n  )\n    return;\n  const rollbackSnapshot = exportFullHistorySnapshot(currentDoc).slice();\n  addDocumentAttachments(currentDoc, nextAttachments);\n  const attachmentUpdate = pendingDeltaSinceBase(state, currentDoc);\n  // Captured at delta time: the enqueued row proves coverage up to exactly\n  // this version, so it is the frontier the persist below may publish.\n  const coveredVersion = encodeVersionVector(currentDoc);\n\n  let staged: Awaited<ReturnType<typeof stagePendingAttachments>>;\n  try {\n    staged = await stagePendingAttachments({\n      files,\n      generation,\n      pendingAttachments: nextPendingAttachments,\n      state,\n    });\n  } catch (error) {\n    await restoreFailedAttachmentMutation({\n      generation,\n      rollbackSnapshot,\n      state,\n    });\n    throw error;\n  }\n  if (!staged) {\n    await restoreFailedAttachmentMutation({\n      generation,\n      rollbackSnapshot,\n      state,\n    });\n    return;\n  }\n  // This persist changes attachments, not prose. setReadySnapshot always\n  // re-derives attachments from the doc, but preserve the text/structured\n  // fields so an attach that overlaps an in-flight keystroke does not republish\n  // a stale doc read over the live optimistic editor value.\n  const persisted = await persistStagedAttachmentMutation({\n    attachmentUpdate,\n    coveredVersion,\n    currentDoc,\n    generation,\n    rollbackSnapshot,\n    staged,\n    state,\n  });\n  if (\n    shouldAbortAttachmentPersistFollowup(\n      state,\n      writeGeneration,\n      generation,\n      persisted,\n    )\n  ) {\n    await deleteUnreferencedStagedAttachmentBytes({\n      generation,\n      pendingAttachments: staged.pendingAttachments,\n      state,\n    });\n    return;\n  }\n  installPendingAttachmentRows({ ...staged, state });\n  advancePendingBaseVersion(state, currentDoc);\n  logAttachedFiles(state, files.length);\n  requestDocumentStoreSync(state);\n}\n\nasync function persistSlotAttachmentFile(\n  state: DocumentStoreState,\n  slotId: string,\n  file: DocumentAttachmentUpload,\n  writeGeneration: AttachmentWriteGeneration,\n) {\n  if (!isAttachmentWriteGenerationCurrent(state, writeGeneration)) return;\n  const currentDoc = state.doc;\n\n  if (!currentDoc || !canAttachFiles(state)) {\n    state.runtime.util.log(\n      \"Documents: slot attachments require a local key package.\",\n    );\n    return;\n  }\n  const generation = captureDocumentStoreSyncGeneration(state, currentDoc);\n  if (!generation) {\n    return;\n  }\n\n  const replacementAttachment = await buildAttachmentIntent(slotId, file);\n  if (\n    !isAttachmentWriteGenerationCurrent(state, writeGeneration) ||\n    state.doc !== currentDoc\n  )\n    return;\n  const rollbackSnapshot = exportFullHistorySnapshot(currentDoc).slice();\n  addDocumentAttachments(currentDoc, [replacementAttachment]);\n  const attachmentUpdate = pendingDeltaSinceBase(state, currentDoc);\n  const coveredVersion = encodeVersionVector(currentDoc);\n\n  const storageKey = `${state.localId}-${slotId}-${crypto.randomUUID()}`;\n  const pendingAttachment: PendingAttachmentRecord = {\n    byteLength: replacementAttachment.byteLength,\n    contentSha256: replacementAttachment.contentSha256,\n    localId: state.localId,\n    mimeType: replacementAttachment.mimeType,\n    name: replacementAttachment.name,\n    slotId,\n    storageKey,\n  };\n  let staged: Awaited<ReturnType<typeof stagePendingAttachments>>;\n  try {\n    staged = await stagePendingAttachments({\n      files: [file],\n      generation,\n      pendingAttachments: [pendingAttachment],\n      state,\n    });\n  } catch (error) {\n    await restoreFailedAttachmentMutation({\n      generation,\n      rollbackSnapshot,\n      state,\n    });\n    throw error;\n  }\n  if (!staged) {\n    await restoreFailedAttachmentMutation({\n      generation,\n      rollbackSnapshot,\n      state,\n    });\n    return;\n  }\n  // Preserve the optimistic text/structured fields (see persistAttachedFiles):\n  // a slot replacement overlapping a keystroke must not regress the editor.\n  const persisted = await persistStagedAttachmentMutation({\n    attachmentUpdate,\n    coveredVersion,\n    currentDoc,\n    generation,\n    rollbackSnapshot,\n    staged,\n    state,\n  });\n  if (\n    shouldAbortAttachmentPersistFollowup(\n      state,\n      writeGeneration,\n      generation,\n      persisted,\n    )\n  ) {\n    await deleteUnreferencedStagedAttachmentBytes({\n      generation,\n      pendingAttachments: staged.pendingAttachments,\n      state,\n    });\n    return;\n  }\n  installPendingAttachmentRows({ ...staged, state });\n  advancePendingBaseVersion(state, currentDoc);\n  state.runtime.util.log(`Queued attachment ${file.name} for slot ${slotId}.`);\n  requestDocumentStoreSync(state);\n}\n\nasync function installCommittedAttachmentRemoval(input: {\n  currentDoc: NonNullable<DocumentStoreState[\"doc\"]>;\n  slotId: string;\n  state: DocumentStoreState;\n  storageKey: string | undefined;\n  syncedAttachment: boolean;\n}): Promise<void> {\n  const { slotId, state, storageKey } = input;\n  if (!storageKey) return;\n  state.pendingAttachments = state.pendingAttachments.filter(\n    (attachment) =>\n      attachment.slotId !== slotId || attachment.storageKey !== storageKey,\n  );\n  if (\n    input.syncedAttachment ||\n    state.attachmentStorageKeyBySlotId[slotId] !== storageKey\n  ) {\n    return;\n  }\n  removeLocalAttachmentSlot(state, slotId);\n  await state.runtime.infra.blobStore\n    .deleteBytes(storageKey)\n    .catch(() =>\n      state.runtime.util.log(\n        `Documents: failed to delete detached attachment bytes for ${slotId}.`,\n      ),\n    );\n  setReadySnapshot(\n    state,\n    input.currentDoc,\n    state.snapshot.syncing,\n    state.snapshot.text,\n    state.snapshot.structuredFields,\n  );\n}\n\nasync function persistRemovedAttachment(\n  state: DocumentStoreState,\n  slotId: string,\n  writeGeneration: AttachmentWriteGeneration,\n) {\n  if (!isAttachmentWriteGenerationCurrent(state, writeGeneration)) return;\n  const currentDoc = state.doc;\n  if (!currentDoc) {\n    return;\n  }\n  const generation = captureDocumentStoreSyncGeneration(state, currentDoc);\n  if (!generation) {\n    return;\n  }\n\n  const existingAttachment = getDocumentAttachments(currentDoc).find(\n    (attachment) => attachment.slotId === slotId,\n  );\n  if (!existingAttachment) {\n    return;\n  }\n\n  const storageKey = state.attachmentStorageKeyBySlotId[slotId];\n  if (\n    !isAttachmentWriteGenerationCurrent(state, writeGeneration) ||\n    state.doc !== currentDoc\n  )\n    return;\n  const rollbackSnapshot = exportFullHistorySnapshot(currentDoc).slice();\n  removeDocumentAttachment(currentDoc, slotId);\n  const attachmentUpdate = pendingDeltaSinceBase(state, currentDoc);\n  const coveredVersion = encodeVersionVector(currentDoc);\n  const pendingUpdate = createPendingUpdateFields(attachmentUpdate);\n  const syncedAttachment = Boolean(state.record?.documentId);\n\n  // Preserve the optimistic text/structured fields (see persistAttachedFiles):\n  // removing an attachment while typing must not regress the editor.\n  let persisted: Awaited<ReturnType<typeof persistDocument>>;\n  try {\n    persisted = await persistDocument(\n      state,\n      currentDoc,\n      { snapshotEndVersion: coveredVersion },\n      {\n        ...(storageKey\n          ? {\n              attachmentRemoval: {\n                mode: syncedAttachment\n                  ? (\"detach\" as const)\n                  : (\"delete\" as const),\n                slotId,\n                storageKey,\n              },\n            }\n          : {}),\n        ...(pendingUpdate ? { pendingUpdate } : {}),\n        preserveSnapshotStructuredFields: true,\n        preserveSnapshotText: true,\n      },\n      generation,\n    );\n  } catch (error) {\n    await restoreFailedAttachmentMutation({\n      generation,\n      rollbackSnapshot,\n      state,\n    });\n    throw error;\n  }\n  if (\n    shouldAbortAttachmentPersistFollowup(\n      state,\n      writeGeneration,\n      generation,\n      persisted,\n    )\n  ) {\n    // See persistAttachedFiles: only durable same-identity work re-arms sync.\n    return;\n  }\n  await installCommittedAttachmentRemoval({\n    currentDoc,\n    slotId,\n    state,\n    storageKey,\n    syncedAttachment,\n  });\n  advancePendingBaseVersion(state, currentDoc);\n  state.runtime.util.log(\n    `Removed attachment ${existingAttachment.name} from document ${state.localId}.`,\n  );\n  requestDocumentStoreSync(state);\n}\n\nexport async function attachFilesToDocumentStore(\n  state: DocumentStoreState,\n  scheduleSync: () => void,\n  files: ReadonlyArray<DocumentAttachmentUpload>,\n) {\n  if (files.length === 0) {\n    return;\n  }\n\n  let ready: boolean;\n  try {\n    ready = await ensureDocumentStoreReady(state, scheduleSync);\n  } catch (error) {\n    reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);\n    return;\n  }\n\n  if (!ready || !state.doc || !canWriteDocument(state)) {\n    return;\n  }\n\n  const writeGeneration = captureAttachmentWriteGeneration(state);\n  if (!writeGeneration) return;\n  state.writeChain = state.writeChain\n    .catch(() => undefined)\n    .then(async () => persistAttachedFiles(state, files, writeGeneration))\n    .catch((error: unknown) => {\n      reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);\n    });\n  return state.writeChain;\n}\n\nexport async function removeAttachmentFromDocumentStore(\n  state: DocumentStoreState,\n  scheduleSync: () => void,\n  slotId: string,\n) {\n  let ready: boolean;\n  try {\n    ready = await ensureDocumentStoreReady(state, scheduleSync);\n  } catch (error) {\n    reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);\n    return;\n  }\n\n  if (!ready || !state.doc || !canWriteDocument(state)) {\n    return;\n  }\n\n  const writeGeneration = captureAttachmentWriteGeneration(state);\n  if (!writeGeneration) return;\n  state.writeChain = state.writeChain\n    .catch(() => undefined)\n    .then(async () => persistRemovedAttachment(state, slotId, writeGeneration))\n    .catch((error: unknown) => {\n      reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);\n    });\n  return state.writeChain;\n}\n\nexport async function replaceAttachmentInDocumentStore(\n  state: DocumentStoreState,\n  scheduleSync: () => void,\n  slotId: string,\n  file: DocumentAttachmentUpload,\n) {\n  let ready: boolean;\n  try {\n    ready = await ensureDocumentStoreReady(state, scheduleSync);\n  } catch (error) {\n    reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);\n    return;\n  }\n\n  if (!ready || !state.doc || !canWriteDocument(state)) {\n    return;\n  }\n\n  const writeGeneration = captureAttachmentWriteGeneration(state);\n  if (!writeGeneration) return;\n  state.writeChain = state.writeChain\n    .catch(() => undefined)\n    .then(async () =>\n      persistSlotAttachmentFile(state, slotId, file, writeGeneration),\n    )\n    .catch((error: unknown) => {\n      reportDocumentStoreWriteFailure(state, ATTACHMENT_FAILURE_MESSAGE, error);\n    });\n  return state.writeChain;\n}\n"]}

package/stores/documents/documentStore/discard.js

@@ -0,0 +1,88 @@
+import { discardPersistedDocumentToShell, reclaimDocumentOrphanBlobs, } from "../../../workflows/documents/index.js";
+import { chainIdentityWrite } from "./identityWriteChain.js";
+import { resetDocumentStore } from "./state.js";
+/**
+ * User-initiated escape hatch for a document whose queued local writes can no
+ * longer sync (e.g. an outgoing queue whose update ids conflict forever):
+ * convert the locally persisted document to the freshly-discovered-share
+ * shell (documentId kept, empty snapshot, queue/history/failure rows
+ * dropped) so the store re-hydrates the server copy. The shell matters twice
+ * over: priming's candidate scan reads the documents rows themselves, so a
+ * fully deleted record would never be restored after a restart, and
+ * re-initialization needs the record to hydrate instead of eagerly creating
+ * a blank document. discardPersistedDocumentToShell owns the row-level
+ * sequence — including refusing local-only, unlinked, and move-pending
+ * documents under its serialized mutation — and converts the record in
+ * place, so no step leaves the document row absent.
+ *
+ * The caller restarts initialization after this settles (success or not);
+ * the reset store then hydrates from whatever rows the sequence left. That
+ * restart must happen OUTSIDE the identity-chained task — initialization
+ * chains identity writes of its own, so starting it there would deadlock.
+ */
+export async function discardDocumentStoreLocalState(state, expectedDocumentId) {
+    const runtime = state.runtime;
+    if (runtime.infra.dbStatus !== "ready") {
+        return false;
+    }
+    // Cheap eligibility probe before disturbing the live store: an obviously
+    // ineligible document (local-only, unlinked, or one whose identity is not
+    // the one the caller asked to discard) returns without stopping writes.
+    // The workflow re-checks under its serialized mutation, so a status change
+    // between here and there is still refused safely.
+    const execSql = runtime.infra.execSql;
+    const record = await state.persistence.loadDocument(execSql, state.localId);
+    if (!record?.documentId ||
+        record.documentId !== expectedDocumentId ||
+        !record.containerId) {
+        return false;
+    }
+    // Stop local writes before draining: dropping the live doc rejects new
+    // mutations at queue time, and the generation bump invalidates queued
+    // write tasks that have not started (and in-flight attachment passes and
+    // initializations, which re-check the generation inside their writes'
+    // serialized mutations).
+    state.doc = null;
+    state.localWriteGeneration += 1;
+    // Drain OUTSIDE the identity chain. Write-chain tasks can themselves enter
+    // the identity chain (the stale-heal recovery installs its rebuilt
+    // document that way), so awaiting the write chain while holding an
+    // identity-chain slot would deadlock: the drained task would queue behind
+    // this one and each would wait on the other forever. Out here the drain is
+    // a plain await; whatever the drained tasks chain onto the identity chain
+    // runs before the teardown task below and is superseded by it.
+    await state.writeChain.catch(() => undefined);
+    return chainIdentityWrite(state, async () => {
+        let shell;
+        try {
+            shell = await discardPersistedDocumentToShell({
+                documentProjectors: runtime.infra.documentProjectors,
+                execSql,
+                expectedDocumentId,
+                localId: state.localId,
+                persistence: state.persistence,
+            });
+        }
+        catch {
+            // The conversion is in-place, so an interrupted sequence still leaves a
+            // loadable record (old or shell). Reset so re-initialization reloads
+            // whatever survived instead of running on the dropped live doc.
+            resetDocumentStore(state);
+            runtime.util.log(`Documents: discard failed for document ${state.localId}; store reset to reload persisted state`);
+            return false;
+        }
+        if (!shell.discarded) {
+            // Refused under the lock (a move intent, or an identity change since
+            // the probe): rows are untouched; reset so the store reloads them.
+            resetDocumentStore(state);
+            return false;
+        }
+        // The conversion queued the bytes its dropped rows pointed to; the
+        // reclaim deletes each only once no other row references it.
+        await reclaimDocumentOrphanBlobs(runtime);
+        resetDocumentStore(state);
+        runtime.util.log(`Documents: discarded local edits for document ${state.localId}; re-pulling the server copy`);
+        return true;
+    });
+}
+//# sourceMappingURL=discard.js.map

package/stores/documents/documentStore/discard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discard.js","sourceRoot":"","sources":["discard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAA2B,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAyB,EACzB,kBAA0B;IAE1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,IACE,CAAC,MAAM,EAAE,UAAU;QACnB,MAAM,CAAC,UAAU,KAAK,kBAAkB;QACxC,CAAC,MAAM,CAAC,WAAW,EACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,yBAAyB;IACzB,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;IACjB,KAAK,CAAC,oBAAoB,IAAI,CAAC,CAAC;IAChC,2EAA2E;IAC3E,mEAAmE;IACnE,mEAAmE;IACnE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC1C,IAAI,KAAkE,CAAC;QACvE,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,+BAA+B,CAAC;gBAC5C,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,kBAAkB;gBACpD,OAAO;gBACP,kBAAkB;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,0CAA0C,KAAK,CAAC,OAAO,yCAAyC,CACjG,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,qEAAqE;YACrE,mEAAmE;YACnE,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC1C,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,iDAAiD,KAAK,CAAC,OAAO,8BAA8B,CAC7F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  discardPersistedDocumentToShell,\n  reclaimDocumentOrphanBlobs,\n} from \"../../../workflows/documents\";\nimport { chainIdentityWrite } from \"./identityWriteChain\";\nimport { type DocumentStoreState, resetDocumentStore } from \"./state\";\n\n/**\n * User-initiated escape hatch for a document whose queued local writes can no\n * longer sync (e.g. an outgoing queue whose update ids conflict forever):\n * convert the locally persisted document to the freshly-discovered-share\n * shell (documentId kept, empty snapshot, queue/history/failure rows\n * dropped) so the store re-hydrates the server copy. The shell matters twice\n * over: priming's candidate scan reads the documents rows themselves, so a\n * fully deleted record would never be restored after a restart, and\n * re-initialization needs the record to hydrate instead of eagerly creating\n * a blank document. discardPersistedDocumentToShell owns the row-level\n * sequence — including refusing local-only, unlinked, and move-pending\n * documents under its serialized mutation — and converts the record in\n * place, so no step leaves the document row absent.\n *\n * The caller restarts initialization after this settles (success or not);\n * the reset store then hydrates from whatever rows the sequence left. That\n * restart must happen OUTSIDE the identity-chained task — initialization\n * chains identity writes of its own, so starting it there would deadlock.\n */\nexport async function discardDocumentStoreLocalState(\n  state: DocumentStoreState,\n  expectedDocumentId: string,\n): Promise<boolean> {\n  const runtime = state.runtime;\n  if (runtime.infra.dbStatus !== \"ready\") {\n    return false;\n  }\n\n  // Cheap eligibility probe before disturbing the live store: an obviously\n  // ineligible document (local-only, unlinked, or one whose identity is not\n  // the one the caller asked to discard) returns without stopping writes.\n  // The workflow re-checks under its serialized mutation, so a status change\n  // between here and there is still refused safely.\n  const execSql = runtime.infra.execSql;\n  const record = await state.persistence.loadDocument(execSql, state.localId);\n  if (\n    !record?.documentId ||\n    record.documentId !== expectedDocumentId ||\n    !record.containerId\n  ) {\n    return false;\n  }\n\n  // Stop local writes before draining: dropping the live doc rejects new\n  // mutations at queue time, and the generation bump invalidates queued\n  // write tasks that have not started (and in-flight attachment passes and\n  // initializations, which re-check the generation inside their writes'\n  // serialized mutations).\n  state.doc = null;\n  state.localWriteGeneration += 1;\n  // Drain OUTSIDE the identity chain. Write-chain tasks can themselves enter\n  // the identity chain (the stale-heal recovery installs its rebuilt\n  // document that way), so awaiting the write chain while holding an\n  // identity-chain slot would deadlock: the drained task would queue behind\n  // this one and each would wait on the other forever. Out here the drain is\n  // a plain await; whatever the drained tasks chain onto the identity chain\n  // runs before the teardown task below and is superseded by it.\n  await state.writeChain.catch(() => undefined);\n\n  return chainIdentityWrite(state, async () => {\n    let shell: Awaited<ReturnType<typeof discardPersistedDocumentToShell>>;\n    try {\n      shell = await discardPersistedDocumentToShell({\n        documentProjectors: runtime.infra.documentProjectors,\n        execSql,\n        expectedDocumentId,\n        localId: state.localId,\n        persistence: state.persistence,\n      });\n    } catch {\n      // The conversion is in-place, so an interrupted sequence still leaves a\n      // loadable record (old or shell). Reset so re-initialization reloads\n      // whatever survived instead of running on the dropped live doc.\n      resetDocumentStore(state);\n      runtime.util.log(\n        `Documents: discard failed for document ${state.localId}; store reset to reload persisted state`,\n      );\n      return false;\n    }\n    if (!shell.discarded) {\n      // Refused under the lock (a move intent, or an identity change since\n      // the probe): rows are untouched; reset so the store reloads them.\n      resetDocumentStore(state);\n      return false;\n    }\n\n    // The conversion queued the bytes its dropped rows pointed to; the\n    // reclaim deletes each only once no other row references it.\n    await reclaimDocumentOrphanBlobs(runtime);\n    resetDocumentStore(state);\n    runtime.util.log(\n      `Documents: discarded local edits for document ${state.localId}; re-pulling the server copy`,\n    );\n    return true;\n  });\n}\n"]}

package/stores/documents/documentStore/documentHistoryCompaction.js

@@ -0,0 +1,67 @@
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+import { encodeVersionVector, exportFullHistorySnapshot, updateMatchesDocumentHistory, } from "../../../internal/loro/index.js";
+import { DOCUMENT_HISTORY_COMPACTION_MAX_BYTES, DOCUMENT_HISTORY_COMPACTION_MAX_ROWS, } from "../../../workflows/documents/index.js";
+import { captureDocumentStoreSyncGeneration, isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent, } from "./syncGeneration.js";
+/**
+ * Refresh the durable full-history checkpoint when the tail has grown past
+ * the compaction thresholds, or seed the first checkpoint as soon as the
+ * document can export full history (a freshly created or rebuilt document is
+ * cheap to export; waiting for the threshold would leave restarts without
+ * history until then). The snapshot comes from the LIVE document, which has
+ * every tail update imported, so clearing the tail loses nothing.
+ */
+export async function maybeCompactDocumentHistory(state, currentDoc, stillCurrent) {
+    const { persistence } = state;
+    // Bind this compaction to the store context it started under: a store
+    // reset or runtime swap mid-compaction must not let the OLD document's
+    // checkpoint overwrite the replacement generation's history (or land in a
+    // newly selected database).
+    const generation = captureDocumentStoreSyncGeneration(state, currentDoc);
+    if (!generation || stillCurrent?.() === false) {
+        return;
+    }
+    const execSql = state.runtime.infra.execSql;
+    const tail = await persistence.readHistoryTailSize(execSql, state.localId);
+    if (tail.hasCheckpoint &&
+        tail.rowCount < DOCUMENT_HISTORY_COMPACTION_MAX_ROWS &&
+        tail.byteLength < DOCUMENT_HISTORY_COMPACTION_MAX_BYTES) {
+        return;
+    }
+    // Capture the tail BEFORE exporting, then prove coverage per row: another
+    // pane can append ops this pane's document has not merged, so blanket
+    // deletion would discard the only durable copy. Unproven rows survive for
+    // a later compaction by whichever pane holds their ops.
+    const tailEntries = await persistence.listHistoryTailEntries(execSql, state.localId);
+    const snapshot = exportFullHistorySnapshot(currentDoc);
+    if (!isSyncGenerationCurrent(state, generation) ||
+        stillCurrent?.() === false) {
+        return;
+    }
+    const endVersionVector = encodeVersionVector(currentDoc);
+    await persistence.replaceHistoryCheckpoint(execSql, {
+        coveredTailIds: coveredHistoryTailIds(tailEntries, currentDoc),
+        endVersionVector,
+        localId: state.localId,
+        snapshot: bytesToBase64(snapshot),
+        stillCurrent: () => isSyncGenerationCurrent(state, generation) && stillCurrent?.() !== false,
+    });
+}
+/**
+ * Tail rows whose exact operations already belong to the checkpoint document.
+ * Version-vector dominance is insufficient: a same-frontier fork has the same
+ * declared range, and malformed rows must survive so recovery fails closed
+ * instead of compaction deleting the evidence before provenance validation.
+ */
+function coveredHistoryTailIds(tailEntries, document) {
+    return tailEntries.flatMap((entry) => {
+        try {
+            return updateMatchesDocumentHistory(document, base64ToBytes(entry.updateData))
+                ? [entry.id]
+                : [];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+//# sourceMappingURL=documentHistoryCompaction.js.map

package/stores/documents/documentStore/documentHistoryCompaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentHistoryCompaction.js","sourceRoot":"","sources":["documentHistoryCompaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,kCAAkC,EAClC,oCAAoC,IAAI,uBAAuB,GAChE,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAyB,EACzB,UAAyB,EACzB,YAA0C;IAE1C,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC9B,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IACE,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,QAAQ,GAAG,oCAAoC;QACpD,IAAI,CAAC,UAAU,GAAG,qCAAqC,EACvD,CAAC;QACD,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC1D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACvD,IACE,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3C,YAAY,EAAE,EAAE,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,WAAW,CAAC,wBAAwB,CAAC,OAAO,EAAE;QAClD,cAAc,EAAE,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC;QAC9D,gBAAgB;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;QACjC,YAAY,EAAE,GAAG,EAAE,CACjB,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;KAC3E,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,WAA0D,EAC1D,QAAuB;IAEvB,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,4BAA4B,CACjC,QAAQ,EACR,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAChC;gBACC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  encodeVersionVector,\n  exportFullHistorySnapshot,\n  updateMatchesDocumentHistory,\n} from \"@tearleads/loro\";\nimport {\n  DOCUMENT_HISTORY_COMPACTION_MAX_BYTES,\n  DOCUMENT_HISTORY_COMPACTION_MAX_ROWS,\n} from \"../../../workflows/documents\";\nimport type { DocumentState, DocumentStoreState } from \"./state\";\nimport {\n  captureDocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\n/**\n * Refresh the durable full-history checkpoint when the tail has grown past\n * the compaction thresholds, or seed the first checkpoint as soon as the\n * document can export full history (a freshly created or rebuilt document is\n * cheap to export; waiting for the threshold would leave restarts without\n * history until then). The snapshot comes from the LIVE document, which has\n * every tail update imported, so clearing the tail loses nothing.\n */\nexport async function maybeCompactDocumentHistory(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  const { persistence } = state;\n  // Bind this compaction to the store context it started under: a store\n  // reset or runtime swap mid-compaction must not let the OLD document's\n  // checkpoint overwrite the replacement generation's history (or land in a\n  // newly selected database).\n  const generation = captureDocumentStoreSyncGeneration(state, currentDoc);\n  if (!generation || stillCurrent?.() === false) {\n    return;\n  }\n  const execSql = state.runtime.infra.execSql;\n  const tail = await persistence.readHistoryTailSize(execSql, state.localId);\n  if (\n    tail.hasCheckpoint &&\n    tail.rowCount < DOCUMENT_HISTORY_COMPACTION_MAX_ROWS &&\n    tail.byteLength < DOCUMENT_HISTORY_COMPACTION_MAX_BYTES\n  ) {\n    return;\n  }\n\n  // Capture the tail BEFORE exporting, then prove coverage per row: another\n  // pane can append ops this pane's document has not merged, so blanket\n  // deletion would discard the only durable copy. Unproven rows survive for\n  // a later compaction by whichever pane holds their ops.\n  const tailEntries = await persistence.listHistoryTailEntries(\n    execSql,\n    state.localId,\n  );\n  const snapshot = exportFullHistorySnapshot(currentDoc);\n  if (\n    !isSyncGenerationCurrent(state, generation) ||\n    stillCurrent?.() === false\n  ) {\n    return;\n  }\n  const endVersionVector = encodeVersionVector(currentDoc);\n  await persistence.replaceHistoryCheckpoint(execSql, {\n    coveredTailIds: coveredHistoryTailIds(tailEntries, currentDoc),\n    endVersionVector,\n    localId: state.localId,\n    snapshot: bytesToBase64(snapshot),\n    stillCurrent: () =>\n      isSyncGenerationCurrent(state, generation) && stillCurrent?.() !== false,\n  });\n}\n\n/**\n * Tail rows whose exact operations already belong to the checkpoint document.\n * Version-vector dominance is insufficient: a same-frontier fork has the same\n * declared range, and malformed rows must survive so recovery fails closed\n * instead of compaction deleting the evidence before provenance validation.\n */\nfunction coveredHistoryTailIds(\n  tailEntries: readonly { id: string; updateData: string }[],\n  document: DocumentState,\n): string[] {\n  return tailEntries.flatMap((entry) => {\n    try {\n      return updateMatchesDocumentHistory(\n        document,\n        base64ToBytes(entry.updateData),\n      )\n        ? [entry.id]\n        : [];\n    } catch {\n      return [];\n    }\n  });\n}\n"]}