@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/stores/documents/documentStore/attachmentMutationPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentMutationPersistence.js","sourceRoot":"","sources":["attachmentMutationPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,uCAAuC,GAExC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIhD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,gCAAgC,CAAC;QACrC,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,uCAAuC,EAAE,IAAI;QAC7C,oBAAoB,EAAE,KAAK,CAAC,gBAAgB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAUrD;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAC1B,KAAK,EACL,KAAK,CAAC,UAAU,EAChB,EAAE,kBAAkB,EAAE,KAAK,CAAC,cAAc,EAAE,EAC5C;YACE,iBAAiB,EAAE,MAAM;YACzB,aAAa,EACX,yBAAyB,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,SAAS;YAChE,gCAAgC,EAAE,IAAI;YACtC,oBAAoB,EAAE,IAAI;SAC3B,EACD,KAAK,CAAC,UAAU,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uCAAuC,CAAC;YAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,KAAK;SACN,CAAC,CAAC;QACH,MAAM,+BAA+B,CAAC;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,KAAK;SACN,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { createPendingUpdateFields } from \"../../../data/documents/documentSync\";\nimport {\n  deleteUnreferencedStagedAttachmentBytes,\n  type stagePendingAttachments,\n} from \"./attachmentStaging\";\nimport { reloadDocumentFromDurableHistory } from \"./durableDocumentReload\";\nimport { persistDocument } from \"./persistence\";\nimport type { DocumentStoreState } from \"./state\";\nimport type { captureDocumentStoreSyncGeneration } from \"./syncGeneration\";\n\nexport async function restoreFailedAttachmentMutation(input: {\n  generation: NonNullable<\n    ReturnType<typeof captureDocumentStoreSyncGeneration>\n  >;\n  rollbackSnapshot: Uint8Array;\n  state: DocumentStoreState;\n}): Promise<void> {\n  await reloadDocumentFromDurableHistory({\n    expectedGeneration: input.generation,\n    preserveQueuedWritesWhenIdentityMatches: true,\n    sameIdentitySnapshot: input.rollbackSnapshot,\n    state: input.state,\n  });\n}\n\nexport async function persistStagedAttachmentMutation(input: {\n  attachmentUpdate: Uint8Array;\n  coveredVersion: string;\n  currentDoc: NonNullable<DocumentStoreState[\"doc\"]>;\n  generation: NonNullable<\n    ReturnType<typeof captureDocumentStoreSyncGeneration>\n  >;\n  rollbackSnapshot: Uint8Array;\n  staged: NonNullable<Awaited<ReturnType<typeof stagePendingAttachments>>>;\n  state: DocumentStoreState;\n}) {\n  const { staged, state } = input;\n  try {\n    return await persistDocument(\n      state,\n      input.currentDoc,\n      { snapshotEndVersion: input.coveredVersion },\n      {\n        attachmentStaging: staged,\n        pendingUpdate:\n          createPendingUpdateFields(input.attachmentUpdate) ?? undefined,\n        preserveSnapshotStructuredFields: true,\n        preserveSnapshotText: true,\n      },\n      input.generation,\n    );\n  } catch (error) {\n    await deleteUnreferencedStagedAttachmentBytes({\n      generation: input.generation,\n      pendingAttachments: staged.pendingAttachments,\n      state,\n    });\n    await restoreFailedAttachmentMutation({\n      generation: input.generation,\n      rollbackSnapshot: input.rollbackSnapshot,\n      state,\n    });\n    throw error;\n  }\n}\n"]}

package/stores/documents/documentStore/attachmentPersistFollowup.js

@@ -0,0 +1,16 @@
+/**
+ * A same-identity conflict may still leave newer durable work for the current
+ * lane to submit. Identity replacement and local teardown deliberately do not
+ * schedule the losing document against the replacement generation.
+ */
+export function attachmentPersistNeedsFollowupSync(input) {
+    if (input.currentLocalWriteGeneration !== input.expectedLocalWriteGeneration ||
+        input.currentDocumentId !== input.expectedDocumentId) {
+        return false;
+    }
+    if (!input.persisted)
+        return true;
+    return (input.persisted.pullContinuationSuperseded === true &&
+        input.persisted.syncIdentitySuperseded !== true);
+}
+//# sourceMappingURL=attachmentPersistFollowup.js.map

package/stores/documents/documentStore/attachmentPersistFollowup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentPersistFollowup.js","sourceRoot":"","sources":["attachmentPersistFollowup.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAMlD;IACC,IACE,KAAK,CAAC,2BAA2B,KAAK,KAAK,CAAC,4BAA4B;QACxE,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,kBAAkB,EACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,CACL,KAAK,CAAC,SAAS,CAAC,0BAA0B,KAAK,IAAI;QACnD,KAAK,CAAC,SAAS,CAAC,sBAAsB,KAAK,IAAI,CAChD,CAAC;AACJ,CAAC","sourcesContent":["import type { PersistedDocumentRecord } from \"./state\";\n\n/**\n * A same-identity conflict may still leave newer durable work for the current\n * lane to submit. Identity replacement and local teardown deliberately do not\n * schedule the losing document against the replacement generation.\n */\nexport function attachmentPersistNeedsFollowupSync(input: {\n  currentDocumentId: string | null | undefined;\n  currentLocalWriteGeneration: number;\n  expectedDocumentId: string | null;\n  expectedLocalWriteGeneration: number;\n  persisted: PersistedDocumentRecord | null;\n}): boolean {\n  if (\n    input.currentLocalWriteGeneration !== input.expectedLocalWriteGeneration ||\n    input.currentDocumentId !== input.expectedDocumentId\n  ) {\n    return false;\n  }\n  if (!input.persisted) return true;\n  return (\n    input.persisted.pullContinuationSuperseded === true &&\n    input.persisted.syncIdentitySuperseded !== true\n  );\n}\n"]}

package/stores/documents/documentStore/attachmentPersistence.js

@@ -0,0 +1,106 @@
+import { deleteLocalDocumentAttachment, deletePendingDocumentAttachment, saveLocalDocumentAttachments, savePendingDocumentAttachment, } from "../../../workflows/documents/index.js";
+import { withLocalAttachmentDetachState } from "./attachmentDetachState.js";
+import { withGenerationGuardedMutation } from "./persistence.js";
+import { setReadySnapshot, } from "./state.js";
+import { isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent, } from "./syncGeneration.js";
+export async function deletePendingAttachment(state, slotId, storageKey, expectedGeneration) {
+    // After a REFUSED discard the reset store keeps its rows, and a stale pass
+    // racing that reset must not delete state the refusal deliberately
+    // preserved.
+    await withGenerationGuardedMutation(state, expectedGeneration, (execSql) => deletePendingDocumentAttachment({
+        execSql,
+        localId: state.localId,
+        persistence: state.persistence,
+        slotId,
+        storageKey,
+    }));
+}
+export async function deleteLocalAttachmentRecord(state, slotId, storageKey, currentDoc = state.doc) {
+    await deleteLocalDocumentAttachment({
+        execSql: state.runtime.infra.execSql,
+        localId: state.localId,
+        persistence: state.persistence,
+        slotId,
+        storageKey,
+    });
+    if (state.attachmentStorageKeyBySlotId[slotId] === storageKey) {
+        removeLocalAttachmentSlot(state, slotId);
+    }
+    if (currentDoc && currentDoc === state.doc) {
+        setReadySnapshot(state, currentDoc, state.snapshot.syncing, state.snapshot.text, state.snapshot.structuredFields);
+    }
+}
+export async function saveLocalAttachmentRecord(state, attachment, currentDoc = state.doc, expectedGeneration) {
+    await saveLocalAttachmentRecords(state, [attachment], currentDoc, expectedGeneration);
+}
+export async function saveLocalAttachmentRecords(state, attachments, currentDoc = state.doc, expectedGeneration) {
+    if (attachments.length === 0) {
+        return;
+    }
+    // These rows are upserts, and a stale writer racing a teardown must never
+    // re-insert what the teardown just removed.
+    const saved = await withGenerationGuardedMutation(state, expectedGeneration, (execSql) => saveLocalDocumentAttachments({
+        attachments: withLocalAttachmentDetachState(attachments, currentDoc),
+        execSql,
+        persistence: state.persistence,
+    }));
+    if (!saved ||
+        (expectedGeneration && !isSyncGenerationCurrent(state, expectedGeneration))) {
+        return;
+    }
+    installLocalAttachmentRecords(state, attachments, currentDoc);
+}
+/** Publish the held copy of each record's slot to the store's slot maps. */
+export function assignLocalAttachmentSlots(state, attachments) {
+    const entries = (pick) => Object.fromEntries(attachments.map((attachment) => [attachment.slotId, pick(attachment)]));
+    state.attachmentBlobIdBySlotId = {
+        ...state.attachmentBlobIdBySlotId,
+        ...entries((attachment) => attachment.blobId),
+    };
+    state.attachmentContentSha256BySlotId = {
+        ...state.attachmentContentSha256BySlotId,
+        ...entries((attachment) => attachment.contentSha256),
+    };
+    state.attachmentStorageKeyBySlotId = {
+        ...state.attachmentStorageKeyBySlotId,
+        ...entries((attachment) => attachment.storageKey),
+    };
+}
+/** Forget the held copy of one slot without touching its durable row. */
+export function removeLocalAttachmentSlot(state, slotId) {
+    const { [slotId]: _blobId, ...blobIds } = state.attachmentBlobIdBySlotId;
+    const { [slotId]: _contentSha256, ...contentSha256s } = state.attachmentContentSha256BySlotId;
+    const { [slotId]: _storageKey, ...storageKeys } = state.attachmentStorageKeyBySlotId;
+    state.attachmentBlobIdBySlotId = blobIds;
+    state.attachmentContentSha256BySlotId = contentSha256s;
+    state.attachmentStorageKeyBySlotId = storageKeys;
+}
+export function installLocalAttachmentRecords(state, attachments, currentDoc) {
+    assignLocalAttachmentSlots(state, attachments);
+    if (currentDoc && currentDoc === state.doc) {
+        setReadySnapshot(state, currentDoc, state.snapshot.syncing, state.snapshot.text, state.snapshot.structuredFields);
+    }
+}
+export function upsertPendingAttachments(state, nextPendingAttachments) {
+    const nextSlotIds = new Set(nextPendingAttachments.map((pendingAttachment) => pendingAttachment.slotId));
+    state.pendingAttachments = [
+        ...state.pendingAttachments.filter((pendingAttachment) => !nextSlotIds.has(pendingAttachment.slotId)),
+        ...nextPendingAttachments,
+    ];
+}
+/**
+ * Persist a pending attachment's upload-resume identity (blob id, content key,
+ * IV, and — once staged — the multipart stage id/part size) so a later attempt
+ * reuses it instead of orphaning the stage. The caller publishes the saved
+ * identity on the live pending record only after this write succeeds.
+ */
+export async function savePendingAttachmentUpload(state, pendingAttachment, expectedGeneration) {
+    // This row is an upsert, and a stale resume racing a teardown must never
+    // re-insert the pending row the teardown just removed.
+    await withGenerationGuardedMutation(state, expectedGeneration, (execSql) => savePendingDocumentAttachment({
+        attachment: pendingAttachment,
+        execSql,
+        persistence: state.persistence,
+    }));
+}
+//# sourceMappingURL=attachmentPersistence.js.map

package/stores/documents/documentStore/attachmentPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentPersistence.js","sourceRoot":"","sources":["attachmentPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAG/B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAGL,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,oCAAoC,IAAI,uBAAuB,GAChE,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAyB,EACzB,MAAc,EACd,UAAkB,EAClB,kBAAgD;IAEhD,2EAA2E;IAC3E,mEAAmE;IACnE,aAAa;IACb,MAAM,6BAA6B,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CACzE,+BAA+B,CAAC;QAC9B,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,UAAU;KACX,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAyB,EACzB,MAAc,EACd,UAAkB,EAClB,aAAmC,KAAK,CAAC,GAAG;IAE5C,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;QAC9D,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,UAAU,IAAI,UAAU,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3C,gBAAgB,CACd,KAAK,EACL,UAAU,EACV,KAAK,CAAC,QAAQ,CAAC,OAAO,EACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB,EACzB,UAAiC,EACjC,aAAmC,KAAK,CAAC,GAAG,EAC5C,kBAAgD;IAEhD,MAAM,0BAA0B,CAC9B,KAAK,EACL,CAAC,UAAU,CAAC,EACZ,UAAU,EACV,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAyB,EACzB,WAAiD,EACjD,aAAmC,KAAK,CAAC,GAAG,EAC5C,kBAAgD;IAEhD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAC/C,KAAK,EACL,kBAAkB,EAClB,CAAC,OAAO,EAAE,EAAE,CACV,4BAA4B,CAAC;QAC3B,WAAW,EAAE,8BAA8B,CAAC,WAAW,EAAE,UAAU,CAAC;QACpE,OAAO;QACP,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CACL,CAAC;IACF,IACE,CAAC,KAAK;QACN,CAAC,kBAAkB,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,EAC3E,CAAC;QACD,OAAO;IACT,CAAC;IAED,6BAA6B,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CACxC,KAAyB,EACzB,WAAiD;IAEjD,MAAM,OAAO,GAAG,CAAI,IAA8C,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CACvE,CAAC;IACJ,KAAK,CAAC,wBAAwB,GAAG;QAC/B,GAAG,KAAK,CAAC,wBAAwB;QACjC,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;KAC9C,CAAC;IACF,KAAK,CAAC,+BAA+B,GAAG;QACtC,GAAG,KAAK,CAAC,+BAA+B;QACxC,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;KACrD,CAAC;IACF,KAAK,CAAC,4BAA4B,GAAG;QACnC,GAAG,KAAK,CAAC,4BAA4B;QACrC,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,yBAAyB,CACvC,KAAyB,EACzB,MAAc;IAEd,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,wBAAwB,CAAC;IACzE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,GACnD,KAAK,CAAC,+BAA+B,CAAC;IACxC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAC7C,KAAK,CAAC,4BAA4B,CAAC;IACrC,KAAK,CAAC,wBAAwB,GAAG,OAAO,CAAC;IACzC,KAAK,CAAC,+BAA+B,GAAG,cAAc,CAAC;IACvD,KAAK,CAAC,4BAA4B,GAAG,WAAW,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAyB,EACzB,WAAiD,EACjD,UAAgC;IAEhC,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAE/C,IAAI,UAAU,IAAI,UAAU,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3C,gBAAgB,CACd,KAAK,EACL,UAAU,EACV,KAAK,CAAC,QAAQ,CAAC,OAAO,EACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,sBAA8D;IAE9D,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,sBAAsB,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAC5E,CAAC;IACF,KAAK,CAAC,kBAAkB,GAAG;QACzB,GAAG,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAChC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAClE;QACD,GAAG,sBAAsB;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAyB,EACzB,iBAA0C,EAC1C,kBAAgD;IAEhD,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,6BAA6B,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CACzE,6BAA6B,CAAC;QAC5B,UAAU,EAAE,iBAAiB;QAC7B,OAAO;QACP,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  deleteLocalDocumentAttachment,\n  deletePendingDocumentAttachment,\n  type LocalAttachmentRecord,\n  type PendingAttachmentRecord,\n  saveLocalDocumentAttachments,\n  savePendingDocumentAttachment,\n} from \"../../../workflows/documents\";\nimport { withLocalAttachmentDetachState } from \"./attachmentDetachState\";\nimport { withGenerationGuardedMutation } from \"./persistence\";\nimport {\n  type DocumentState,\n  type DocumentStoreState,\n  setReadySnapshot,\n} from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\nexport async function deletePendingAttachment(\n  state: DocumentStoreState,\n  slotId: string,\n  storageKey: string,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  // After a REFUSED discard the reset store keeps its rows, and a stale pass\n  // racing that reset must not delete state the refusal deliberately\n  // preserved.\n  await withGenerationGuardedMutation(state, expectedGeneration, (execSql) =>\n    deletePendingDocumentAttachment({\n      execSql,\n      localId: state.localId,\n      persistence: state.persistence,\n      slotId,\n      storageKey,\n    }),\n  );\n}\n\nexport async function deleteLocalAttachmentRecord(\n  state: DocumentStoreState,\n  slotId: string,\n  storageKey: string,\n  currentDoc: DocumentState | null = state.doc,\n) {\n  await deleteLocalDocumentAttachment({\n    execSql: state.runtime.infra.execSql,\n    localId: state.localId,\n    persistence: state.persistence,\n    slotId,\n    storageKey,\n  });\n\n  if (state.attachmentStorageKeyBySlotId[slotId] === storageKey) {\n    removeLocalAttachmentSlot(state, slotId);\n  }\n\n  if (currentDoc && currentDoc === state.doc) {\n    setReadySnapshot(\n      state,\n      currentDoc,\n      state.snapshot.syncing,\n      state.snapshot.text,\n      state.snapshot.structuredFields,\n    );\n  }\n}\n\nexport async function saveLocalAttachmentRecord(\n  state: DocumentStoreState,\n  attachment: LocalAttachmentRecord,\n  currentDoc: DocumentState | null = state.doc,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  await saveLocalAttachmentRecords(\n    state,\n    [attachment],\n    currentDoc,\n    expectedGeneration,\n  );\n}\n\nexport async function saveLocalAttachmentRecords(\n  state: DocumentStoreState,\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n  currentDoc: DocumentState | null = state.doc,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  if (attachments.length === 0) {\n    return;\n  }\n\n  // These rows are upserts, and a stale writer racing a teardown must never\n  // re-insert what the teardown just removed.\n  const saved = await withGenerationGuardedMutation(\n    state,\n    expectedGeneration,\n    (execSql) =>\n      saveLocalDocumentAttachments({\n        attachments: withLocalAttachmentDetachState(attachments, currentDoc),\n        execSql,\n        persistence: state.persistence,\n      }),\n  );\n  if (\n    !saved ||\n    (expectedGeneration && !isSyncGenerationCurrent(state, expectedGeneration))\n  ) {\n    return;\n  }\n\n  installLocalAttachmentRecords(state, attachments, currentDoc);\n}\n\n/** Publish the held copy of each record's slot to the store's slot maps. */\nexport function assignLocalAttachmentSlots(\n  state: DocumentStoreState,\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n): void {\n  const entries = <T>(pick: (attachment: LocalAttachmentRecord) => T) =>\n    Object.fromEntries(\n      attachments.map((attachment) => [attachment.slotId, pick(attachment)]),\n    );\n  state.attachmentBlobIdBySlotId = {\n    ...state.attachmentBlobIdBySlotId,\n    ...entries((attachment) => attachment.blobId),\n  };\n  state.attachmentContentSha256BySlotId = {\n    ...state.attachmentContentSha256BySlotId,\n    ...entries((attachment) => attachment.contentSha256),\n  };\n  state.attachmentStorageKeyBySlotId = {\n    ...state.attachmentStorageKeyBySlotId,\n    ...entries((attachment) => attachment.storageKey),\n  };\n}\n\n/** Forget the held copy of one slot without touching its durable row. */\nexport function removeLocalAttachmentSlot(\n  state: DocumentStoreState,\n  slotId: string,\n): void {\n  const { [slotId]: _blobId, ...blobIds } = state.attachmentBlobIdBySlotId;\n  const { [slotId]: _contentSha256, ...contentSha256s } =\n    state.attachmentContentSha256BySlotId;\n  const { [slotId]: _storageKey, ...storageKeys } =\n    state.attachmentStorageKeyBySlotId;\n  state.attachmentBlobIdBySlotId = blobIds;\n  state.attachmentContentSha256BySlotId = contentSha256s;\n  state.attachmentStorageKeyBySlotId = storageKeys;\n}\n\nexport function installLocalAttachmentRecords(\n  state: DocumentStoreState,\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n  currentDoc: DocumentState | null,\n) {\n  assignLocalAttachmentSlots(state, attachments);\n\n  if (currentDoc && currentDoc === state.doc) {\n    setReadySnapshot(\n      state,\n      currentDoc,\n      state.snapshot.syncing,\n      state.snapshot.text,\n      state.snapshot.structuredFields,\n    );\n  }\n}\n\nexport function upsertPendingAttachments(\n  state: DocumentStoreState,\n  nextPendingAttachments: ReadonlyArray<PendingAttachmentRecord>,\n) {\n  const nextSlotIds = new Set(\n    nextPendingAttachments.map((pendingAttachment) => pendingAttachment.slotId),\n  );\n  state.pendingAttachments = [\n    ...state.pendingAttachments.filter(\n      (pendingAttachment) => !nextSlotIds.has(pendingAttachment.slotId),\n    ),\n    ...nextPendingAttachments,\n  ];\n}\n\n/**\n * Persist a pending attachment's upload-resume identity (blob id, content key,\n * IV, and — once staged — the multipart stage id/part size) so a later attempt\n * reuses it instead of orphaning the stage. The caller publishes the saved\n * identity on the live pending record only after this write succeeds.\n */\nexport async function savePendingAttachmentUpload(\n  state: DocumentStoreState,\n  pendingAttachment: PendingAttachmentRecord,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n): Promise<void> {\n  // This row is an upsert, and a stale resume racing a teardown must never\n  // re-insert the pending row the teardown just removed.\n  await withGenerationGuardedMutation(state, expectedGeneration, (execSql) =>\n    savePendingDocumentAttachment({\n      attachment: pendingAttachment,\n      execSql,\n      persistence: state.persistence,\n    }),\n  );\n}\n"]}

package/stores/documents/documentStore/attachmentSnapshot.js

@@ -0,0 +1,33 @@
+export function getAttachmentStorageKeys(storageKeyBySlotId, attachments) {
+    const nextStorageKeys = {};
+    for (const attachment of attachments) {
+        const storageKey = storageKeyBySlotId[attachment.slotId];
+        if (storageKey) {
+            nextStorageKeys[attachment.slotId] = storageKey;
+        }
+    }
+    return nextStorageKeys;
+}
+/**
+ * A slot is `syncing` while its upload is queued. Otherwise it is
+ * `intent-mismatch` when the held bytes' digest differs from the digest the
+ * document content records: a validly signed served binding the document has
+ * not (yet) recorded. The status clears by itself once the content update
+ * carrying the digest arrives or a matching binding is hydrated.
+ */
+export function getAttachmentStatuses(input) {
+    const nextStatuses = {};
+    for (const attachment of input.attachments) {
+        if (input.pendingSlotIds.has(attachment.slotId)) {
+            nextStatuses[attachment.slotId] = "syncing";
+            continue;
+        }
+        const heldContentSha256 = input.contentSha256BySlotId[attachment.slotId];
+        if (heldContentSha256 !== undefined &&
+            heldContentSha256 !== attachment.contentSha256) {
+            nextStatuses[attachment.slotId] = "intent-mismatch";
+        }
+    }
+    return nextStatuses;
+}
+//# sourceMappingURL=attachmentSnapshot.js.map

package/stores/documents/documentStore/attachmentSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentSnapshot.js","sourceRoot":"","sources":["attachmentSnapshot.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,wBAAwB,CACtC,kBAAoD,EACpD,WAA8C;IAE9C,MAAM,eAAe,GAA2B,EAAE,CAAC;IAEnD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YACf,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,MAAM,YAAY,GAA6C,EAAE,CAAC;IAElE,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzE,IACE,iBAAiB,KAAK,SAAS;YAC/B,iBAAiB,KAAK,UAAU,CAAC,aAAa,EAC9C,CAAC;YACD,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,iBAAiB,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import type { DocumentAttachment } from \"../../../data/documents/documentContent\";\nimport type { DocumentAttachmentStatus } from \"../types\";\n\nexport function getAttachmentStorageKeys(\n  storageKeyBySlotId: Readonly<Record<string, string>>,\n  attachments: ReadonlyArray<DocumentAttachment>,\n): Record<string, string> {\n  const nextStorageKeys: Record<string, string> = {};\n\n  for (const attachment of attachments) {\n    const storageKey = storageKeyBySlotId[attachment.slotId];\n    if (storageKey) {\n      nextStorageKeys[attachment.slotId] = storageKey;\n    }\n  }\n\n  return nextStorageKeys;\n}\n\n/**\n * A slot is `syncing` while its upload is queued. Otherwise it is\n * `intent-mismatch` when the held bytes' digest differs from the digest the\n * document content records: a validly signed served binding the document has\n * not (yet) recorded. The status clears by itself once the content update\n * carrying the digest arrives or a matching binding is hydrated.\n */\nexport function getAttachmentStatuses(input: {\n  attachments: ReadonlyArray<DocumentAttachment>;\n  contentSha256BySlotId: Readonly<Record<string, string>>;\n  pendingSlotIds: ReadonlySet<string>;\n}): Record<string, DocumentAttachmentStatus> {\n  const nextStatuses: Record<string, DocumentAttachmentStatus> = {};\n\n  for (const attachment of input.attachments) {\n    if (input.pendingSlotIds.has(attachment.slotId)) {\n      nextStatuses[attachment.slotId] = \"syncing\";\n      continue;\n    }\n    const heldContentSha256 = input.contentSha256BySlotId[attachment.slotId];\n    if (\n      heldContentSha256 !== undefined &&\n      heldContentSha256 !== attachment.contentSha256\n    ) {\n      nextStatuses[attachment.slotId] = \"intent-mismatch\";\n    }\n  }\n\n  return nextStatuses;\n}\n"]}

package/stores/documents/documentStore/attachmentSourceUpload.js

@@ -0,0 +1,39 @@
+import { inspectBlobSource, } from "../../../data/documents/blob/shared/blobSourceSnapshot.js";
+import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from "../../../data/documents/blob/shared/crypto.js";
+import { getDocumentAttachments } from "../../../data/documents/documentContent.js";
+import { deletePendingAttachment } from "./attachmentPersistence.js";
+import { resolveAttachmentUploadResume, } from "./attachmentUploadResume.js";
+export function pendingAttachmentMatchesIntent(input) {
+    return (input.state.doc !== null &&
+        getDocumentAttachments(input.state.doc).some((item) => item.slotId === input.pendingAttachment.slotId &&
+            item.contentSha256 === input.pendingAttachment.contentSha256));
+}
+export async function dropUnavailablePendingAttachment(input) {
+    const { state, pendingAttachment, attachmentGeneration } = input;
+    // Unusable bytes or superseded intent cannot be retried. Delete only this
+    // storage identity so a concurrently queued replacement survives.
+    state.runtime.util.log(`Documents: dropping pending attachment ${pendingAttachment.slotId}; its bytes are unavailable or changed, or its content intent was superseded.`);
+    await deletePendingAttachment(state, pendingAttachment.slotId, pendingAttachment.storageKey, attachmentGeneration);
+    return "dropped";
+}
+export async function resolveAttachmentSourceUpload(input) {
+    let chunkSize = input.pendingAttachment.upload?.partSize ?? DEFAULT_BLOB_CHUNK_SIZE_BYTES;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const snapshot = await inspectBlobSource(input.source, chunkSize);
+        if (!pendingAttachmentMatchesIntent(input))
+            return null;
+        if (input.pendingAttachment.contentSha256 !== snapshot.sha256) {
+            return null;
+        }
+        const resume = await resolveAttachmentUploadResume(input.state, input.pendingAttachment, snapshot.sha256, input.attachmentGeneration);
+        const resolvedChunkSize = resume.multipart?.partSize ?? DEFAULT_BLOB_CHUNK_SIZE_BYTES;
+        if (!pendingAttachmentMatchesIntent(input))
+            return null;
+        if (resolvedChunkSize === snapshot.chunkSize) {
+            return { resume, snapshot };
+        }
+        chunkSize = resolvedChunkSize;
+    }
+    throw new Error("Blob source changed while preparing its upload identity");
+}
+//# sourceMappingURL=attachmentSourceUpload.js.map

package/stores/documents/documentStore/attachmentSourceUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentSourceUpload.js","sourceRoot":"","sources":["attachmentSourceUpload.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,wDAAwD,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAEL,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAUlC,MAAM,UAAU,8BAA8B,CAC5C,KAAyB;IAEzB,OAAO,CACL,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;QACxB,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,iBAAiB,CAAC,MAAM;YAC9C,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAC/D,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAyB;IAEzB,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IACjE,0EAA0E;IAC1E,kEAAkE;IAClE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,0CAA0C,iBAAiB,CAAC,MAAM,+EAA+E,CAClJ,CAAC;IACF,MAAM,uBAAuB,CAC3B,KAAK,EACL,iBAAiB,CAAC,MAAM,EACxB,iBAAiB,CAAC,UAAU,EAC5B,oBAAoB,CACrB,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAEC;IAKD,IAAI,SAAS,GACX,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,IAAI,6BAA6B,CAAC;IAE5E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,MAAM,EACf,KAAK,CAAC,oBAAoB,CAC3B,CAAC;QACF,MAAM,iBAAiB,GACrB,MAAM,CAAC,SAAS,EAAE,QAAQ,IAAI,6BAA6B,CAAC;QAC9D,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,iBAAiB,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,SAAS,GAAG,iBAAiB,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import type { BlobByteSource } from \"../../../data/blobContracts\";\nimport {\n  type BlobSourceSnapshot,\n  inspectBlobSource,\n} from \"../../../data/documents/blob/shared/blobSourceSnapshot\";\nimport { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from \"../../../data/documents/blob/shared/crypto\";\nimport { getDocumentAttachments } from \"../../../data/documents/documentContent\";\nimport type { PendingAttachmentRecord } from \"../../../workflows/documents\";\nimport { deletePendingAttachment } from \"./attachmentPersistence\";\nimport {\n  type AttachmentUploadResume,\n  resolveAttachmentUploadResume,\n} from \"./attachmentUploadResume\";\nimport type { DocumentStoreState } from \"./state\";\nimport type { DocumentStoreSyncGeneration } from \"./syncGeneration\";\n\ninterface PendingSourceInput {\n  attachmentGeneration: DocumentStoreSyncGeneration;\n  pendingAttachment: PendingAttachmentRecord;\n  state: DocumentStoreState;\n}\n\nexport function pendingAttachmentMatchesIntent(\n  input: PendingSourceInput,\n): boolean {\n  return (\n    input.state.doc !== null &&\n    getDocumentAttachments(input.state.doc).some(\n      (item) =>\n        item.slotId === input.pendingAttachment.slotId &&\n        item.contentSha256 === input.pendingAttachment.contentSha256,\n    )\n  );\n}\n\nexport async function dropUnavailablePendingAttachment(\n  input: PendingSourceInput,\n): Promise<\"dropped\"> {\n  const { state, pendingAttachment, attachmentGeneration } = input;\n  // Unusable bytes or superseded intent cannot be retried. Delete only this\n  // storage identity so a concurrently queued replacement survives.\n  state.runtime.util.log(\n    `Documents: dropping pending attachment ${pendingAttachment.slotId}; its bytes are unavailable or changed, or its content intent was superseded.`,\n  );\n  await deletePendingAttachment(\n    state,\n    pendingAttachment.slotId,\n    pendingAttachment.storageKey,\n    attachmentGeneration,\n  );\n  return \"dropped\";\n}\n\nexport async function resolveAttachmentSourceUpload(\n  input: PendingSourceInput & {\n    source: BlobByteSource;\n  },\n): Promise<{\n  readonly resume: AttachmentUploadResume;\n  readonly snapshot: BlobSourceSnapshot;\n} | null> {\n  let chunkSize =\n    input.pendingAttachment.upload?.partSize ?? DEFAULT_BLOB_CHUNK_SIZE_BYTES;\n\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    const snapshot = await inspectBlobSource(input.source, chunkSize);\n    if (!pendingAttachmentMatchesIntent(input)) return null;\n    if (input.pendingAttachment.contentSha256 !== snapshot.sha256) {\n      return null;\n    }\n    const resume = await resolveAttachmentUploadResume(\n      input.state,\n      input.pendingAttachment,\n      snapshot.sha256,\n      input.attachmentGeneration,\n    );\n    const resolvedChunkSize =\n      resume.multipart?.partSize ?? DEFAULT_BLOB_CHUNK_SIZE_BYTES;\n    if (!pendingAttachmentMatchesIntent(input)) return null;\n    if (resolvedChunkSize === snapshot.chunkSize) {\n      return { resume, snapshot };\n    }\n    chunkSize = resolvedChunkSize;\n  }\n\n  throw new Error(\"Blob source changed while preparing its upload identity\");\n}\n"]}

package/stores/documents/documentStore/attachmentStaging.js

@@ -0,0 +1,73 @@
+import { createBlobByteSource } from "../../../data/blobContracts.js";
+import { assignLocalAttachmentSlots, upsertPendingAttachments, } from "./attachmentPersistence.js";
+import { setReadySnapshot } from "./state.js";
+import { isDocumentStoreSyncGenerationCurrent, } from "./syncGeneration.js";
+function localAttachmentRecords(localId, pendingAttachments) {
+    return pendingAttachments.map((pendingAttachment) => ({
+        blobId: null,
+        byteLength: pendingAttachment.byteLength,
+        contentSha256: pendingAttachment.contentSha256,
+        detachedAt: null,
+        localId,
+        mimeType: pendingAttachment.mimeType,
+        slotId: pendingAttachment.slotId,
+        storageKey: pendingAttachment.storageKey,
+    }));
+}
+async function deleteStagedAttachmentBytes(input) {
+    const { state } = input;
+    const cleanupResults = await Promise.allSettled(input.pendingAttachments.map((attachment) => state.runtime.infra.blobStore.deleteBytes(attachment.storageKey)));
+    const failedCleanupCount = cleanupResults.filter((result) => result.status === "rejected").length;
+    if (failedCleanupCount > 0) {
+        state.runtime.util.log(`Documents: failed to roll back ${failedCleanupCount} staged attachment operation${failedCleanupCount === 1 ? "" : "s"}.`);
+    }
+}
+export async function deleteUnreferencedStagedAttachmentBytes(input) {
+    let durableStorageKeys;
+    try {
+        const durableAttachments = await input.state.persistence.listLocalAttachments(input.generation.execSql, input.state.localId);
+        durableStorageKeys = new Set(durableAttachments.map(({ storageKey }) => storageKey));
+    }
+    catch {
+        // A failed probe cannot prove that the atomic mutation rolled back. Keep
+        // the bytes: orphan maintenance can reclaim them once storage is readable.
+        return;
+    }
+    await deleteStagedAttachmentBytes({
+        pendingAttachments: input.pendingAttachments.filter(({ storageKey }) => !durableStorageKeys.has(storageKey)),
+        state: input.state,
+    });
+}
+async function writePendingAttachmentBytes(input) {
+    for (const [index, pendingAttachment] of input.pendingAttachments.entries()) {
+        const sourceFile = input.files[index];
+        if (!sourceFile)
+            continue;
+        await input.state.runtime.infra.blobStore.writeByteSource(pendingAttachment.storageKey, createBlobByteSource(sourceFile.bytes));
+    }
+}
+export function installPendingAttachmentRows(input) {
+    const { localAttachments, pendingAttachments, state } = input;
+    assignLocalAttachmentSlots(state, localAttachments);
+    upsertPendingAttachments(state, pendingAttachments);
+    if (state.doc) {
+        setReadySnapshot(state, state.doc, state.snapshot.syncing, state.snapshot.text, state.snapshot.structuredFields);
+    }
+}
+export async function stagePendingAttachments(input) {
+    const { pendingAttachments, state } = input;
+    const localAttachments = localAttachmentRecords(state.localId, pendingAttachments);
+    try {
+        await writePendingAttachmentBytes(input);
+        if (!isDocumentStoreSyncGenerationCurrent(state, input.generation)) {
+            await deleteStagedAttachmentBytes({ pendingAttachments, state });
+            return null;
+        }
+        return { localAttachments, pendingAttachments };
+    }
+    catch (error) {
+        await deleteStagedAttachmentBytes({ pendingAttachments, state });
+        throw error;
+    }
+}
+//# sourceMappingURL=attachmentStaging.js.map

package/stores/documents/documentStore/attachmentStaging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentStaging.js","sourceRoot":"","sources":["attachmentStaging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOnE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA2B,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAS1B,SAAS,sBAAsB,CAC7B,OAAe,EACf,kBAA0D;IAE1D,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,iBAAiB,CAAC,UAAU;QACxC,aAAa,EAAE,iBAAiB,CAAC,aAAa;QAC9C,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,UAAU,EAAE,iBAAiB,CAAC,UAAU;KACzC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,UAAU,CAC7C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CACjE,CACF,CAAC;IACF,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAC9C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CACzC,CAAC,MAAM,CAAC;IACT,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kCAAkC,kBAAkB,+BAA+B,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,IAAI,kBAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,kBAAkB,GACtB,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,oBAAoB,CAChD,KAAK,CAAC,UAAU,CAAC,OAAO,EACxB,KAAK,CAAC,KAAK,CAAC,OAAO,CACpB,CAAC;QACJ,kBAAkB,GAAG,IAAI,GAAG,CAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CACvD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CACjD,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CACxD;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAmC;IAEnC,KAAK,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CACvD,iBAAiB,CAAC,UAAU,EAC5B,oBAAoB,CAAC,UAAU,CAAC,KAAK,CAAC,CACvC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9D,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,gBAAgB,CACd,KAAK,EACL,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,QAAQ,CAAC,OAAO,EACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,gBAAgB,GAAG,sBAAsB,CAC7C,KAAK,CAAC,OAAO,EACb,kBAAkB,CACnB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,MAAM,2BAA2B,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,2BAA2B,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { createBlobByteSource } from \"../../../data/blobContracts\";\nimport type {\n  AttachmentStagingRows,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n} from \"../../../workflows/documents\";\nimport type { DocumentAttachmentUpload } from \"../types\";\nimport {\n  assignLocalAttachmentSlots,\n  upsertPendingAttachments,\n} from \"./attachmentPersistence\";\nimport { type DocumentStoreState, setReadySnapshot } from \"./state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\n\ninterface StagePendingAttachmentsInput {\n  files: ReadonlyArray<DocumentAttachmentUpload>;\n  generation: DocumentStoreSyncGeneration;\n  pendingAttachments: PendingAttachmentRecord[];\n  state: DocumentStoreState;\n}\n\nfunction localAttachmentRecords(\n  localId: string,\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>,\n): LocalAttachmentRecord[] {\n  return pendingAttachments.map((pendingAttachment) => ({\n    blobId: null,\n    byteLength: pendingAttachment.byteLength,\n    contentSha256: pendingAttachment.contentSha256,\n    detachedAt: null,\n    localId,\n    mimeType: pendingAttachment.mimeType,\n    slotId: pendingAttachment.slotId,\n    storageKey: pendingAttachment.storageKey,\n  }));\n}\n\nasync function deleteStagedAttachmentBytes(input: {\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>;\n  state: DocumentStoreState;\n}) {\n  const { state } = input;\n  const cleanupResults = await Promise.allSettled(\n    input.pendingAttachments.map((attachment) =>\n      state.runtime.infra.blobStore.deleteBytes(attachment.storageKey),\n    ),\n  );\n  const failedCleanupCount = cleanupResults.filter(\n    (result) => result.status === \"rejected\",\n  ).length;\n  if (failedCleanupCount > 0) {\n    state.runtime.util.log(\n      `Documents: failed to roll back ${failedCleanupCount} staged attachment operation${failedCleanupCount === 1 ? \"\" : \"s\"}.`,\n    );\n  }\n}\n\nexport async function deleteUnreferencedStagedAttachmentBytes(input: {\n  generation: DocumentStoreSyncGeneration;\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>;\n  state: DocumentStoreState;\n}): Promise<void> {\n  let durableStorageKeys: Set<string>;\n  try {\n    const durableAttachments =\n      await input.state.persistence.listLocalAttachments(\n        input.generation.execSql,\n        input.state.localId,\n      );\n    durableStorageKeys = new Set(\n      durableAttachments.map(({ storageKey }) => storageKey),\n    );\n  } catch {\n    // A failed probe cannot prove that the atomic mutation rolled back. Keep\n    // the bytes: orphan maintenance can reclaim them once storage is readable.\n    return;\n  }\n  await deleteStagedAttachmentBytes({\n    pendingAttachments: input.pendingAttachments.filter(\n      ({ storageKey }) => !durableStorageKeys.has(storageKey),\n    ),\n    state: input.state,\n  });\n}\n\nasync function writePendingAttachmentBytes(\n  input: StagePendingAttachmentsInput,\n): Promise<void> {\n  for (const [index, pendingAttachment] of input.pendingAttachments.entries()) {\n    const sourceFile = input.files[index];\n    if (!sourceFile) continue;\n    await input.state.runtime.infra.blobStore.writeByteSource(\n      pendingAttachment.storageKey,\n      createBlobByteSource(sourceFile.bytes),\n    );\n  }\n}\n\nexport function installPendingAttachmentRows(input: {\n  localAttachments: ReadonlyArray<LocalAttachmentRecord>;\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>;\n  state: DocumentStoreState;\n}): void {\n  const { localAttachments, pendingAttachments, state } = input;\n  assignLocalAttachmentSlots(state, localAttachments);\n  upsertPendingAttachments(state, pendingAttachments);\n  if (state.doc) {\n    setReadySnapshot(\n      state,\n      state.doc,\n      state.snapshot.syncing,\n      state.snapshot.text,\n      state.snapshot.structuredFields,\n    );\n  }\n}\n\nexport async function stagePendingAttachments(\n  input: StagePendingAttachmentsInput,\n): Promise<AttachmentStagingRows | null> {\n  const { pendingAttachments, state } = input;\n  const localAttachments = localAttachmentRecords(\n    state.localId,\n    pendingAttachments,\n  );\n\n  try {\n    await writePendingAttachmentBytes(input);\n\n    if (!isDocumentStoreSyncGenerationCurrent(state, input.generation)) {\n      await deleteStagedAttachmentBytes({ pendingAttachments, state });\n      return null;\n    }\n    return { localAttachments, pendingAttachments };\n  } catch (error) {\n    await deleteStagedAttachmentBytes({ pendingAttachments, state });\n    throw error;\n  }\n}\n"]}

package/stores/documents/documentStore/attachmentUploadAttempt.js

@@ -0,0 +1,97 @@
+import { reportAndRethrowKeyingVerificationError } from "../../../data/keyingProjectionVerification/error.js";
+import { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from "../../../workflows/blobs/upload.js";
+export async function uploadAttachmentWithWriterProjectionRetry(input) {
+    let remoteSyncBlocked = false;
+    let checkedOrganizationId;
+    let resolvedMultipartStage;
+    const onStageResolved = async (stage) => {
+        resolvedMultipartStage = stage;
+        await input.baseUploadInput.onStageResolved?.(stage);
+    };
+    const baseUploadInput = {
+        ...input.baseUploadInput,
+        isRemoteSyncBlocked: (organizationId) => {
+            checkedOrganizationId = organizationId;
+            remoteSyncBlocked =
+                input.state.runtime.util.isRemoteSyncBlocked?.(organizationId) ?? false;
+            return remoteSyncBlocked;
+        },
+        onStageResolved,
+    };
+    let uploadError;
+    let uploadThrew = false;
+    let uploaded = await tryUploadDocumentAttachment({
+        documentId: input.state.record?.documentId ?? input.state.localId,
+        input: {
+            ...baseUploadInput,
+            writerProjection: input.writerProjection ?? undefined,
+        },
+        onError: (error) => {
+            uploadThrew = true;
+            uploadError = error;
+        },
+        reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,
+    });
+    if (!uploaded && checkedOrganizationId !== undefined) {
+        // The request itself may have produced the first 402 after the workflow's
+        // preflight check. Re-read the same verified manifest org so that response
+        // is treated as a billing pause even when there was no cached projection
+        // available to trigger the retry path below.
+        remoteSyncBlocked ||=
+            input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??
+                false;
+    }
+    if (!uploaded &&
+        input.writerProjection &&
+        !remoteSyncBlocked &&
+        !uploadThrew) {
+        // A stale cached writer projection may have caused an ambiguous null. Retry
+        // once with a fresh projection, but do not immediately replay a concrete
+        // thrown failure or an expected billing pause.
+        input.state.writerProjection = null;
+        // Binding can return null after multipart staging succeeded. Carry that
+        // resolved stage into the retry so it is resumed instead of orphaned.
+        const retryUploadInput = resolvedMultipartStage
+            ? {
+                ...baseUploadInput,
+                multipart: {
+                    ...(baseUploadInput.multipart ?? {}),
+                    partSize: resolvedMultipartStage.partSize,
+                    resumeStageId: resolvedMultipartStage.stageId,
+                },
+            }
+            : baseUploadInput;
+        uploaded = await tryUploadDocumentAttachment({
+            documentId: input.state.record?.documentId ?? input.state.localId,
+            input: retryUploadInput,
+            onError: (error) => {
+                uploadError = error;
+            },
+            reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,
+        });
+        if (!uploaded && checkedOrganizationId !== undefined) {
+            remoteSyncBlocked ||=
+                input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??
+                    false;
+        }
+    }
+    if (remoteSyncBlocked) {
+        uploadError = undefined;
+    }
+    return { error: uploadError, remoteSyncBlocked, uploaded };
+}
+async function tryUploadDocumentAttachment(input) {
+    try {
+        return await uploadDocumentAttachment(input.input);
+    }
+    catch (error) {
+        await reportAndRethrowKeyingVerificationError(error, input.reportSecurityIncident, {
+            objectId: input.documentId,
+            objectKind: "document",
+            operation: "document.attachment.upload",
+        });
+        input.onError(error);
+        return null;
+    }
+}
+//# sourceMappingURL=attachmentUploadAttempt.js.map

package/stores/documents/documentStore/attachmentUploadAttempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentUploadAttempt.js","sourceRoot":"","sources":["attachmentUploadAttempt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,gCAAgC,IAAI,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAG/G,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAI/D;IAKC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,qBAAyC,CAAC;IAC9C,IAAI,sBAES,CAAC;IACd,MAAM,eAAe,GAAG,KAAK,EAAE,KAG9B,EAAE,EAAE;QACH,sBAAsB,GAAG,KAAK,CAAC;QAC/B,MAAM,KAAK,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,eAAe;QACxB,mBAAmB,EAAE,CAAC,cAAsB,EAAE,EAAE;YAC9C,qBAAqB,GAAG,cAAc,CAAC;YACvC,iBAAiB;gBACf,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YAC1E,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,eAAe;KAChB,CAAC;IACF,IAAI,WAAoB,CAAC;IACzB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QAC/C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO;QACjE,KAAK,EAAE;YACL,GAAG,eAAe;YAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;SACtD;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QACD,sBAAsB,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;KACxE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACrD,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6CAA6C;QAC7C,iBAAiB;YACf,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;gBACrE,KAAK,CAAC;IACV,CAAC;IACD,IACE,CAAC,QAAQ;QACT,KAAK,CAAC,gBAAgB;QACtB,CAAC,iBAAiB;QAClB,CAAC,WAAW,EACZ,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,+CAA+C;QAC/C,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;QACpC,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,gBAAgB,GAAG,sBAAsB;YAC7C,CAAC,CAAC;gBACE,GAAG,eAAe;gBAClB,SAAS,EAAE;oBACT,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC;oBACpC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;oBACzC,aAAa,EAAE,sBAAsB,CAAC,OAAO;iBAC9C;aACF;YACH,CAAC,CAAC,eAAe,CAAC;QACpB,QAAQ,GAAG,MAAM,2BAA2B,CAAC;YAC3C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO;YACjE,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,sBAAsB,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACrD,iBAAiB;gBACf,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;oBACrE,KAAK,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;YACE,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,4BAA4B;SACxC,CACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../../data/keyingProjectionVerification/error\";\nimport { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from \"../../../workflows/blobs/upload\";\nimport type { DocumentStoreState } from \"./state\";\n\nexport async function uploadAttachmentWithWriterProjectionRetry(input: {\n  baseUploadInput: Parameters<typeof uploadDocumentAttachment>[0];\n  state: DocumentStoreState;\n  writerProjection: DocumentStoreState[\"writerProjection\"];\n}): Promise<{\n  error: unknown;\n  remoteSyncBlocked: boolean;\n  uploaded: Awaited<ReturnType<typeof uploadDocumentAttachment>>;\n}> {\n  let remoteSyncBlocked = false;\n  let checkedOrganizationId: string | undefined;\n  let resolvedMultipartStage:\n    | { readonly partSize: number; readonly stageId: string }\n    | undefined;\n  const onStageResolved = async (stage: {\n    readonly partSize: number;\n    readonly stageId: string;\n  }) => {\n    resolvedMultipartStage = stage;\n    await input.baseUploadInput.onStageResolved?.(stage);\n  };\n  const baseUploadInput = {\n    ...input.baseUploadInput,\n    isRemoteSyncBlocked: (organizationId: string) => {\n      checkedOrganizationId = organizationId;\n      remoteSyncBlocked =\n        input.state.runtime.util.isRemoteSyncBlocked?.(organizationId) ?? false;\n      return remoteSyncBlocked;\n    },\n    onStageResolved,\n  };\n  let uploadError: unknown;\n  let uploadThrew = false;\n  let uploaded = await tryUploadDocumentAttachment({\n    documentId: input.state.record?.documentId ?? input.state.localId,\n    input: {\n      ...baseUploadInput,\n      writerProjection: input.writerProjection ?? undefined,\n    },\n    onError: (error) => {\n      uploadThrew = true;\n      uploadError = error;\n    },\n    reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,\n  });\n  if (!uploaded && checkedOrganizationId !== undefined) {\n    // The request itself may have produced the first 402 after the workflow's\n    // preflight check. Re-read the same verified manifest org so that response\n    // is treated as a billing pause even when there was no cached projection\n    // available to trigger the retry path below.\n    remoteSyncBlocked ||=\n      input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??\n      false;\n  }\n  if (\n    !uploaded &&\n    input.writerProjection &&\n    !remoteSyncBlocked &&\n    !uploadThrew\n  ) {\n    // A stale cached writer projection may have caused an ambiguous null. Retry\n    // once with a fresh projection, but do not immediately replay a concrete\n    // thrown failure or an expected billing pause.\n    input.state.writerProjection = null;\n    // Binding can return null after multipart staging succeeded. Carry that\n    // resolved stage into the retry so it is resumed instead of orphaned.\n    const retryUploadInput = resolvedMultipartStage\n      ? {\n          ...baseUploadInput,\n          multipart: {\n            ...(baseUploadInput.multipart ?? {}),\n            partSize: resolvedMultipartStage.partSize,\n            resumeStageId: resolvedMultipartStage.stageId,\n          },\n        }\n      : baseUploadInput;\n    uploaded = await tryUploadDocumentAttachment({\n      documentId: input.state.record?.documentId ?? input.state.localId,\n      input: retryUploadInput,\n      onError: (error) => {\n        uploadError = error;\n      },\n      reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,\n    });\n    if (!uploaded && checkedOrganizationId !== undefined) {\n      remoteSyncBlocked ||=\n        input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??\n        false;\n    }\n  }\n\n  if (remoteSyncBlocked) {\n    uploadError = undefined;\n  }\n  return { error: uploadError, remoteSyncBlocked, uploaded };\n}\n\nasync function tryUploadDocumentAttachment(input: {\n  documentId: string;\n  input: Parameters<typeof uploadDocumentAttachment>[0];\n  onError: (error: unknown) => void;\n  reportSecurityIncident: DocumentStoreState[\"runtime\"][\"util\"][\"reportSecurityIncident\"];\n}): ReturnType<typeof uploadDocumentAttachment> {\n  try {\n    return await uploadDocumentAttachment(input.input);\n  } catch (error) {\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      input.reportSecurityIncident,\n      {\n        objectId: input.documentId,\n        objectKind: \"document\",\n        operation: \"document.attachment.upload\",\n      },\n    );\n    input.onError(error);\n    return null;\n  }\n}\n"]}

package/stores/documents/documentStore/attachmentUploadLane.js

@@ -0,0 +1,49 @@
+import { beginDomainSyncUploadLane, } from "../../../workflows/sync/index.js";
+function getAttachmentUploadLaneLabel(name) {
+    return name ? `Upload ${name}` : "Attachment upload";
+}
+function getAttachmentUploadFailureTarget(pendingAttachment) {
+    return pendingAttachment.name
+        ? `${pendingAttachment.name} (slot ${pendingAttachment.slotId})`
+        : `slot ${pendingAttachment.slotId}`;
+}
+export function createAttachmentUploadFailedError(pendingAttachment, cause) {
+    const error = new Error(`Attachment upload failed for ${getAttachmentUploadFailureTarget(pendingAttachment)}.`);
+    if (cause !== undefined)
+        Reflect.set(error, "cause", cause);
+    return error;
+}
+/**
+ * Surfaces attachment uploads as observational lanes. The persisted blob id is
+ * the lane identity: slot ids repeat across documents, while a retry must keep
+ * updating the same row. Lane creation stays lazy until progress, failure, or
+ * completion so a billing block before any upload work does not add noise.
+ */
+export function createAttachmentUploadLaneReporter(input) {
+    const { blobId, domainScope, pendingAttachment } = input;
+    const laneRef = { current: null };
+    const ensureLane = () => {
+        laneRef.current ??= beginDomainSyncUploadLane(domainScope, `blob-upload:${blobId}`, {
+            blobStorageKey: pendingAttachment.storageKey,
+            label: getAttachmentUploadLaneLabel(pendingAttachment.name),
+        });
+        return laneRef.current;
+    };
+    return {
+        complete() {
+            // Completion must create/re-begin the lane too: a resumed stage can
+            // already be complete before it emits any per-part callbacks.
+            ensureLane().complete();
+        },
+        fail(error) {
+            ensureLane().fail(error);
+        },
+        failIfStarted(error) {
+            laneRef.current?.fail(error);
+        },
+        onMultipartProgress(progress) {
+            ensureLane().reportProgress(progress);
+        },
+    };
+}
+//# sourceMappingURL=attachmentUploadLane.js.map

package/stores/documents/documentStore/attachmentUploadLane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentUploadLane.js","sourceRoot":"","sources":["attachmentUploadLane.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,yBAAyB,CAAC;AASjC,SAAS,4BAA4B,CAAC,IAA+B;IACnE,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACvD,CAAC;AAED,SAAS,gCAAgC,CACvC,iBAA0C;IAE1C,OAAO,iBAAiB,CAAC,IAAI;QAC3B,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,UAAU,iBAAiB,CAAC,MAAM,GAAG;QAChE,CAAC,CAAC,QAAQ,iBAAiB,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,iBAA0C,EAC1C,KAAc;IAEd,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,gCAAgC,gCAAgC,CAAC,iBAAiB,CAAC,GAAG,CACvF,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAIlD;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACzD,MAAM,OAAO,GAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtE,MAAM,UAAU,GAAG,GAAmB,EAAE;QACtC,OAAO,CAAC,OAAO,KAAK,yBAAyB,CAC3C,WAAW,EACX,eAAe,MAAM,EAAE,EACvB;YACE,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,KAAK,EAAE,4BAA4B,CAAC,iBAAiB,CAAC,IAAI,CAAC;SAC5D,CACF,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ;YACN,oEAAoE;YACpE,8DAA8D;YAC9D,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,KAAc;YACjB,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,aAAa,CAAC,KAAc;YAC1B,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,mBAAmB,CAAC,QAAQ;YAC1B,UAAU,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../../data/domainScope\";\nimport type { MultipartUploadProgressListener } from \"../../../workflows/blobs\";\nimport type { PendingAttachmentRecord } from \"../../../workflows/documents\";\nimport {\n  beginDomainSyncUploadLane,\n  type UploadSyncLane,\n} from \"../../../workflows/sync\";\n\nexport interface AttachmentUploadLaneReporter {\n  complete: () => void;\n  fail: (error: unknown) => void;\n  failIfStarted: (error: unknown) => void;\n  onMultipartProgress: MultipartUploadProgressListener;\n}\n\nfunction getAttachmentUploadLaneLabel(name: string | null | undefined): string {\n  return name ? `Upload ${name}` : \"Attachment upload\";\n}\n\nfunction getAttachmentUploadFailureTarget(\n  pendingAttachment: PendingAttachmentRecord,\n): string {\n  return pendingAttachment.name\n    ? `${pendingAttachment.name} (slot ${pendingAttachment.slotId})`\n    : `slot ${pendingAttachment.slotId}`;\n}\n\nexport function createAttachmentUploadFailedError(\n  pendingAttachment: PendingAttachmentRecord,\n  cause: unknown,\n): Error {\n  const error = new Error(\n    `Attachment upload failed for ${getAttachmentUploadFailureTarget(pendingAttachment)}.`,\n  );\n  if (cause !== undefined) Reflect.set(error, \"cause\", cause);\n\n  return error;\n}\n\n/**\n * Surfaces attachment uploads as observational lanes. The persisted blob id is\n * the lane identity: slot ids repeat across documents, while a retry must keep\n * updating the same row. Lane creation stays lazy until progress, failure, or\n * completion so a billing block before any upload work does not add noise.\n */\nexport function createAttachmentUploadLaneReporter(input: {\n  blobId: string;\n  domainScope: DomainScope;\n  pendingAttachment: PendingAttachmentRecord;\n}): AttachmentUploadLaneReporter {\n  const { blobId, domainScope, pendingAttachment } = input;\n  const laneRef: { current: UploadSyncLane | null } = { current: null };\n\n  const ensureLane = (): UploadSyncLane => {\n    laneRef.current ??= beginDomainSyncUploadLane(\n      domainScope,\n      `blob-upload:${blobId}`,\n      {\n        blobStorageKey: pendingAttachment.storageKey,\n        label: getAttachmentUploadLaneLabel(pendingAttachment.name),\n      },\n    );\n    return laneRef.current;\n  };\n\n  return {\n    complete() {\n      // Completion must create/re-begin the lane too: a resumed stage can\n      // already be complete before it emits any per-part callbacks.\n      ensureLane().complete();\n    },\n    fail(error: unknown) {\n      ensureLane().fail(error);\n    },\n    failIfStarted(error: unknown) {\n      laneRef.current?.fail(error);\n    },\n    onMultipartProgress(progress) {\n      ensureLane().reportProgress(progress);\n    },\n  };\n}\n"]}

package/stores/documents/documentStore/attachmentUploadResume.js

@@ -0,0 +1,95 @@
+import { createAesGcmIv } from "../../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+import { savePendingAttachmentUpload } from "./attachmentPersistence.js";
+import { isDocumentStoreSyncGenerationCurrent, } from "./syncGeneration.js";
+function createPendingUploadIdentity(plaintextSha256) {
+    // Generated once and persisted before the first upload attempt. The source
+    // digest derives an envelope IV from this seed, then each chunk derives its
+    // IV. Reusing the material for unchanged bytes makes retries byte-identical.
+    return {
+        blobId: crypto.randomUUID(),
+        contentKey: bytesToBase64(crypto.getRandomValues(new Uint8Array(32))),
+        contentKeyEpoch: 1,
+        nonceSeed: bytesToBase64(createAesGcmIv()),
+        partSize: null,
+        plaintextSha256,
+        stageId: null,
+    };
+}
+/**
+ * Resolve and persist stable encryption and multipart inputs across retries.
+ *
+ * Every persist here is an UPSERT of the pending-attachment row, so each one
+ * is generation-gated: a store teardown (reset/discard) deletes that row on
+ * purpose, and a stale resume racing it would otherwise re-insert the row it
+ * just removed. Skipping the persist only costs retry resumability.
+ */
+export async function resolveAttachmentUploadResume(state, pendingAttachment, plaintextSha256, attachmentGeneration) {
+    let uploadIdentity = pendingAttachment.upload?.plaintextSha256 === plaintextSha256
+        ? pendingAttachment.upload
+        : createPendingUploadIdentity(plaintextSha256);
+    if (pendingAttachment.upload !== uploadIdentity &&
+        isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+        await savePendingAttachmentUpload(state, { ...pendingAttachment, upload: uploadIdentity }, attachmentGeneration);
+        if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+            pendingAttachment.upload = uploadIdentity;
+        }
+    }
+    const multipart = uploadIdentity.stageId !== null && uploadIdentity.partSize !== null
+        ? {
+            partSize: uploadIdentity.partSize,
+            resumeStageId: uploadIdentity.stageId,
+        }
+        : undefined;
+    const onStageResolved = async ({ partSize, stageId, }) => {
+        if (uploadIdentity.stageId === stageId &&
+            uploadIdentity.partSize === partSize) {
+            return;
+        }
+        if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+            return;
+        }
+        const nextUploadIdentity = { ...uploadIdentity, partSize, stageId };
+        await savePendingAttachmentUpload(state, { ...pendingAttachment, upload: nextUploadIdentity }, attachmentGeneration);
+        if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+            // Publish only after persistence succeeds: a failed save must leave the
+            // next attempt responsible for making this identity durable.
+            uploadIdentity = nextUploadIdentity;
+            pendingAttachment.upload = nextUploadIdentity;
+        }
+    };
+    return {
+        blobId: uploadIdentity.blobId,
+        contentKey: base64ToBytes(uploadIdentity.contentKey),
+        contentKeyEpoch: uploadIdentity.contentKeyEpoch,
+        nonceSeed: base64ToBytes(uploadIdentity.nonceSeed),
+        multipart,
+        onStageResolved,
+        onStageUnavailable: async (stageId, documentId) => {
+            if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||
+                pendingAttachment.upload?.stageId !== stageId)
+                return;
+            // Recheck after the ambiguous bind, including an immediate projection
+            // retry in this pass. A still-active commit must retain its identity for
+            // normal adoption on the next pass; a failed read proves nothing.
+            const bindings = await state.runtime.apiClient.listDocumentAttachments(documentId, { refresh: true });
+            if (!bindings)
+                throw new Error("Attachment recovery lookup failed.");
+            if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||
+                pendingAttachment.upload?.stageId !== stageId ||
+                bindings.some((binding) => binding.slotId === pendingAttachment.slotId &&
+                    binding.blobId === uploadIdentity.blobId))
+                return;
+            // A missing stage may have been consumed by a committed bind whose
+            // response was lost and whose slot was subsequently replaced/detached.
+            // That blob id is permanently reserved, so a replacement stage must use
+            // fresh crypto material and an id persisted before any bytes are sent.
+            const nextUploadIdentity = createPendingUploadIdentity(plaintextSha256);
+            await savePendingAttachmentUpload(state, { ...pendingAttachment, upload: nextUploadIdentity }, attachmentGeneration);
+            if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+                pendingAttachment.upload = nextUploadIdentity;
+            }
+        },
+    };
+}
+//# sourceMappingURL=attachmentUploadResume.js.map