@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/blobs/upload/multipartUpload.js

@@ -0,0 +1,274 @@
+import { MAX_BLOB_CHUNK_COUNT } from "../../../internal/crypto/index.js";
+import { MAX_MULTIPART_BLOB_PART_BYTES } from "../../../internal/validators/util/index.js";
+import { BLOB_TRANSFER_CONCURRENCY, runBlobTransfer, } from "../../../data/blobs/transferPool.js";
+import { releasePreparedParts, sha256BytesHex, takePartSource, } from "./multipartFirstParts.js";
+import { multipartApiFailureMessage, multipartStagePath, } from "./multipartStageFailures.js";
+import { resolveMultipartStage } from "./multipartStageResolution.js";
+const DEFAULT_MULTIPART_UPLOAD_CONCURRENCY = 4;
+const MAX_MULTIPART_UPLOAD_CONCURRENCY = 4;
+// Fetch exposes no upload progress on every host. Allow a slow shared uplink
+// (8 KiB/s total, shared by every admitted part), plus setup/encryption time.
+const MULTIPART_TRANSFER_BYTES_PER_SECOND = 8 * 1024;
+function pathSegment(value) {
+    return encodeURIComponent(String(value));
+}
+function multipartPartRequest(input) {
+    const basePath = `${multipartStagePath(input.stageId)}/parts/${pathSegment(input.partNumber)}`;
+    const authorization = { method: "POST", path: `${basePath}/upload` };
+    // A successful authorization clears its previous failure. If a memory-store
+    // byte request then fails, its separate transport diagnostic is authoritative.
+    return input.apiClient.getRequestFailure?.(authorization)
+        ? authorization
+        : { method: "PUT", path: `${basePath}/bytes` };
+}
+function normalizeMultipartUploadConcurrency(value) {
+    if (value === undefined) {
+        return DEFAULT_MULTIPART_UPLOAD_CONCURRENCY;
+    }
+    if (!Number.isInteger(value) ||
+        value <= 0 ||
+        value > MAX_MULTIPART_UPLOAD_CONCURRENCY) {
+        throw new Error(`Multipart blob upload concurrency must be between 1 and ${MAX_MULTIPART_UPLOAD_CONCURRENCY}`);
+    }
+    return value;
+}
+function isMultipartPartCommit(part) {
+    return part !== undefined;
+}
+async function uploadMultipartPartTasks(input) {
+    let failed = false;
+    let firstFailure;
+    let nextTaskIndex = 0;
+    const recordFailure = (error) => {
+        failed = true;
+        firstFailure ??= { error };
+    };
+    async function worker() {
+        while (!failed) {
+            const task = input.tasks[nextTaskIndex];
+            nextTaskIndex += 1;
+            if (!task) {
+                return;
+            }
+            try {
+                // A first part already holds the pool slot its prepared bytes use.
+                const heldPermit = input.prepared.get(task.partIndex)?.permit;
+                await runBlobTransfer(input.apiClient, async (signal) => {
+                    if (failed)
+                        return;
+                    const aborted = () => recordFailure(signal.reason);
+                    signal.addEventListener("abort", aborted, { once: true });
+                    try {
+                        const uploaded = await uploadMultipartPartBytes({
+                            apiClient: input.apiClient,
+                            encryption: input.encryption,
+                            prepared: input.prepared,
+                            sources: input.sources,
+                            stageId: input.stageId,
+                            task,
+                            uploadId: input.uploadId,
+                            signal,
+                        });
+                        signal.throwIfAborted();
+                        if (!uploaded) {
+                            failed = true;
+                            throw new Error(multipartApiFailureMessage({
+                                apiClient: input.apiClient,
+                                fallback: `Multipart blob part ${task.partNumber} upload failed for stage ${input.stageId}.`,
+                                request: multipartPartRequest({
+                                    apiClient: input.apiClient,
+                                    partNumber: task.partNumber,
+                                    stageId: input.stageId,
+                                }),
+                            }));
+                        }
+                        input.completeParts[task.partIndex] = {
+                            etag: uploaded.part.etag,
+                            partNumber: task.partNumber,
+                        };
+                        input.onPartUploaded?.(task);
+                    }
+                    catch (error) {
+                        // Publish failure before releasing the permit to a queued sibling.
+                        // Already-started parts still record success and drain through the join.
+                        recordFailure(error);
+                    }
+                    finally {
+                        signal.removeEventListener("abort", aborted);
+                    }
+                }, 120_000 +
+                    Math.ceil((task.byteLength * BLOB_TRANSFER_CONCURRENCY * 1000) /
+                        MULTIPART_TRANSFER_BYTES_PER_SECOND), heldPermit);
+            }
+            catch (error) {
+                recordFailure(error);
+            }
+        }
+    }
+    const workerCount = Math.min(input.concurrency, input.tasks.length);
+    await Promise.all(Array.from({ length: workerCount }, () => worker()));
+    if (firstFailure) {
+        throw firstFailure.error;
+    }
+}
+// A first part was encrypted once before the stage existed; hand its bytes
+// over (and release them) instead of encrypting it again.
+async function encryptedPart(input) {
+    const prepared = input.prepared.get(input.task.partIndex);
+    if (prepared) {
+        input.prepared.delete(input.task.partIndex);
+        return prepared;
+    }
+    const bytes = await input.encryption.encryptPart(input.task.partIndex);
+    if (bytes.byteLength !== input.task.byteLength) {
+        throw new Error(`Encrypted blob part ${input.task.partNumber} byte length mismatch: expected ${input.task.byteLength.toLocaleString()}, received ${bytes.byteLength.toLocaleString()}.`);
+    }
+    return { bytes, sha256: await sha256BytesHex(bytes) };
+}
+async function uploadMultipartPartBytes(input) {
+    input.signal.throwIfAborted();
+    const { bytes: encryptedPartBytes, sha256 } = await encryptedPart(input);
+    input.signal.throwIfAborted();
+    const source = takePartSource(input.sources, input.task.partNumber);
+    const uploaded = await input.apiClient.uploadMultipartBlobPartBytes(input.stageId, input.task.partNumber, {
+        byteLength: encryptedPartBytes.byteLength,
+        encryptedBytes: encryptedPartBytes,
+        sha256,
+        ...(source === undefined ? {} : { source }),
+        uploadId: input.uploadId,
+    }, { signal: input.signal });
+    input.signal.throwIfAborted();
+    if (uploaded &&
+        (uploaded.stageId !== input.stageId ||
+            uploaded.uploadId !== input.uploadId ||
+            uploaded.part.partNumber !== input.task.partNumber ||
+            uploaded.part.byteLength !== input.task.byteLength)) {
+        throw new Error(`Multipart blob part ${input.task.partNumber} response does not match its request.`);
+    }
+    return uploaded;
+}
+function uploadedPartsByPartNumber(parts) {
+    return new Map(parts.map((part) => [part.partNumber, part]));
+}
+/**
+ * Plans encrypted part indices without materializing their bytes, reusing any
+ * already-staged parts and seeding cumulative progress for resumed uploads.
+ */
+function planMultipartParts(input) {
+    const { encryption, uploadedParts } = input;
+    const completeParts = new Array(encryption.partCount);
+    const uploadTasks = [];
+    const progress = {
+        bytesTotal: 0,
+        bytesUploaded: 0,
+        partsCompleted: 0,
+        partsTotal: encryption.partCount,
+    };
+    for (let partIndex = 0; partIndex < encryption.partCount; partIndex += 1) {
+        const partNumber = partIndex + 1;
+        const byteLength = encryption.getPartByteLength(partIndex);
+        progress.bytesTotal += byteLength;
+        const uploadedPart = uploadedParts.get(partNumber);
+        if (uploadedPart?.byteLength === byteLength) {
+            completeParts[partIndex] = {
+                etag: uploadedPart.etag,
+                partNumber,
+            };
+            progress.partsCompleted += 1;
+            progress.bytesUploaded += byteLength;
+            continue;
+        }
+        uploadTasks.push({
+            byteLength,
+            partIndex,
+            partNumber,
+        });
+    }
+    return { completeParts, progress, uploadTasks };
+}
+function assertMultipartPlanLimits(encryption) {
+    if (encryption.partCount > MAX_BLOB_CHUNK_COUNT) {
+        throw new Error(`Multipart blob upload would require ${encryption.partCount.toLocaleString()} parts; the maximum is ${MAX_BLOB_CHUNK_COUNT.toLocaleString()} parts.`);
+    }
+    for (let index = 0; index < encryption.partCount; index += 1) {
+        if (encryption.getPartByteLength(index) > MAX_MULTIPART_BLOB_PART_BYTES) {
+            throw new Error(`Encrypted blob part ${index + 1} exceeds the 32 MiB multipart part limit.`);
+        }
+    }
+}
+export async function stageMultipartBlobAttachment(input) {
+    if (input.multipart.partSize !== input.encryption.chunkSize) {
+        throw new Error("Multipart part size must match the encryption chunk size exactly.");
+    }
+    assertMultipartPlanLimits(input.encryption);
+    const concurrency = normalizeMultipartUploadConcurrency(input.multipart.uploadConcurrency);
+    const resolved = await resolveMultipartStage({
+        apiClient: input.apiClient,
+        concurrency,
+        encryption: input.encryption,
+        multipart: input.multipart,
+        organizationId: input.organizationId,
+        onStageUnavailable: input.onStageUnavailable,
+    });
+    try {
+        return await uploadResolvedMultipartStage(input, concurrency, resolved);
+    }
+    finally {
+        // First parts no worker consumed (an early failure) return their slots.
+        releasePreparedParts(resolved.prepared);
+    }
+}
+async function uploadResolvedMultipartStage(input, concurrency, { prepared, sources, status, }) {
+    // Surface the stage id before any parts upload so the caller can persist it;
+    // an upload interrupted mid-flight can then resume this same stage.
+    await input.onStageResolved?.({
+        partSize: input.encryption.chunkSize,
+        stageId: status.stageId,
+    });
+    if (status.completed) {
+        input.onMultipartProgress?.({
+            bytesTotal: input.encryption.byteLength,
+            bytesUploaded: input.encryption.byteLength,
+            partsCompleted: input.encryption.partCount,
+            partsTotal: input.encryption.partCount,
+        });
+        return status.stageId;
+    }
+    const { completeParts, progress, uploadTasks } = planMultipartParts({
+        encryption: input.encryption,
+        uploadedParts: uploadedPartsByPartNumber(status.uploadedParts),
+    });
+    const reportMultipartProgress = () => {
+        input.onMultipartProgress?.({
+            bytesTotal: progress.bytesTotal,
+            bytesUploaded: progress.bytesUploaded,
+            partsCompleted: progress.partsCompleted,
+            partsTotal: progress.partsTotal,
+        });
+    };
+    reportMultipartProgress();
+    await uploadMultipartPartTasks({
+        apiClient: input.apiClient,
+        completeParts,
+        concurrency,
+        encryption: input.encryption,
+        onPartUploaded: (task) => {
+            progress.partsCompleted += 1;
+            progress.bytesUploaded += task.byteLength;
+            reportMultipartProgress();
+        },
+        prepared,
+        sources,
+        stageId: status.stageId,
+        tasks: uploadTasks,
+        uploadId: status.uploadId,
+    });
+    const committedParts = completeParts.filter(isMultipartPartCommit);
+    if (committedParts.length !== input.encryption.partCount) {
+        throw new Error(`Multipart blob upload incomplete for stage ${status.stageId}: committed ${committedParts.length.toLocaleString()} of ${input.encryption.partCount.toLocaleString()} parts.`);
+    }
+    // Binding the attachment completes the stage: the API assembles these parts
+    // and verifies the object's length and SHA-256 before promoting it.
+    return status.stageId;
+}
+//# sourceMappingURL=multipartUpload.js.map

package/workflows/blobs/upload/multipartUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multipartUpload.js","sourceRoot":"","sources":["multipartUpload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,EAIL,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAC/C,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,mCAAmC,GAAG,CAAC,GAAG,IAAI,CAAC;AAarD,SAAS,WAAW,CAAC,KAAsB;IACzC,OAAO,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAI7B;IACC,MAAM,QAAQ,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/F,MAAM,aAAa,GAAG,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,OAAO,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,aAAa,CAAC;QACvD,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,GAAG,QAAQ,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,mCAAmC,CAC1C,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACxB,KAAK,IAAI,CAAC;QACV,KAAK,GAAG,gCAAgC,EACxC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,gCAAgC,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAqC;IAErC,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAWvC;IACC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,YAAqD,CAAC;IAC1D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,EAAE;QACvC,MAAM,GAAG,IAAI,CAAC;QACd,YAAY,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM;QACnB,OAAO,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,aAAa,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,mEAAmE;gBACnE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBAC9D,MAAM,eAAe,CACnB,KAAK,CAAC,SAAS,EACf,KAAK,EAAE,MAAM,EAAE,EAAE;oBACf,IAAI,MAAM;wBAAE,OAAO;oBACnB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC1D,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;4BAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;4BAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,IAAI;4BACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,MAAM;yBACP,CAAC,CAAC;wBACH,MAAM,CAAC,cAAc,EAAE,CAAC;wBACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,MAAM,GAAG,IAAI,CAAC;4BACd,MAAM,IAAI,KAAK,CACb,0BAA0B,CAAC;gCACzB,SAAS,EAAE,KAAK,CAAC,SAAS;gCAC1B,QAAQ,EAAE,uBAAuB,IAAI,CAAC,UAAU,4BAA4B,KAAK,CAAC,OAAO,GAAG;gCAC5F,OAAO,EAAE,oBAAoB,CAAC;oCAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;oCAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iCACvB,CAAC;6BACH,CAAC,CACH,CAAC;wBACJ,CAAC;wBAED,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG;4BACpC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;4BACxB,UAAU,EAAE,IAAI,CAAC,UAAU;yBAC5B,CAAC;wBACF,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC/B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,mEAAmE;wBACnE,yEAAyE;wBACzE,aAAa,CAAC,KAAK,CAAC,CAAC;oBACvB,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC,EACD,OAAO;oBACL,IAAI,CAAC,IAAI,CACP,CAAC,IAAI,CAAC,UAAU,GAAG,yBAAyB,GAAG,IAAI,CAAC;wBAClD,mCAAmC,CACtC,EACH,UAAU,CACX,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,YAAY,CAAC,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,0DAA0D;AAC1D,KAAK,UAAU,aAAa,CAAC,KAI5B;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,CAAC,IAAI,CAAC,UAAU,mCAAmC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CACxK,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KASvC;IACC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACzE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjE,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,IAAI,CAAC,UAAU,EACrB;QACE,UAAU,EAAE,kBAAkB,CAAC,UAAU;QACzC,cAAc,EAAE,kBAAkB;QAClC,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EACD,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,IACE,QAAQ;QACR,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACjC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACpC,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU;YAClD,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,CAAC,IAAI,CAAC,UAAU,uCAAuC,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAwC;IAExC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAeD;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAG3B;IACC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,aAAa,GAAwC,IAAI,KAAK,CAClE,UAAU,CAAC,SAAS,CACrB,CAAC;IACF,MAAM,WAAW,GAA8B,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAiC;QAC7C,UAAU,EAAE,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,UAAU,CAAC,SAAS;KACjC,CAAC;IAEF,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,SAAS,GAAG,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3D,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QAClC,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,YAAY,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;YAC5C,aAAa,CAAC,SAAS,CAAC,GAAG;gBACzB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,UAAU;aACX,CAAC;YACF,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC;YAC7B,QAAQ,CAAC,aAAa,IAAI,UAAU,CAAC;YACrC,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC;YACf,UAAU;YACV,SAAS;YACT,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,yBAAyB,CAAC,UAA8B;IAC/D,IAAI,UAAU,CAAC,SAAS,GAAG,oBAAoB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,uCAAuC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,oBAAoB,CAAC,cAAc,EAAE,SAAS,CACrJ,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,6BAA6B,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,GAAG,CAAC,2CAA2C,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,mCAAmC,CACrD,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAClC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW;QACX,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,wEAAwE;QACxE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAwC,EACxC,WAAmB,EACnB,EACE,QAAQ,EACR,OAAO,EACP,MAAM,GAC4C;IAEpD,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;QACpC,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;YACvC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;YAC1C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QAClE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC;KAC/D,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,GAAG,EAAE;QACnC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,uBAAuB,EAAE,CAAC;IAE1B,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa;QACb,WAAW;QACX,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC;YAC7B,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC;YAC1C,uBAAuB,EAAE,CAAC;QAC5B,CAAC;QACD,QAAQ;QACR,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACnE,IAAI,cAAc,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,OAAO,eAAe,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAC7K,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC","sourcesContent":["import { MAX_BLOB_CHUNK_COUNT } from \"@tearleads/crypto\";\nimport type { MultipartBlobStagePart } from \"@tearleads/validators/response\";\nimport { MAX_MULTIPART_BLOB_PART_BYTES } from \"@tearleads/validators/util\";\nimport {\n  BLOB_TRANSFER_CONCURRENCY,\n  runBlobTransfer,\n} from \"../../../data/blobs/transferPool\";\nimport type { BlobEncryptionPlan } from \"../../../data/documents/blob/shared/crypto\";\nimport type {\n  BlobAttachmentApi,\n  MultipartStageResolvedListener,\n  MultipartUploadProgressListener,\n  UploadDocumentAttachmentInput,\n} from \"../../../data/documents/blob/shared/types\";\nimport {\n  type MultipartPartSources,\n  type PreparedFirstPart,\n  type PreparedMultipartPart,\n  releasePreparedParts,\n  sha256BytesHex,\n  takePartSource,\n} from \"./multipartFirstParts\";\nimport {\n  multipartApiFailureMessage,\n  multipartStagePath,\n} from \"./multipartStageFailures\";\nimport { resolveMultipartStage } from \"./multipartStageResolution\";\n\nconst DEFAULT_MULTIPART_UPLOAD_CONCURRENCY = 4;\nconst MAX_MULTIPART_UPLOAD_CONCURRENCY = 4;\n// Fetch exposes no upload progress on every host. Allow a slow shared uplink\n// (8 KiB/s total, shared by every admitted part), plus setup/encryption time.\nconst MULTIPART_TRANSFER_BYTES_PER_SECOND = 8 * 1024;\n\ninterface MultipartPartCommit {\n  readonly etag: string;\n  readonly partNumber: number;\n}\n\ninterface MultipartPartUploadTask {\n  readonly byteLength: number;\n  readonly partIndex: number;\n  readonly partNumber: number;\n}\n\nfunction pathSegment(value: number | string): string {\n  return encodeURIComponent(String(value));\n}\n\nfunction multipartPartRequest(input: {\n  readonly apiClient: BlobAttachmentApi;\n  readonly partNumber: number;\n  readonly stageId: string;\n}) {\n  const basePath = `${multipartStagePath(input.stageId)}/parts/${pathSegment(input.partNumber)}`;\n  const authorization = { method: \"POST\" as const, path: `${basePath}/upload` };\n  // A successful authorization clears its previous failure. If a memory-store\n  // byte request then fails, its separate transport diagnostic is authoritative.\n  return input.apiClient.getRequestFailure?.(authorization)\n    ? authorization\n    : { method: \"PUT\" as const, path: `${basePath}/bytes` };\n}\n\nfunction normalizeMultipartUploadConcurrency(\n  value: number | undefined,\n): number {\n  if (value === undefined) {\n    return DEFAULT_MULTIPART_UPLOAD_CONCURRENCY;\n  }\n  if (\n    !Number.isInteger(value) ||\n    value <= 0 ||\n    value > MAX_MULTIPART_UPLOAD_CONCURRENCY\n  ) {\n    throw new Error(\n      `Multipart blob upload concurrency must be between 1 and ${MAX_MULTIPART_UPLOAD_CONCURRENCY}`,\n    );\n  }\n\n  return value;\n}\n\nfunction isMultipartPartCommit(\n  part: MultipartPartCommit | undefined,\n): part is MultipartPartCommit {\n  return part !== undefined;\n}\n\nasync function uploadMultipartPartTasks(input: {\n  readonly apiClient: BlobAttachmentApi;\n  readonly completeParts: (MultipartPartCommit | undefined)[];\n  readonly concurrency: number;\n  readonly encryption: BlobEncryptionPlan;\n  readonly onPartUploaded?: (task: MultipartPartUploadTask) => void;\n  readonly prepared: Map<number, PreparedFirstPart>;\n  readonly sources: MultipartPartSources;\n  readonly stageId: string;\n  readonly tasks: readonly MultipartPartUploadTask[];\n  readonly uploadId: string;\n}): Promise<void> {\n  let failed = false;\n  let firstFailure: { readonly error: unknown } | undefined;\n  let nextTaskIndex = 0;\n  const recordFailure = (error: unknown) => {\n    failed = true;\n    firstFailure ??= { error };\n  };\n\n  async function worker(): Promise<void> {\n    while (!failed) {\n      const task = input.tasks[nextTaskIndex];\n      nextTaskIndex += 1;\n      if (!task) {\n        return;\n      }\n\n      try {\n        // A first part already holds the pool slot its prepared bytes use.\n        const heldPermit = input.prepared.get(task.partIndex)?.permit;\n        await runBlobTransfer(\n          input.apiClient,\n          async (signal) => {\n            if (failed) return;\n            const aborted = () => recordFailure(signal.reason);\n            signal.addEventListener(\"abort\", aborted, { once: true });\n            try {\n              const uploaded = await uploadMultipartPartBytes({\n                apiClient: input.apiClient,\n                encryption: input.encryption,\n                prepared: input.prepared,\n                sources: input.sources,\n                stageId: input.stageId,\n                task,\n                uploadId: input.uploadId,\n                signal,\n              });\n              signal.throwIfAborted();\n              if (!uploaded) {\n                failed = true;\n                throw new Error(\n                  multipartApiFailureMessage({\n                    apiClient: input.apiClient,\n                    fallback: `Multipart blob part ${task.partNumber} upload failed for stage ${input.stageId}.`,\n                    request: multipartPartRequest({\n                      apiClient: input.apiClient,\n                      partNumber: task.partNumber,\n                      stageId: input.stageId,\n                    }),\n                  }),\n                );\n              }\n\n              input.completeParts[task.partIndex] = {\n                etag: uploaded.part.etag,\n                partNumber: task.partNumber,\n              };\n              input.onPartUploaded?.(task);\n            } catch (error) {\n              // Publish failure before releasing the permit to a queued sibling.\n              // Already-started parts still record success and drain through the join.\n              recordFailure(error);\n            } finally {\n              signal.removeEventListener(\"abort\", aborted);\n            }\n          },\n          120_000 +\n            Math.ceil(\n              (task.byteLength * BLOB_TRANSFER_CONCURRENCY * 1000) /\n                MULTIPART_TRANSFER_BYTES_PER_SECOND,\n            ),\n          heldPermit,\n        );\n      } catch (error) {\n        recordFailure(error);\n      }\n    }\n  }\n\n  const workerCount = Math.min(input.concurrency, input.tasks.length);\n  await Promise.all(Array.from({ length: workerCount }, () => worker()));\n  if (firstFailure) {\n    throw firstFailure.error;\n  }\n}\n\n// A first part was encrypted once before the stage existed; hand its bytes\n// over (and release them) instead of encrypting it again.\nasync function encryptedPart(input: {\n  readonly encryption: BlobEncryptionPlan;\n  readonly prepared: Map<number, PreparedFirstPart>;\n  readonly task: MultipartPartUploadTask;\n}): Promise<PreparedMultipartPart> {\n  const prepared = input.prepared.get(input.task.partIndex);\n  if (prepared) {\n    input.prepared.delete(input.task.partIndex);\n    return prepared;\n  }\n  const bytes = await input.encryption.encryptPart(input.task.partIndex);\n  if (bytes.byteLength !== input.task.byteLength) {\n    throw new Error(\n      `Encrypted blob part ${input.task.partNumber} byte length mismatch: expected ${input.task.byteLength.toLocaleString()}, received ${bytes.byteLength.toLocaleString()}.`,\n    );\n  }\n  return { bytes, sha256: await sha256BytesHex(bytes) };\n}\n\nasync function uploadMultipartPartBytes(input: {\n  readonly apiClient: BlobAttachmentApi;\n  readonly encryption: BlobEncryptionPlan;\n  readonly prepared: Map<number, PreparedFirstPart>;\n  readonly sources: MultipartPartSources;\n  readonly stageId: string;\n  readonly task: MultipartPartUploadTask;\n  readonly uploadId: string;\n  readonly signal: AbortSignal;\n}): ReturnType<BlobAttachmentApi[\"uploadMultipartBlobPartBytes\"]> {\n  input.signal.throwIfAborted();\n  const { bytes: encryptedPartBytes, sha256 } = await encryptedPart(input);\n  input.signal.throwIfAborted();\n  const source = takePartSource(input.sources, input.task.partNumber);\n  const uploaded = await input.apiClient.uploadMultipartBlobPartBytes(\n    input.stageId,\n    input.task.partNumber,\n    {\n      byteLength: encryptedPartBytes.byteLength,\n      encryptedBytes: encryptedPartBytes,\n      sha256,\n      ...(source === undefined ? {} : { source }),\n      uploadId: input.uploadId,\n    },\n    { signal: input.signal },\n  );\n  input.signal.throwIfAborted();\n  if (\n    uploaded &&\n    (uploaded.stageId !== input.stageId ||\n      uploaded.uploadId !== input.uploadId ||\n      uploaded.part.partNumber !== input.task.partNumber ||\n      uploaded.part.byteLength !== input.task.byteLength)\n  ) {\n    throw new Error(\n      `Multipart blob part ${input.task.partNumber} response does not match its request.`,\n    );\n  }\n  return uploaded;\n}\n\nfunction uploadedPartsByPartNumber(\n  parts: readonly MultipartBlobStagePart[],\n): ReadonlyMap<number, MultipartBlobStagePart> {\n  return new Map(parts.map((part) => [part.partNumber, part]));\n}\n\ninterface MultipartUploadProgressState {\n  bytesTotal: number;\n  bytesUploaded: number;\n  partsCompleted: number;\n  partsTotal: number;\n}\n\ninterface MultipartPartPlan {\n  completeParts: (MultipartPartCommit | undefined)[];\n  progress: MultipartUploadProgressState;\n  uploadTasks: MultipartPartUploadTask[];\n}\n\n/**\n * Plans encrypted part indices without materializing their bytes, reusing any\n * already-staged parts and seeding cumulative progress for resumed uploads.\n */\nfunction planMultipartParts(input: {\n  encryption: BlobEncryptionPlan;\n  uploadedParts: ReadonlyMap<number, MultipartBlobStagePart>;\n}): MultipartPartPlan {\n  const { encryption, uploadedParts } = input;\n  const completeParts: (MultipartPartCommit | undefined)[] = new Array(\n    encryption.partCount,\n  );\n  const uploadTasks: MultipartPartUploadTask[] = [];\n  const progress: MultipartUploadProgressState = {\n    bytesTotal: 0,\n    bytesUploaded: 0,\n    partsCompleted: 0,\n    partsTotal: encryption.partCount,\n  };\n\n  for (let partIndex = 0; partIndex < encryption.partCount; partIndex += 1) {\n    const partNumber = partIndex + 1;\n    const byteLength = encryption.getPartByteLength(partIndex);\n    progress.bytesTotal += byteLength;\n    const uploadedPart = uploadedParts.get(partNumber);\n    if (uploadedPart?.byteLength === byteLength) {\n      completeParts[partIndex] = {\n        etag: uploadedPart.etag,\n        partNumber,\n      };\n      progress.partsCompleted += 1;\n      progress.bytesUploaded += byteLength;\n      continue;\n    }\n\n    uploadTasks.push({\n      byteLength,\n      partIndex,\n      partNumber,\n    });\n  }\n\n  return { completeParts, progress, uploadTasks };\n}\n\nfunction assertMultipartPlanLimits(encryption: BlobEncryptionPlan): void {\n  if (encryption.partCount > MAX_BLOB_CHUNK_COUNT) {\n    throw new Error(\n      `Multipart blob upload would require ${encryption.partCount.toLocaleString()} parts; the maximum is ${MAX_BLOB_CHUNK_COUNT.toLocaleString()} parts.`,\n    );\n  }\n  for (let index = 0; index < encryption.partCount; index += 1) {\n    if (encryption.getPartByteLength(index) > MAX_MULTIPART_BLOB_PART_BYTES) {\n      throw new Error(\n        `Encrypted blob part ${index + 1} exceeds the 32 MiB multipart part limit.`,\n      );\n    }\n  }\n}\n\ntype StageMultipartBlobAttachmentInput = {\n  readonly apiClient: BlobAttachmentApi;\n  readonly encryption: BlobEncryptionPlan;\n  readonly multipart: NonNullable<UploadDocumentAttachmentInput[\"multipart\"]>;\n  readonly organizationId: string;\n  readonly onMultipartProgress?: MultipartUploadProgressListener | undefined;\n  readonly onStageResolved?: MultipartStageResolvedListener | undefined;\n  readonly onStageUnavailable?:\n    | ((stageId: string) => Promise<void>)\n    | undefined;\n};\n\nexport async function stageMultipartBlobAttachment(\n  input: StageMultipartBlobAttachmentInput,\n): Promise<string | null> {\n  if (input.multipart.partSize !== input.encryption.chunkSize) {\n    throw new Error(\n      \"Multipart part size must match the encryption chunk size exactly.\",\n    );\n  }\n  assertMultipartPlanLimits(input.encryption);\n  const concurrency = normalizeMultipartUploadConcurrency(\n    input.multipart.uploadConcurrency,\n  );\n  const resolved = await resolveMultipartStage({\n    apiClient: input.apiClient,\n    concurrency,\n    encryption: input.encryption,\n    multipart: input.multipart,\n    organizationId: input.organizationId,\n    onStageUnavailable: input.onStageUnavailable,\n  });\n  try {\n    return await uploadResolvedMultipartStage(input, concurrency, resolved);\n  } finally {\n    // First parts no worker consumed (an early failure) return their slots.\n    releasePreparedParts(resolved.prepared);\n  }\n}\n\nasync function uploadResolvedMultipartStage(\n  input: StageMultipartBlobAttachmentInput,\n  concurrency: number,\n  {\n    prepared,\n    sources,\n    status,\n  }: Awaited<ReturnType<typeof resolveMultipartStage>>,\n): Promise<string> {\n  // Surface the stage id before any parts upload so the caller can persist it;\n  // an upload interrupted mid-flight can then resume this same stage.\n  await input.onStageResolved?.({\n    partSize: input.encryption.chunkSize,\n    stageId: status.stageId,\n  });\n  if (status.completed) {\n    input.onMultipartProgress?.({\n      bytesTotal: input.encryption.byteLength,\n      bytesUploaded: input.encryption.byteLength,\n      partsCompleted: input.encryption.partCount,\n      partsTotal: input.encryption.partCount,\n    });\n    return status.stageId;\n  }\n\n  const { completeParts, progress, uploadTasks } = planMultipartParts({\n    encryption: input.encryption,\n    uploadedParts: uploadedPartsByPartNumber(status.uploadedParts),\n  });\n\n  const reportMultipartProgress = () => {\n    input.onMultipartProgress?.({\n      bytesTotal: progress.bytesTotal,\n      bytesUploaded: progress.bytesUploaded,\n      partsCompleted: progress.partsCompleted,\n      partsTotal: progress.partsTotal,\n    });\n  };\n  reportMultipartProgress();\n\n  await uploadMultipartPartTasks({\n    apiClient: input.apiClient,\n    completeParts,\n    concurrency,\n    encryption: input.encryption,\n    onPartUploaded: (task) => {\n      progress.partsCompleted += 1;\n      progress.bytesUploaded += task.byteLength;\n      reportMultipartProgress();\n    },\n    prepared,\n    sources,\n    stageId: status.stageId,\n    tasks: uploadTasks,\n    uploadId: status.uploadId,\n  });\n  const committedParts = completeParts.filter(isMultipartPartCommit);\n  if (committedParts.length !== input.encryption.partCount) {\n    throw new Error(\n      `Multipart blob upload incomplete for stage ${status.stageId}: committed ${committedParts.length.toLocaleString()} of ${input.encryption.partCount.toLocaleString()} parts.`,\n    );\n  }\n\n  // Binding the attachment completes the stage: the API assembles these parts\n  // and verifies the object's length and SHA-256 before promoting it.\n  return status.stageId;\n}\n"]}

package/workflows/blobs/verification/attachmentBindingVerification.js

@@ -0,0 +1,49 @@
+import { KeyingVerificationError, verifyAttachmentBindingEvent, } from "../../../internal/crypto/index.js";
+import { readCanonicalJson, readCanonicalRecord, } from "../../../data/keying/canonicalJson.js";
+import { readAccessEvent, readRecordString, readRequiredRecordValue, resolveEventContainerPaths, } from "../../../data/keyingProjectionVerification/index.js";
+export async function assertAttachmentBindingVerified(input) {
+    if (!input.authorization) {
+        throw new Error("Attachment binding lacks verified document authority");
+    }
+    if (!input.binding.bindingEvent ||
+        !input.binding.documentManifestHash ||
+        input.binding.previousBindingId === undefined) {
+        throw new Error("Attachment binding lacks signed verification material");
+    }
+    const eventBundle = readCanonicalRecord(input.binding.bindingEvent, "Attachment binding event bundle");
+    const event = readAccessEvent(readRequiredRecordValue(eventBundle, "event", "Attachment binding event bundle"), "Attachment binding event");
+    const signer = await input.resolveProjectionUserKey(event.signerUserId);
+    if (!signer) {
+        throw new Error("Attachment binding signer identity is unavailable");
+    }
+    const documentManifest = input.authorization.documentManifestByHash.get(input.binding.documentManifestHash);
+    if (!documentManifest) {
+        throw new Error("Attachment binding document manifest is unverified");
+    }
+    const { dependencyContainerPaths } = resolveEventContainerPaths({
+        containerPathByManifestHash: input.authorization.containerPathByManifestHash,
+        dependencyManifestHashes: event.dependencyManifestHashes.filter((hash) => hash !== input.binding.documentManifestHash),
+    });
+    const verified = await verifyAttachmentBindingEvent({
+        authorizationMembership: "referenced",
+        authorizingContainerPaths: dependencyContainerPaths,
+        body: readCanonicalJson(readRequiredRecordValue(eventBundle, "body", "Attachment binding event bundle"), "Attachment binding event body"),
+        documentManifest,
+        event,
+        expectedBindingId: input.binding.bindingId,
+        expectedBlobId: input.binding.blobId,
+        expectedDocumentId: input.expectedDocumentId,
+        expectedDocumentManifestHash: input.binding.documentManifestHash,
+        expectedPreviousBindingId: input.binding.previousBindingId,
+        principalPolicies: input.authorization.principalPolicies,
+        signerPublicKey: signer.signingPublicKey,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    if (verified.value.slotId !== input.expectedSlotId ||
+        readRecordString(eventBundle, "eventHash", "Attachment binding event bundle") !== verified.value.event.eventHash) {
+        throw new KeyingVerificationError("object_mismatch", "Attachment binding slot or event hash is inconsistent");
+    }
+}
+//# sourceMappingURL=attachmentBindingVerification.js.map

package/workflows/blobs/verification/attachmentBindingVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentBindingVerification.js","sourceRoot":"","sources":["attachmentBindingVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAarD;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB;QACnC,KAAK,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,KAAK,CAAC,OAAO,CAAC,YAAY,EAC1B,iCAAiC,CAClC,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAC3B,uBAAuB,CACrB,WAAW,EACX,OAAO,EACP,iCAAiC,CAClC,EACD,0BAA0B,CAC3B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACrE,KAAK,CAAC,OAAO,CAAC,oBAAoB,CACnC,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,wBAAwB,EAAE,GAAG,0BAA0B,CAAC;QAC9D,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;QACjD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,oBAAoB,CACtD;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,uBAAuB,EAAE,YAAY;QACrC,yBAAyB,EAAE,wBAAwB;QACnD,IAAI,EAAE,iBAAiB,CACrB,uBAAuB,CACrB,WAAW,EACX,MAAM,EACN,iCAAiC,CAClC,EACD,+BAA+B,CAChC;QACD,gBAAgB;QAChB,KAAK;QACL,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAC1C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB;QAChE,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAC1D,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;QACxD,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QAC9C,gBAAgB,CACd,WAAW,EACX,WAAW,EACX,iCAAiC,CAClC,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EACpC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  verifyAttachmentBindingEvent,\n} from \"@tearleads/crypto\";\nimport type { DecryptDocumentAttachmentBlobInput } from \"../../../data/documents/blob/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../../data/keying/canonicalJson\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  type ProjectionUserKeyResolver,\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n  resolveEventContainerPaths,\n} from \"../../../data/keyingProjectionVerification\";\n\nexport async function assertAttachmentBindingVerified(input: {\n  readonly authorization: DocumentWriterProjectionAuthorization | undefined;\n  readonly binding: Pick<\n    DecryptDocumentAttachmentBlobInput[\"binding\"],\n    | \"bindingEvent\"\n    | \"documentManifestHash\"\n    | \"previousBindingId\"\n    | \"bindingId\"\n    | \"blobId\"\n  >;\n  readonly expectedDocumentId: string;\n  readonly expectedSlotId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n}): Promise<void> {\n  if (!input.authorization) {\n    throw new Error(\"Attachment binding lacks verified document authority\");\n  }\n  if (\n    !input.binding.bindingEvent ||\n    !input.binding.documentManifestHash ||\n    input.binding.previousBindingId === undefined\n  ) {\n    throw new Error(\"Attachment binding lacks signed verification material\");\n  }\n  const eventBundle = readCanonicalRecord(\n    input.binding.bindingEvent,\n    \"Attachment binding event bundle\",\n  );\n  const event = readAccessEvent(\n    readRequiredRecordValue(\n      eventBundle,\n      \"event\",\n      \"Attachment binding event bundle\",\n    ),\n    \"Attachment binding event\",\n  );\n  const signer = await input.resolveProjectionUserKey(event.signerUserId);\n  if (!signer) {\n    throw new Error(\"Attachment binding signer identity is unavailable\");\n  }\n  const documentManifest = input.authorization.documentManifestByHash.get(\n    input.binding.documentManifestHash,\n  );\n  if (!documentManifest) {\n    throw new Error(\"Attachment binding document manifest is unverified\");\n  }\n  const { dependencyContainerPaths } = resolveEventContainerPaths({\n    containerPathByManifestHash:\n      input.authorization.containerPathByManifestHash,\n    dependencyManifestHashes: event.dependencyManifestHashes.filter(\n      (hash) => hash !== input.binding.documentManifestHash,\n    ),\n  });\n  const verified = await verifyAttachmentBindingEvent({\n    authorizationMembership: \"referenced\",\n    authorizingContainerPaths: dependencyContainerPaths,\n    body: readCanonicalJson(\n      readRequiredRecordValue(\n        eventBundle,\n        \"body\",\n        \"Attachment binding event bundle\",\n      ),\n      \"Attachment binding event body\",\n    ),\n    documentManifest,\n    event,\n    expectedBindingId: input.binding.bindingId,\n    expectedBlobId: input.binding.blobId,\n    expectedDocumentId: input.expectedDocumentId,\n    expectedDocumentManifestHash: input.binding.documentManifestHash,\n    expectedPreviousBindingId: input.binding.previousBindingId,\n    principalPolicies: input.authorization.principalPolicies,\n    signerPublicKey: signer.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (\n    verified.value.slotId !== input.expectedSlotId ||\n    readRecordString(\n      eventBundle,\n      \"eventHash\",\n      \"Attachment binding event bundle\",\n    ) !== verified.value.event.eventHash\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Attachment binding slot or event hash is inconsistent\",\n    );\n  }\n}\n"]}

package/workflows/blobs/verification/attachmentDecryptor.js

@@ -0,0 +1,41 @@
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { isKeyingVerificationError } from "../../../data/keyingProjectionVerification/error.js";
+import { decryptDocumentAttachmentBlob } from "../hydration/decrypt.js";
+/**
+ * Proof material the cached projection lacks, such as a wrap-cited container
+ * manifest that a fresher projection serves. Not integrity evidence.
+ */
+function isRefreshableProofDependency(error) {
+    return (error instanceof ProjectionDependencyUnavailableError ||
+        (isKeyingVerificationError(error) && error.code === "missing_dependency"));
+}
+/** One fresh proof fetch shared by a hydration or key-rewrap run. */
+export function createAttachmentProofReader(apiClient, documentId, read) {
+    let refreshed;
+    const refresh = () => {
+        refreshed ??= (async () => {
+            apiClient.evictDocumentWriterProjection?.(documentId);
+            return apiClient.getDocumentWriterProjection(documentId);
+        })();
+        return refreshed;
+    };
+    return async (input) => {
+        try {
+            return await read(input);
+        }
+        catch (error) {
+            if (!isRefreshableProofDependency(error))
+                throw error;
+            const writerProjection = await refresh();
+            if (!writerProjection)
+                throw error;
+            // Retry the same binding and ciphertext with fully verified fresh proof.
+            // A second missing dependency escapes; it cannot trigger another fetch.
+            return read({ ...input, writerProjection });
+        }
+    };
+}
+export function createAttachmentDecryptor(apiClient, documentId) {
+    return createAttachmentProofReader(apiClient, documentId, decryptDocumentAttachmentBlob);
+}
+//# sourceMappingURL=attachmentDecryptor.js.map

package/workflows/blobs/verification/attachmentDecryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentDecryptor.js","sourceRoot":"","sources":["attachmentDecryptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AASrE;;;GAGG;AACH,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,CACL,KAAK,YAAY,oCAAoC;QACrD,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,2BAA2B,CAIzC,SAAkC,EAClC,UAAkB,EAClB,IAAuC;IAEvC,IAAI,SAAuE,CAAC;IAC5E,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YACxB,SAAS,CAAC,6BAA6B,EAAE,CAAC,UAAU,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,KAAY,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,gBAAgB,GAAG,MAAM,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnC,yEAAyE;YACzE,wEAAwE;YACxE,OAAO,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,SAAkC,EAClC,UAAkB;IAElB,OAAO,2BAA2B,CAChC,SAAS,EACT,UAAU,EACV,6BAA6B,CAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { isKeyingVerificationError } from \"../../../data/keyingProjectionVerification/error\";\nimport { decryptDocumentAttachmentBlob } from \"../hydration/decrypt\";\n\ninterface AttachmentProjectionApi {\n  evictDocumentWriterProjection?(documentId: string): void;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n}\n\n/**\n * Proof material the cached projection lacks, such as a wrap-cited container\n * manifest that a fresher projection serves. Not integrity evidence.\n */\nfunction isRefreshableProofDependency(error: unknown): boolean {\n  return (\n    error instanceof ProjectionDependencyUnavailableError ||\n    (isKeyingVerificationError(error) && error.code === \"missing_dependency\")\n  );\n}\n\n/** One fresh proof fetch shared by a hydration or key-rewrap run. */\nexport function createAttachmentProofReader<\n  Input extends { writerProjection: DocumentWriterProjectionResponse },\n  Result,\n>(\n  apiClient: AttachmentProjectionApi,\n  documentId: string,\n  read: (input: Input) => Promise<Result>,\n) {\n  let refreshed: Promise<DocumentWriterProjectionResponse | null> | undefined;\n  const refresh = () => {\n    refreshed ??= (async () => {\n      apiClient.evictDocumentWriterProjection?.(documentId);\n      return apiClient.getDocumentWriterProjection(documentId);\n    })();\n    return refreshed;\n  };\n  return async (input: Input) => {\n    try {\n      return await read(input);\n    } catch (error) {\n      if (!isRefreshableProofDependency(error)) throw error;\n      const writerProjection = await refresh();\n      if (!writerProjection) throw error;\n      // Retry the same binding and ciphertext with fully verified fresh proof.\n      // A second missing dependency escapes; it cannot trigger another fetch.\n      return read({ ...input, writerProjection });\n    }\n  };\n}\n\nexport function createAttachmentDecryptor(\n  apiClient: AttachmentProjectionApi,\n  documentId: string,\n) {\n  return createAttachmentProofReader(\n    apiClient,\n    documentId,\n    decryptDocumentAttachmentBlob,\n  );\n}\n"]}

package/workflows/blobs/verification/attachmentKeyAuthenticator.js

@@ -0,0 +1,68 @@
+import { AES_GCM_TAG_BYTES, blobChunkPlaintextByteLength, bytesToHex, } from "../../../internal/crypto/index.js";
+import { createBlobEnvelopeStream } from "../../../data/documents/blob/shared/blobEnvelopeStream.js";
+import { assertEqualBytes, readWriteHeader, } from "../../../data/documents/shared/readers.js";
+import { decryptBlobChunk } from "../hydration/blobChunkDecryption.js";
+import { prepareDocumentAttachmentBlobDecryption } from "../hydration/decrypt.js";
+import { createAttachmentProofReader } from "./attachmentDecryptor.js";
+const createProofReader = (api, documentId) => createAttachmentProofReader(api, documentId, prepareDocumentAttachmentBlobDecryption);
+async function authenticateAttachmentKey(api, input, readProof) {
+    const blob = await api.getBlobBytes(input.binding.blobId);
+    if (!blob)
+        throw new Error("Attachment ciphertext is unavailable for relinking");
+    const body = new Response(blob.encryptedBytes).body;
+    if (!body)
+        throw new Error("Attachment ciphertext stream is unavailable");
+    const source = createBlobEnvelopeStream(body);
+    try {
+        const encrypted = await source.readHeader();
+        // A missing citation can refresh the proof before consuming ciphertext.
+        const context = await readProof({ ...input, encrypted });
+        for (let index = 0; index < encrypted.chunkCount; index++) {
+            const plaintextByteLength = blobChunkPlaintextByteLength({
+                chunkCount: encrypted.chunkCount,
+                chunkIndex: index,
+                chunkSize: encrypted.chunkSize,
+                plaintextByteLength: encrypted.byteLength,
+            });
+            const ciphertext = await source.read(plaintextByteLength + AES_GCM_TAG_BYTES);
+            await decryptBlobChunk({
+                ...context,
+                encrypted,
+                expectedBlobId: input.binding.blobId,
+                chunk: { ciphertext, index, plaintextByteLength },
+            });
+        }
+        const header = readWriteHeader(input.binding.writeHeader, "Attachment blob write header");
+        if (bytesToHex(await source.finish()) !== header.ciphertextHash)
+            throw new Error("Attachment blob write header does not match ciphertext");
+        return {
+            encrypted,
+            contentKey: context.contentKey,
+            ciphertextHash: header.ciphertextHash,
+        };
+    }
+    finally {
+        await source.close();
+    }
+}
+/** Shared blobs retain only authenticated keys and metadata, never their bytes. */
+export function createAttachmentKeyAuthenticator(api, documentId) {
+    const readProof = createProofReader(api, documentId);
+    const authenticated = new Map();
+    return async (input) => {
+        const existing = authenticated.get(input.binding.blobId);
+        if (!existing) {
+            const pending = authenticateAttachmentKey(api, input, readProof);
+            authenticated.set(input.binding.blobId, pending);
+            return (await pending).contentKey;
+        }
+        const cached = await existing;
+        const context = await readProof({ ...input, encrypted: cached.encrypted });
+        if (readWriteHeader(input.binding.writeHeader, "Attachment blob write header")
+            .ciphertextHash !== cached.ciphertextHash)
+            throw new Error("Attachment blob write header does not match ciphertext");
+        assertEqualBytes(context.contentKey, cached.contentKey, "Attachment bindings contain conflicting blob keys");
+        return cached.contentKey;
+    };
+}
+//# sourceMappingURL=attachmentKeyAuthenticator.js.map

package/workflows/blobs/verification/attachmentKeyAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentKeyAuthenticator.js","sourceRoot":"","sources":["attachmentKeyAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAKlG,OAAO,EACL,gBAAgB,EAChB,eAAe,GAChB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,uCAAuC,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAapE,MAAM,iBAAiB,GAAG,CACxB,GAA+B,EAC/B,UAAkB,EAClB,EAAE,CACF,2BAA2B,CACzB,GAAG,EACH,UAAU,EACV,uCAAuC,CACxC,CAAC;AAEJ,KAAK,UAAU,yBAAyB,CACtC,GAA+B,EAC/B,KAAyB,EACzB,SAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5C,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1D,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,UAAU,EAAE,KAAK;gBACjB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,mBAAmB,EAAE,SAAS,CAAC,UAAU;aAC1C,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAClC,mBAAmB,GAAG,iBAAiB,CACxC,CAAC;YACF,MAAM,gBAAgB,CAAC;gBACrB,GAAG,OAAO;gBACV,SAAS;gBACT,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;gBACpC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC,cAAc;YAC7D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,OAAO;YACL,SAAS;YACT,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gCAAgC,CAC9C,GAA+B,EAC/B,UAAkB;IAElB,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC9D,OAAO,KAAK,EAAE,KAAyB,EAAuB,EAAE;QAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,UAAU,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3E,IACE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,8BAA8B,CAAC;aACvE,cAAc,KAAK,MAAM,CAAC,cAAc;YAE3C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,gBAAgB,CACd,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,UAAU,EACjB,mDAAmD,CACpD,CAAC;QACF,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  AES_GCM_TAG_BYTES,\n  blobChunkPlaintextByteLength,\n  bytesToHex,\n} from \"@tearleads/crypto\";\nimport { createBlobEnvelopeStream } from \"../../../data/documents/blob/shared/blobEnvelopeStream\";\nimport type {\n  BlobEncryptedBytesHeader,\n  DecryptDocumentAttachmentBlobInput,\n} from \"../../../data/documents/blob/shared/types\";\nimport {\n  assertEqualBytes,\n  readWriteHeader,\n} from \"../../../data/documents/shared/readers\";\nimport type { DocumentLinkSetMutationApi } from \"../../../data/documents/shared/types\";\nimport { decryptBlobChunk } from \"../hydration/blobChunkDecryption\";\nimport { prepareDocumentAttachmentBlobDecryption } from \"../hydration/decrypt\";\nimport { createAttachmentProofReader } from \"./attachmentDecryptor\";\n\ntype AttachmentKeyInput = Omit<\n  DecryptDocumentAttachmentBlobInput,\n  \"encryptedBytes\"\n>;\ntype VerifiedKey = {\n  ciphertextHash: string;\n  encrypted: BlobEncryptedBytesHeader;\n  contentKey: Uint8Array;\n};\ntype ProofReader = ReturnType<typeof createProofReader>;\n\nconst createProofReader = (\n  api: DocumentLinkSetMutationApi,\n  documentId: string,\n) =>\n  createAttachmentProofReader(\n    api,\n    documentId,\n    prepareDocumentAttachmentBlobDecryption,\n  );\n\nasync function authenticateAttachmentKey(\n  api: DocumentLinkSetMutationApi,\n  input: AttachmentKeyInput,\n  readProof: ProofReader,\n): Promise<VerifiedKey> {\n  const blob = await api.getBlobBytes(input.binding.blobId);\n  if (!blob)\n    throw new Error(\"Attachment ciphertext is unavailable for relinking\");\n  const body = new Response(blob.encryptedBytes).body;\n  if (!body) throw new Error(\"Attachment ciphertext stream is unavailable\");\n  const source = createBlobEnvelopeStream(body);\n  try {\n    const encrypted = await source.readHeader();\n    // A missing citation can refresh the proof before consuming ciphertext.\n    const context = await readProof({ ...input, encrypted });\n    for (let index = 0; index < encrypted.chunkCount; index++) {\n      const plaintextByteLength = blobChunkPlaintextByteLength({\n        chunkCount: encrypted.chunkCount,\n        chunkIndex: index,\n        chunkSize: encrypted.chunkSize,\n        plaintextByteLength: encrypted.byteLength,\n      });\n      const ciphertext = await source.read(\n        plaintextByteLength + AES_GCM_TAG_BYTES,\n      );\n      await decryptBlobChunk({\n        ...context,\n        encrypted,\n        expectedBlobId: input.binding.blobId,\n        chunk: { ciphertext, index, plaintextByteLength },\n      });\n    }\n    const header = readWriteHeader(\n      input.binding.writeHeader,\n      \"Attachment blob write header\",\n    );\n    if (bytesToHex(await source.finish()) !== header.ciphertextHash)\n      throw new Error(\"Attachment blob write header does not match ciphertext\");\n    return {\n      encrypted,\n      contentKey: context.contentKey,\n      ciphertextHash: header.ciphertextHash,\n    };\n  } finally {\n    await source.close();\n  }\n}\n\n/** Shared blobs retain only authenticated keys and metadata, never their bytes. */\nexport function createAttachmentKeyAuthenticator(\n  api: DocumentLinkSetMutationApi,\n  documentId: string,\n) {\n  const readProof = createProofReader(api, documentId);\n  const authenticated = new Map<string, Promise<VerifiedKey>>();\n  return async (input: AttachmentKeyInput): Promise<Uint8Array> => {\n    const existing = authenticated.get(input.binding.blobId);\n    if (!existing) {\n      const pending = authenticateAttachmentKey(api, input, readProof);\n      authenticated.set(input.binding.blobId, pending);\n      return (await pending).contentKey;\n    }\n    const cached = await existing;\n    const context = await readProof({ ...input, encrypted: cached.encrypted });\n    if (\n      readWriteHeader(input.binding.writeHeader, \"Attachment blob write header\")\n        .ciphertextHash !== cached.ciphertextHash\n    )\n      throw new Error(\"Attachment blob write header does not match ciphertext\");\n    assertEqualBytes(\n      context.contentKey,\n      cached.contentKey,\n      \"Attachment bindings contain conflicting blob keys\",\n    );\n    return cached.contentKey;\n  };\n}\n"]}

package/workflows/blobs/verification/retainedAttachmentVerification.js

@@ -0,0 +1,40 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { assertBlobContentKeyBundleTargetHash } from "../../../data/documents/blob/shared/responses.js";
+import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
+import { assertAttachmentBindingVerified } from "./attachmentBindingVerification.js";
+import { assertBlobWrapScopeVerified } from "./verifiedWrapScope.js";
+/** Retaining an existing envelope does not propagate a key to a new recipient. */
+export async function verifyRetainedAttachment(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Retained attachment scope");
+    let authorization;
+    await assertDocumentWriterProjectionConsistent(input.writerProjection, {
+        allowStaleContentKeyBundle: true,
+        ...projectionVerificationOptions({
+            execSql: input.execSql,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+            resolveProjectionUserKey,
+        }),
+        onVerifiedAuthorization: (value) => {
+            authorization = value;
+        },
+    });
+    if (input.binding.contentKeyBundle.blobId !== input.binding.blobId)
+        throw new KeyingVerificationError("object_mismatch", "Retained attachment bundle names another blob");
+    await assertBlobContentKeyBundleTargetHash(input.binding.contentKeyBundle);
+    await assertAttachmentBindingVerified({
+        ...input,
+        authorization,
+        resolveProjectionUserKey,
+    });
+    if (!authorization)
+        throw new Error("Attachment authority is unavailable");
+    assertBlobWrapScopeVerified({
+        authorization,
+        binding: input.binding,
+        documentId: input.expectedDocumentId,
+    });
+}
+//# sourceMappingURL=retainedAttachmentVerification.js.map

package/workflows/blobs/verification/retainedAttachmentVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainedAttachmentVerification.js","sourceRoot":"","sources":["retainedAttachmentVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AAErG,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAEL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAGC;IAED,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,2BAA2B,CAC5B,CAAC;IACF,IAAI,aAAgE,CAAC;IACrE,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,0BAA0B,EAAE,IAAI;QAChC,GAAG,6BAA6B,CAAC;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,wBAAwB;SACzB,CAAC;QACF,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAChE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,MAAM,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,MAAM,+BAA+B,CAAC;QACpC,GAAG,KAAK;QACR,aAAa;QACb,wBAAwB;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,2BAA2B,CAAC;QAC1B,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../../data/documents/blob/shared/responses\";\nimport type { DecryptDocumentAttachmentBlobInput } from \"../../../data/documents/blob/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport { assertAttachmentBindingVerified } from \"./attachmentBindingVerification\";\nimport { assertBlobWrapScopeVerified } from \"./verifiedWrapScope\";\n\n/** Retaining an existing envelope does not propagate a key to a new recipient. */\nexport async function verifyRetainedAttachment(\n  input: Omit<\n    DecryptDocumentAttachmentBlobInput,\n    \"encryptedBytes\" | \"targetSecretKey\"\n  >,\n): Promise<void> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Retained attachment scope\",\n  );\n  let authorization: DocumentWriterProjectionAuthorization | undefined;\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    allowStaleContentKeyBundle: true,\n    ...projectionVerificationOptions({\n      execSql: input.execSql,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      resolveProjectionUserKey,\n    }),\n    onVerifiedAuthorization: (value) => {\n      authorization = value;\n    },\n  });\n  if (input.binding.contentKeyBundle.blobId !== input.binding.blobId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retained attachment bundle names another blob\",\n    );\n  await assertBlobContentKeyBundleTargetHash(input.binding.contentKeyBundle);\n  await assertAttachmentBindingVerified({\n    ...input,\n    authorization,\n    resolveProjectionUserKey,\n  });\n  if (!authorization) throw new Error(\"Attachment authority is unavailable\");\n  assertBlobWrapScopeVerified({\n    authorization,\n    binding: input.binding,\n    documentId: input.expectedDocumentId,\n  });\n}\n"]}

package/workflows/blobs/verification/verifiedWrapScope.js

@@ -0,0 +1,20 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+/** A retained wrap must name a KEK committed by verified container history. */
+export function assertBlobWrapScopeVerified(input) {
+    const targets = input.binding.contentKeyBundle.targets.filter((target) => target.bindingId === input.binding.bindingId &&
+        target.documentId === input.documentId);
+    if (targets.length === 0)
+        throw new KeyingVerificationError("object_mismatch", "Blob bundle lacks its attachment target");
+    for (const target of targets) {
+        const path = input.authorization.containerPathByManifestHash.get(target.containerManifestHash);
+        const manifest = path?.at(-1);
+        if (!manifest)
+            throw new ProjectionDependencyUnavailableError("Blob wrapped-target manifest is unavailable");
+        if (manifest.state.containerId !== target.containerId ||
+            manifest.state.containerKeyEpochId !== target.containerKeyEpochId) {
+            throw new KeyingVerificationError("object_mismatch", "Blob wrapped target differs from verified container history");
+        }
+    }
+}
+//# sourceMappingURL=verifiedWrapScope.js.map

package/workflows/blobs/verification/verifiedWrapScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedWrapScope.js","sourceRoot":"","sources":["verifiedWrapScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AAExH,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;QAC5C,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACzC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yCAAyC,CAC1C,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,GAAG,CAC9D,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,oCAAoC,CAC5C,6CAA6C,CAC9C,CAAC;QACJ,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACjD,QAAQ,CAAC,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,EACjE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { BlobAttachmentSummary } from \"@tearleads/validators/response\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\n\n/** A retained wrap must name a KEK committed by verified container history. */\nexport function assertBlobWrapScopeVerified(input: {\n  authorization: DocumentWriterProjectionAuthorization;\n  binding: BlobAttachmentSummary;\n  documentId: string;\n}): void {\n  const targets = input.binding.contentKeyBundle.targets.filter(\n    (target) =>\n      target.bindingId === input.binding.bindingId &&\n      target.documentId === input.documentId,\n  );\n  if (targets.length === 0)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Blob bundle lacks its attachment target\",\n    );\n  for (const target of targets) {\n    const path = input.authorization.containerPathByManifestHash.get(\n      target.containerManifestHash,\n    );\n    const manifest = path?.at(-1);\n    if (!manifest)\n      throw new ProjectionDependencyUnavailableError(\n        \"Blob wrapped-target manifest is unavailable\",\n      );\n    if (\n      manifest.state.containerId !== target.containerId ||\n      manifest.state.containerKeyEpochId !== target.containerKeyEpochId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Blob wrapped target differs from verified container history\",\n      );\n    }\n  }\n}\n"]}