@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/blobs/hydration/hydrate.js

@@ -0,0 +1,190 @@
+import { bytesToHex } from "../../../internal/crypto/index.js";
+import { runBlobTransfer } from "../../../data/blobs/transferPool.js";
+import { attachmentContentSha256 } from "../../../data/documents/attachmentContentIdentity.js";
+import { errorMessage } from "../../../data/shared/errorMessage.js";
+import { createAttachmentDecryptor } from "../verification/attachmentDecryptor.js";
+import { collectHydrationResults } from "./hydrationResults.js";
+import { readAttachmentTransfer } from "./readAttachmentTransfer.js";
+function servedBindingRejectionKey(attachment, binding) {
+    return JSON.stringify([
+        attachment.slotId,
+        binding.bindingId,
+        attachment.contentSha256,
+    ]);
+}
+async function hasExpectedBlobSha256(blob, encryptedBytes) {
+    const blobDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", encryptedBytes));
+    return bytesToHex(blobDigest) === blob.sha256;
+}
+function shouldHydrateAttachment(input) {
+    const slotId = input.attachment.slotId;
+    const localStorageKey = input.localStorageKeyBySlotId?.[slotId];
+    // An empty slot always hydrates: a rejection only ever protected a held
+    // copy, so once that copy is gone the served binding is shown (flagged).
+    if (!localStorageKey) {
+        return true;
+    }
+    if (input.rejectedServedBindings?.has(servedBindingRejectionKey(input.attachment, input.binding))) {
+        return false;
+    }
+    const localBlobId = input.localBlobIdBySlotId?.[slotId];
+    return localBlobId !== null && localBlobId !== input.binding.blobId;
+}
+async function loadDocumentAttachmentBlob(input) {
+    const { apiClient, binding, log } = input;
+    const logPrefix = input.logPrefix ?? "Documents";
+    if (input.stillCurrent?.() === false)
+        return null;
+    input.signal.throwIfAborted();
+    const blob = await apiClient.getBlobBytes(binding.blobId, {
+        signal: input.signal,
+    });
+    if (!blob) {
+        return null;
+    }
+    let encryptedBytes;
+    try {
+        encryptedBytes = await readAttachmentTransfer(blob, input.signal, input.progress);
+    }
+    catch (error) {
+        log?.(`${logPrefix}: blob ${binding.blobId} failed to stream during hydration: ${errorMessage(error)}`);
+        return null;
+    }
+    if (encryptedBytes.byteLength !== blob.byteLength) {
+        log?.(`${logPrefix}: blob ${binding.blobId} byte length mismatch during hydration.`);
+        return null;
+    }
+    if (!(await hasExpectedBlobSha256(blob, encryptedBytes))) {
+        log?.(`${logPrefix}: blob ${binding.blobId} sha256 mismatch during hydration.`);
+        return null;
+    }
+    input.signal.throwIfAborted();
+    return {
+        blobId: binding.blobId,
+        encryptedBytes,
+    };
+}
+async function loadUniqueDocumentAttachmentBlobs(input) {
+    const targetsByBlobId = new Map();
+    for (const target of input.hydrationTargets) {
+        if (!targetsByBlobId.has(target.binding.blobId)) {
+            targetsByBlobId.set(target.binding.blobId, target);
+        }
+    }
+    const loadedBlobs = await collectHydrationResults({
+        ...input,
+        tasks: Array.from(targetsByBlobId.values()).map((target) => ({
+            blobId: target.binding.blobId,
+            run: () => runBlobTransfer(input.apiClient, (signal, progress) => loadDocumentAttachmentBlob({
+                ...input,
+                binding: target.binding,
+                signal,
+                progress,
+            })),
+        })),
+    });
+    return new Map(loadedBlobs.flatMap((loaded) => loaded ? [[loaded.blobId, loaded]] : []));
+}
+function applyLoadedBlobBytesToHydrationTargets(hydrationTargets, loadedBlobsByBlobId) {
+    return hydrationTargets.flatMap((target) => {
+        const loaded = loadedBlobsByBlobId.get(target.binding.blobId);
+        return loaded
+            ? [
+                {
+                    ...target,
+                    encryptedBytes: loaded.encryptedBytes,
+                },
+            ]
+            : [];
+    });
+}
+async function decryptLoadedDocumentAttachmentBlob(input) {
+    const bytes = await input.decryptAttachment({
+        binding: input.loaded.binding,
+        encryptedBytes: input.loaded.encryptedBytes,
+        expectedDocumentId: input.documentId,
+        expectedSlotId: input.loaded.attachment.slotId,
+        execSql: input.execSql,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        targetSecretKey: input.targetSecretKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        writerProjection: input.writerProjection,
+    });
+    const { attachment, binding } = input.loaded;
+    const contentSha256 = await attachmentContentSha256(bytes);
+    const intentMismatch = contentSha256 !== attachment.contentSha256;
+    const logPrefix = input.logPrefix ?? "Documents";
+    if (intentMismatch && input.localStorageKeyBySlotId?.[attachment.slotId]) {
+        // Never replace a held copy with bytes the document does not record.
+        input.rejectedServedBindings?.add(servedBindingRejectionKey(attachment, binding));
+        input.log?.(`${logPrefix}: served attachment bytes differ from the current document content; keeping the held copy.`);
+        return null;
+    }
+    if (intentMismatch) {
+        input.log?.(`${logPrefix}: served attachment bytes differ from the current document content; showing them flagged.`);
+    }
+    return {
+        attachment,
+        binding,
+        bytes,
+        contentSha256,
+        intentMismatch,
+        storageKey: `blob-${binding.blobId}`,
+    };
+}
+export async function hydrateDocumentAttachmentBlobs(input) {
+    const attachmentBindings = await input.apiClient.listDocumentAttachments(input.documentId);
+    if (!attachmentBindings) {
+        return null;
+    }
+    const bindingBySlotId = new Map(attachmentBindings.map((binding) => [binding.slotId, binding]));
+    const hydrationTargets = input.attachments.flatMap((attachment) => {
+        const binding = bindingBySlotId.get(attachment.slotId);
+        return binding &&
+            shouldHydrateAttachment({
+                attachment,
+                binding,
+                localBlobIdBySlotId: input.localBlobIdBySlotId,
+                localStorageKeyBySlotId: input.localStorageKeyBySlotId,
+                rejectedServedBindings: input.rejectedServedBindings,
+            })
+            ? [{ attachment, binding }]
+            : [];
+    });
+    if (hydrationTargets.length === 0) {
+        input.onBindingsChecked?.();
+        return [];
+    }
+    const loadedBlobs = applyLoadedBlobBytesToHydrationTargets(hydrationTargets, await loadUniqueDocumentAttachmentBlobs({
+        ...input,
+        hydrationTargets,
+    }));
+    if (loadedBlobs.length === 0) {
+        return [];
+    }
+    const writerProjection = await input.apiClient.getDocumentWriterProjection(input.documentId);
+    if (!writerProjection) {
+        const logPrefix = input.logPrefix ?? "Documents";
+        input.log?.(`${logPrefix}: cannot hydrate attachments for document ${input.documentId} without a writer projection.`);
+        return [];
+    }
+    const decryptAttachment = createAttachmentDecryptor(input.apiClient, input.documentId);
+    const hydrated = await collectHydrationResults({
+        ...input,
+        tasks: loadedBlobs.map((loaded) => ({
+            blobId: loaded.binding.blobId,
+            run: () => decryptLoadedDocumentAttachmentBlob({
+                ...input,
+                decryptAttachment,
+                loaded,
+                writerProjection,
+            }),
+        })),
+    });
+    const complete = hydrated.filter((item) => item !== null);
+    if (complete.length === hydrationTargets.length)
+        input.onBindingsChecked?.();
+    return complete;
+}
+//# sourceMappingURL=hydrate.js.map

package/workflows/blobs/hydration/hydrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydrate.js","sourceRoot":"","sources":["hydrate.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAM5F,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAyDlE,SAAS,yBAAyB,CAChC,UAA8B,EAC9B,OAA8B;IAE9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,CAAC,MAAM;QACjB,OAAO,CAAC,SAAS;QACjB,UAAU,CAAC,aAAa;KACzB,CAAC,CAAC;AACL,CAAC;AAiBD,KAAK,UAAU,qBAAqB,CAClC,IAAuB,EACvB,cAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CACtD,CAAC;IAEF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAUhC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAC/B,yBAAyB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAC3D,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAIC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,sBAAsB,CAC3C,IAAI,EACJ,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,CACf,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,uCAAuC,YAAY,CACrF,KAAK,CACN,EAAE,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,yCAAyC,CAC9E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,EAAE,CACH,GAAG,SAAS,UAAU,OAAO,CAAC,MAAM,oCAAoC,CACzE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAEC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC7E,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CACpD,0BAA0B,CAAC;gBACzB,GAAG,KAAK;gBACR,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM;gBACN,QAAQ;aACT,CAAC,CACH;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,IAAI,GAAG,CACZ,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,gBAAkE,EAClE,mBAA2E;IAE3E,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM;YACX,CAAC,CAAC;gBACE;oBACE,GAAG,MAAM;oBACT,cAAc,EAAE,MAAM,CAAC,cAAc;iBACtC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mCAAmC,CAChD,KAIC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC7B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,kBAAkB,EAAE,KAAK,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,aAAa,KAAK,UAAU,CAAC,aAAa,CAAC;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,IAAI,cAAc,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,qEAAqE;QACrE,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAC/B,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAC/C,CAAC;QACF,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,4FAA4F,CACzG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,2FAA2F,CACxG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,OAAO;QACP,KAAK;QACL,aAAa;QACb,cAAc;QACd,UAAU,EAAE,QAAQ,OAAO,CAAC,MAAM,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAIC;IAED,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CACtE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC/D,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,OAAO;YACZ,uBAAuB,CAAC;gBACtB,UAAU;gBACV,OAAO;gBACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;gBACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;aACrD,CAAC;YACF,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACL,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,sCAAsC,CACxD,gBAAgB,EAChB,MAAM,iCAAiC,CAAC;QACtC,GAAG,KAAK;QACR,gBAAgB;KACjB,CAAC,CACH,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,2BAA2B,CACxE,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;QACjD,KAAK,CAAC,GAAG,EAAE,CACT,GAAG,SAAS,6CAA6C,KAAK,CAAC,UAAU,+BAA+B,CACzG,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,GAAG,KAAK;QACR,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,mCAAmC,CAAC;gBAClC,GAAG,KAAK;gBACR,iBAAiB;gBACjB,MAAM;gBACN,gBAAgB;aACjB,CAAC;SACL,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,IAAI,CAChE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;QAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type {\n  BlobBytesResponse,\n  RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport { bytesToHex } from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentSummary,\n  DocumentWriterProjectionResponse,\n  ListDocumentAttachmentsResponse,\n} from \"@tearleads/validators/response\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport { runBlobTransfer } from \"../../../data/blobs/transferPool\";\nimport { attachmentContentSha256 } from \"../../../data/documents/attachmentContentIdentity\";\nimport type { DocumentAttachment } from \"../../../data/documents/documentContent\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { createAttachmentDecryptor } from \"../verification/attachmentDecryptor\";\nimport { collectHydrationResults } from \"./hydrationResults\";\nimport { readAttachmentTransfer } from \"./readAttachmentTransfer\";\n\ninterface DocumentAttachmentHydrationApi {\n  evictDocumentWriterProjection?(documentId: string): void;\n  getBlobBytes(\n    blobId: string,\n    options?: RequestResultOptions,\n  ): Promise<BlobBytesResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  listDocumentAttachments(\n    documentId: string,\n  ): Promise<ListDocumentAttachmentsResponse | null>;\n}\n\ninterface HydratedDocumentAttachmentBlob {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n  bytes: BlobBytes;\n  /** Plaintext digest of `bytes`. */\n  contentSha256: string;\n  /**\n   * The served binding is validly signed but its plaintext digest differs\n   * from the digest the document content records for the slot. Set only when\n   * the slot held no local bytes: the bind and the content update carrying\n   * its digest are two server writes, and an uploader lost between them must\n   * not leave the attachment permanently invisible. Never a security incident;\n   * an honest crash window is indistinguishable from a served rollback.\n   */\n  intentMismatch: boolean;\n  storageKey: string;\n}\n\ninterface DocumentAttachmentHydrationContext {\n  apiClient: DocumentAttachmentHydrationApi;\n  documentId: string;\n  execSql: ExecSql;\n  localBlobIdBySlotId?:\n    | Readonly<Record<string, string | null | undefined>>\n    | undefined;\n  localStorageKeyBySlotId?: Readonly<Record<string, string | undefined>>;\n  log?: ((message: string) => void) | undefined;\n  logPrefix?: string | undefined;\n  /**\n   * Served bindings already downloaded and refused for a held copy, keyed per\n   * (slot, binding, intent). Populated here; a later pass skips the download\n   * until the binding or the document intent changes.\n   */\n  rejectedServedBindings?: Set<string> | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  targetSecretKey: Uint8Array;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nfunction servedBindingRejectionKey(\n  attachment: DocumentAttachment,\n  binding: BlobAttachmentSummary,\n): string {\n  return JSON.stringify([\n    attachment.slotId,\n    binding.bindingId,\n    attachment.contentSha256,\n  ]);\n}\n\ninterface DocumentAttachmentHydrationTarget {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n}\n\ninterface LoadedDocumentAttachmentBlob\n  extends DocumentAttachmentHydrationTarget {\n  encryptedBytes: Uint8Array<ArrayBuffer>;\n}\n\ninterface LoadedDocumentAttachmentBlobBytes {\n  blobId: string;\n  encryptedBytes: Uint8Array<ArrayBuffer>;\n}\n\nasync function hasExpectedBlobSha256(\n  blob: BlobBytesResponse,\n  encryptedBytes: Uint8Array<ArrayBuffer>,\n): Promise<boolean> {\n  const blobDigest = new Uint8Array(\n    await crypto.subtle.digest(\"SHA-256\", encryptedBytes),\n  );\n\n  return bytesToHex(blobDigest) === blob.sha256;\n}\n\nfunction shouldHydrateAttachment(input: {\n  attachment: DocumentAttachment;\n  binding: BlobAttachmentSummary;\n  localBlobIdBySlotId:\n    | Readonly<Record<string, string | null | undefined>>\n    | undefined;\n  localStorageKeyBySlotId:\n    | Readonly<Record<string, string | undefined>>\n    | undefined;\n  rejectedServedBindings: ReadonlySet<string> | undefined;\n}): boolean {\n  const slotId = input.attachment.slotId;\n  const localStorageKey = input.localStorageKeyBySlotId?.[slotId];\n  // An empty slot always hydrates: a rejection only ever protected a held\n  // copy, so once that copy is gone the served binding is shown (flagged).\n  if (!localStorageKey) {\n    return true;\n  }\n  if (\n    input.rejectedServedBindings?.has(\n      servedBindingRejectionKey(input.attachment, input.binding),\n    )\n  ) {\n    return false;\n  }\n\n  const localBlobId = input.localBlobIdBySlotId?.[slotId];\n  return localBlobId !== null && localBlobId !== input.binding.blobId;\n}\n\nasync function loadDocumentAttachmentBlob(\n  input: DocumentAttachmentHydrationContext & {\n    binding: BlobAttachmentSummary;\n    signal: AbortSignal;\n    progress: () => void;\n  },\n): Promise<LoadedDocumentAttachmentBlobBytes | null> {\n  const { apiClient, binding, log } = input;\n  const logPrefix = input.logPrefix ?? \"Documents\";\n  if (input.stillCurrent?.() === false) return null;\n  input.signal.throwIfAborted();\n  const blob = await apiClient.getBlobBytes(binding.blobId, {\n    signal: input.signal,\n  });\n  if (!blob) {\n    return null;\n  }\n\n  let encryptedBytes: Uint8Array<ArrayBuffer>;\n  try {\n    encryptedBytes = await readAttachmentTransfer(\n      blob,\n      input.signal,\n      input.progress,\n    );\n  } catch (error) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} failed to stream during hydration: ${errorMessage(\n        error,\n      )}`,\n    );\n    return null;\n  }\n\n  if (encryptedBytes.byteLength !== blob.byteLength) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} byte length mismatch during hydration.`,\n    );\n    return null;\n  }\n\n  if (!(await hasExpectedBlobSha256(blob, encryptedBytes))) {\n    log?.(\n      `${logPrefix}: blob ${binding.blobId} sha256 mismatch during hydration.`,\n    );\n    return null;\n  }\n\n  input.signal.throwIfAborted();\n  return {\n    blobId: binding.blobId,\n    encryptedBytes,\n  };\n}\n\nasync function loadUniqueDocumentAttachmentBlobs(\n  input: DocumentAttachmentHydrationContext & {\n    hydrationTargets: ReadonlyArray<DocumentAttachmentHydrationTarget>;\n  },\n): Promise<ReadonlyMap<string, LoadedDocumentAttachmentBlobBytes>> {\n  const targetsByBlobId = new Map<string, DocumentAttachmentHydrationTarget>();\n  for (const target of input.hydrationTargets) {\n    if (!targetsByBlobId.has(target.binding.blobId)) {\n      targetsByBlobId.set(target.binding.blobId, target);\n    }\n  }\n\n  const loadedBlobs = await collectHydrationResults({\n    ...input,\n    tasks: Array.from(targetsByBlobId.values()).map((target) => ({\n      blobId: target.binding.blobId,\n      run: () =>\n        runBlobTransfer(input.apiClient, (signal, progress) =>\n          loadDocumentAttachmentBlob({\n            ...input,\n            binding: target.binding,\n            signal,\n            progress,\n          }),\n        ),\n    })),\n  });\n\n  return new Map(\n    loadedBlobs.flatMap((loaded) =>\n      loaded ? [[loaded.blobId, loaded] as const] : [],\n    ),\n  );\n}\n\nfunction applyLoadedBlobBytesToHydrationTargets(\n  hydrationTargets: ReadonlyArray<DocumentAttachmentHydrationTarget>,\n  loadedBlobsByBlobId: ReadonlyMap<string, LoadedDocumentAttachmentBlobBytes>,\n): LoadedDocumentAttachmentBlob[] {\n  return hydrationTargets.flatMap((target) => {\n    const loaded = loadedBlobsByBlobId.get(target.binding.blobId);\n    return loaded\n      ? [\n          {\n            ...target,\n            encryptedBytes: loaded.encryptedBytes,\n          },\n        ]\n      : [];\n  });\n}\n\nasync function decryptLoadedDocumentAttachmentBlob(\n  input: DocumentAttachmentHydrationContext & {\n    loaded: LoadedDocumentAttachmentBlob;\n    decryptAttachment: ReturnType<typeof createAttachmentDecryptor>;\n    writerProjection: DocumentWriterProjectionResponse;\n  },\n): Promise<HydratedDocumentAttachmentBlob | null> {\n  const bytes = await input.decryptAttachment({\n    binding: input.loaded.binding,\n    encryptedBytes: input.loaded.encryptedBytes,\n    expectedDocumentId: input.documentId,\n    expectedSlotId: input.loaded.attachment.slotId,\n    execSql: input.execSql,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    targetSecretKey: input.targetSecretKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    writerProjection: input.writerProjection,\n  });\n\n  const { attachment, binding } = input.loaded;\n  const contentSha256 = await attachmentContentSha256(bytes);\n  const intentMismatch = contentSha256 !== attachment.contentSha256;\n  const logPrefix = input.logPrefix ?? \"Documents\";\n  if (intentMismatch && input.localStorageKeyBySlotId?.[attachment.slotId]) {\n    // Never replace a held copy with bytes the document does not record.\n    input.rejectedServedBindings?.add(\n      servedBindingRejectionKey(attachment, binding),\n    );\n    input.log?.(\n      `${logPrefix}: served attachment bytes differ from the current document content; keeping the held copy.`,\n    );\n    return null;\n  }\n  if (intentMismatch) {\n    input.log?.(\n      `${logPrefix}: served attachment bytes differ from the current document content; showing them flagged.`,\n    );\n  }\n  return {\n    attachment,\n    binding,\n    bytes,\n    contentSha256,\n    intentMismatch,\n    storageKey: `blob-${binding.blobId}`,\n  };\n}\n\nexport async function hydrateDocumentAttachmentBlobs(\n  input: DocumentAttachmentHydrationContext & {\n    attachments: ReadonlyArray<DocumentAttachment>;\n    /** No binding target remains unchecked or unavailable in this pass. */\n    onBindingsChecked?: () => void;\n  },\n): Promise<HydratedDocumentAttachmentBlob[] | null> {\n  const attachmentBindings = await input.apiClient.listDocumentAttachments(\n    input.documentId,\n  );\n  if (!attachmentBindings) {\n    return null;\n  }\n\n  const bindingBySlotId = new Map(\n    attachmentBindings.map((binding) => [binding.slotId, binding]),\n  );\n  const hydrationTargets: DocumentAttachmentHydrationTarget[] =\n    input.attachments.flatMap((attachment) => {\n      const binding = bindingBySlotId.get(attachment.slotId);\n      return binding &&\n        shouldHydrateAttachment({\n          attachment,\n          binding,\n          localBlobIdBySlotId: input.localBlobIdBySlotId,\n          localStorageKeyBySlotId: input.localStorageKeyBySlotId,\n          rejectedServedBindings: input.rejectedServedBindings,\n        })\n        ? [{ attachment, binding }]\n        : [];\n    });\n  if (hydrationTargets.length === 0) {\n    input.onBindingsChecked?.();\n    return [];\n  }\n\n  const loadedBlobs = applyLoadedBlobBytesToHydrationTargets(\n    hydrationTargets,\n    await loadUniqueDocumentAttachmentBlobs({\n      ...input,\n      hydrationTargets,\n    }),\n  );\n  if (loadedBlobs.length === 0) {\n    return [];\n  }\n\n  const writerProjection = await input.apiClient.getDocumentWriterProjection(\n    input.documentId,\n  );\n  if (!writerProjection) {\n    const logPrefix = input.logPrefix ?? \"Documents\";\n    input.log?.(\n      `${logPrefix}: cannot hydrate attachments for document ${input.documentId} without a writer projection.`,\n    );\n    return [];\n  }\n\n  const decryptAttachment = createAttachmentDecryptor(\n    input.apiClient,\n    input.documentId,\n  );\n  const hydrated = await collectHydrationResults({\n    ...input,\n    tasks: loadedBlobs.map((loaded) => ({\n      blobId: loaded.binding.blobId,\n      run: () =>\n        decryptLoadedDocumentAttachmentBlob({\n          ...input,\n          decryptAttachment,\n          loaded,\n          writerProjection,\n        }),\n    })),\n  });\n  const complete = hydrated.filter(\n    (item): item is HydratedDocumentAttachmentBlob => item !== null,\n  );\n  if (complete.length === hydrationTargets.length) input.onBindingsChecked?.();\n  return complete;\n}\n"]}

package/workflows/blobs/hydration/hydrationResults.js

@@ -0,0 +1,23 @@
+import { reportKeyingVerificationErrorInCauseChain, rethrowDatabaseUnavailableError, } from "../../../data/keyingProjectionVerification/error.js";
+import { rethrowProjectionVerificationCancelled } from "../../../data/keyingProjectionVerification/types.js";
+/** One unavailable or invalid attachment does not suppress independent successes. */
+export async function collectHydrationResults(input) {
+    const outcomes = await Promise.allSettled(input.tasks.map((task) => task.run()));
+    const values = [];
+    for (const [index, outcome] of outcomes.entries()) {
+        if (outcome.status === "fulfilled") {
+            values.push(outcome.value);
+            continue;
+        }
+        rethrowDatabaseUnavailableError(outcome.reason);
+        rethrowProjectionVerificationCancelled(outcome.reason);
+        await reportKeyingVerificationErrorInCauseChain(outcome.reason, input.reportSecurityIncident, {
+            operation: "hydrate_attachment",
+            objectKind: "blob",
+            objectId: input.tasks[index]?.blobId ?? null,
+        });
+        input.log?.("Documents: an attachment is unavailable during hydration.");
+    }
+    return values;
+}
+//# sourceMappingURL=hydrationResults.js.map

package/workflows/blobs/hydration/hydrationResults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydrationResults.js","sourceRoot":"","sources":["hydrationResults.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yCAAyC,EACzC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,sCAAsC,EAAE,MAAM,kDAAkD,CAAC;AAG1G,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAI,KAIhD;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CACtC,CAAC;IACF,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,sCAAsC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,yCAAyC,CAC7C,OAAO,CAAC,MAAM,EACd,KAAK,CAAC,sBAAsB,EAC5B;YACE,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI;SAC7C,CACF,CAAC;QACF,KAAK,CAAC,GAAG,EAAE,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  reportKeyingVerificationErrorInCauseChain,\n  rethrowDatabaseUnavailableError,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { rethrowProjectionVerificationCancelled } from \"../../../data/keyingProjectionVerification/types\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\n\n/** One unavailable or invalid attachment does not suppress independent successes. */\nexport async function collectHydrationResults<T>(input: {\n  tasks: readonly { blobId: string; run: () => Promise<T> }[];\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  log?: ((message: string) => void) | undefined;\n}): Promise<T[]> {\n  const outcomes = await Promise.allSettled(\n    input.tasks.map((task) => task.run()),\n  );\n  const values: T[] = [];\n  for (const [index, outcome] of outcomes.entries()) {\n    if (outcome.status === \"fulfilled\") {\n      values.push(outcome.value);\n      continue;\n    }\n    rethrowDatabaseUnavailableError(outcome.reason);\n    rethrowProjectionVerificationCancelled(outcome.reason);\n    await reportKeyingVerificationErrorInCauseChain(\n      outcome.reason,\n      input.reportSecurityIncident,\n      {\n        operation: \"hydrate_attachment\",\n        objectKind: \"blob\",\n        objectId: input.tasks[index]?.blobId ?? null,\n      },\n    );\n    input.log?.(\"Documents: an attachment is unavailable during hydration.\");\n  }\n  return values;\n}\n"]}

package/workflows/blobs/index.d.ts

@@ -6,6 +6,6 @@ export { createEncryptedBlobStore, createLazyEncryptedBlobStore, wrapEncryptedBl
 export { createMemoryBlobStore } from "../../data/blobs/memoryBlobStore.js";
 export { purgeOpfsBlobStore } from "../../data/blobs/opfsBlobStore.js";
 export type { MultipartStageResolvedListener, MultipartUploadProgress, MultipartUploadProgressListener, } from "../../data/documents/blob/shared/types.js";
-export { decryptDocumentAttachmentBlob } from "./decrypt.js";
-export { hydrateDocumentAttachmentBlobs } from "./hydrate.js";
-export { uploadDocumentAttachment } from "./upload.js";
+export { decryptDocumentAttachmentBlob } from "./hydration/decrypt.js";
+export { hydrateDocumentAttachmentBlobs } from "./hydration/hydrate.js";
+export { uploadDocumentAttachment } from "./upload/index.js";

package/workflows/blobs/index.js

@@ -3,7 +3,7 @@ export { createBlobStore } from "../../data/blobs/createBlobStore.js";
 export { createEncryptedBlobStore, createLazyEncryptedBlobStore, wrapEncryptedBlobStore, } from "../../data/blobs/encryptedBlobStore.js";
 export { createMemoryBlobStore } from "../../data/blobs/memoryBlobStore.js";
 export { purgeOpfsBlobStore } from "../../data/blobs/opfsBlobStore.js";
-export { decryptDocumentAttachmentBlob } from "./decrypt.js";
-export { hydrateDocumentAttachmentBlobs } from "./hydrate.js";
-export { uploadDocumentAttachment } from "./upload.js";
+export { decryptDocumentAttachmentBlob } from "./hydration/decrypt.js";
+export { hydrateDocumentAttachmentBlobs } from "./hydration/hydrate.js";
+export { uploadDocumentAttachment } from "./upload/index.js";
 //# sourceMappingURL=index.js.map

package/workflows/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAOnE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAMpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC","sourcesContent":["export type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n} from \"../../data/blobs/blobContracts\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  readBlobByteSource,\n} from \"../../data/blobs/blobContracts\";\nexport { createBlobStore } from \"../../data/blobs/createBlobStore\";\nexport type {\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport {\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  wrapEncryptedBlobStore,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport { createMemoryBlobStore } from \"../../data/blobs/memoryBlobStore\";\nexport { purgeOpfsBlobStore } from \"../../data/blobs/opfsBlobStore\";\nexport type {\n  MultipartStageResolvedListener,\n  MultipartUploadProgress,\n  MultipartUploadProgressListener,\n} from \"../../data/documents/blob/shared/types\";\nexport { decryptDocumentAttachmentBlob } from \"./decrypt\";\nexport { hydrateDocumentAttachmentBlobs } from \"./hydrate\";\nexport { uploadDocumentAttachment } from \"./upload\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAOnE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAMpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC","sourcesContent":["export type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n} from \"../../data/blobs/blobContracts\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  readBlobByteSource,\n} from \"../../data/blobs/blobContracts\";\nexport { createBlobStore } from \"../../data/blobs/createBlobStore\";\nexport type {\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport {\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  wrapEncryptedBlobStore,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport { createMemoryBlobStore } from \"../../data/blobs/memoryBlobStore\";\nexport { purgeOpfsBlobStore } from \"../../data/blobs/opfsBlobStore\";\nexport type {\n  MultipartStageResolvedListener,\n  MultipartUploadProgress,\n  MultipartUploadProgressListener,\n} from \"../../data/documents/blob/shared/types\";\nexport { decryptDocumentAttachmentBlob } from \"./hydration/decrypt\";\nexport { hydrateDocumentAttachmentBlobs } from \"./hydration/hydrate\";\nexport { uploadDocumentAttachment } from \"./upload\";\n"]}

package/workflows/blobs/upload/automaticMultipartUpload.js

@@ -0,0 +1,9 @@
+import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from "../../../data/documents/blob/shared/crypto.js";
+export function resolveMultipartUploadOptions(multipart) {
+    const resolved = multipart ?? { partSize: DEFAULT_BLOB_CHUNK_SIZE_BYTES };
+    if (resolved.partSize !== DEFAULT_BLOB_CHUNK_SIZE_BYTES) {
+        throw new Error("Multipart blob chunk size must be exactly 5 MiB");
+    }
+    return resolved;
+}
+//# sourceMappingURL=automaticMultipartUpload.js.map

package/workflows/blobs/upload/automaticMultipartUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automaticMultipartUpload.js","sourceRoot":"","sources":["automaticMultipartUpload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAG3F,MAAM,UAAU,6BAA6B,CAC3C,SAAqD;IAErD,MAAM,QAAQ,GAAG,SAAS,IAAI,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,6BAA6B,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from \"../../../data/documents/blob/shared/crypto\";\nimport type { UploadDocumentAttachmentInput } from \"../../../data/documents/blob/shared/types\";\n\nexport function resolveMultipartUploadOptions(\n  multipart: UploadDocumentAttachmentInput[\"multipart\"],\n): NonNullable<UploadDocumentAttachmentInput[\"multipart\"]> {\n  const resolved = multipart ?? { partSize: DEFAULT_BLOB_CHUNK_SIZE_BYTES };\n  if (resolved.partSize !== DEFAULT_BLOB_CHUNK_SIZE_BYTES) {\n    throw new Error(\"Multipart blob chunk size must be exactly 5 MiB\");\n  }\n  return resolved;\n}\n"]}

package/workflows/blobs/upload/index.d.ts

@@ -0,0 +1,10 @@
+import type { BlobSourceSnapshot } from "../../../data/documents/blob/shared/blobSourceSnapshot.js";
+import type { UploadDocumentAttachmentInput, UploadDocumentAttachmentResult } from "../../../data/documents/blob/shared/types.js";
+interface PreparedUploadDocumentAttachmentInput extends UploadDocumentAttachmentInput {
+    readonly sourceSnapshot?: BlobSourceSnapshot | undefined;
+    readonly onStageUnavailable?: ((stageId: string) => Promise<void>) | undefined;
+}
+export declare function uploadDocumentAttachment(input: UploadDocumentAttachmentInput): Promise<UploadDocumentAttachmentResult | null>;
+/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */
+export declare function uploadPreparedDocumentAttachment(input: PreparedUploadDocumentAttachmentInput): Promise<UploadDocumentAttachmentResult | null>;
+export {};

package/workflows/blobs/upload/index.js

@@ -0,0 +1,243 @@
+import { computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, } from "../../../internal/crypto/index.js";
+import { createBlobByteSource, } from "../../../data/blobs/blobContracts.js";
+import { prepareBlobEncryption } from "../../../data/documents/blob/shared/crypto.js";
+import { signBlobAttachmentEvent, signBlobAttachmentWriteHeader, } from "../../../data/documents/blob/shared/events.js";
+import { verifiedBlobWrapTargetsFromDocumentProjection, wrapBlobContentKey, } from "../../../data/documents/blob/shared/projection.js";
+import { assertBlobAttachmentBindResponse } from "../../../data/documents/blob/shared/responses.js";
+import { authorizingContainerPathRefs } from "../../../data/documents/shared/projection.js";
+import { uniqueSortedStrings } from "../../../data/documents/shared/readers.js";
+import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+import { requireProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/index.js";
+import { shouldRetryWithFreshProjection } from "../../documents/syncFailures/syncFailureClassification.js";
+import { resolveBlobMutationWriterProjection } from "../verification/writerProjection.js";
+import { resolveMultipartUploadOptions } from "./automaticMultipartUpload.js";
+import { stageMultipartBlobAttachment } from "./multipartUpload.js";
+async function buildBlobAttachmentMaterial(input) {
+    const resolved = await resolveBlobMutationWriterProjection({
+        apiClient: input.apiClient,
+        documentId: input.documentId,
+        errorLabel: "Blob attachment",
+        execSql: input.execSql,
+        isRemoteSyncBlocked: input.isRemoteSyncBlocked,
+        writerProjection: input.writerProjection,
+        ...projectionVerificationOptions(input),
+    });
+    if (!resolved) {
+        return null;
+    }
+    const { manifestIdentity, writerProjection } = resolved;
+    const targets = verifiedBlobWrapTargetsFromDocumentProjection({
+        bindingId: input.bindingId,
+        documentId: input.documentId,
+        writerProjection,
+    });
+    const targetHash = await computeBlobContentKeyTargetHash(targets);
+    const contentKeyBundle = {
+        contentKeyEpoch: input.contentKeyEpoch,
+        targetHash,
+        targets: await wrapBlobContentKey({
+            blobId: input.blobId,
+            contentKey: input.contentKey,
+            contentKeyEpoch: input.contentKeyEpoch,
+            execSql: input.execSql,
+            secretKey: input.targetSecretKey,
+            targets,
+            writerProjection,
+            ...projectionVerificationOptions(input),
+        }),
+    };
+    const encrypted = await prepareBlobEncryption({
+        blobId: input.blobId,
+        chunkSize: input.partSize,
+        contentKey: input.contentKey,
+        contentKeyBundle,
+        nonceSeed: input.nonceSeed,
+        organizationId: manifestIdentity.organizationId,
+        source: input.source,
+        sourceSnapshot: input.sourceSnapshot,
+    });
+    const blobAccessManifestHash = await computeBlobAccessManifestHash({
+        version: 1,
+        blobId: input.blobId,
+        organizationId: manifestIdentity.organizationId,
+        activeBindingIds: [input.bindingId],
+        documentManifestHashes: [manifestIdentity.manifestHash],
+        linkedContainerManifestHashes: uniqueSortedStrings(targets.map((target) => target.containerManifestHash)),
+        linkedContainerKeyEpochIds: uniqueSortedStrings(targets.map((target) => target.containerKeyEpochId)),
+        blobKeyTargetHash: targetHash,
+    });
+    return {
+        blobAccessManifestHash,
+        contentKeyBundle,
+        encrypted,
+        manifestIdentity,
+        targetHash,
+        targets,
+        writerProjection,
+    };
+}
+function blobAttachmentBindRequest(input) {
+    return {
+        event: readCanonicalRecord(input.event, "Blob attachment bind event"),
+        body: readCanonicalRecord(input.body, "Blob attachment bind body"),
+        authorizingContainerPathRefs: authorizingContainerPathRefs(input.material.writerProjection),
+        contentKeyBundle: input.material.contentKeyBundle,
+        stagedBlob: {
+            stageId: input.stageId,
+            writeHeader: readCanonicalRecord(input.writeHeader, "Blob attachment write header"),
+        },
+    };
+}
+async function stageAndBindBlobAttachment(input) {
+    const { body, event } = await signBlobAttachmentEvent({
+        author: input.author,
+        bindingId: input.bindingId,
+        blobId: input.blobId,
+        documentId: input.documentId,
+        eventId: input.eventId,
+        expectedBindingId: input.expectedBindingId,
+        manifestIdentity: input.material.manifestIdentity,
+        signedAt: input.signedAt,
+        slotId: input.slotId,
+        authorizingContainerPathRefs: authorizingContainerPathRefs(input.material.writerProjection),
+    });
+    const { writeHeader, writeHeaderHash } = await signBlobAttachmentWriteHeader({
+        authorizingContainerPathRefs: authorizingContainerPathRefs(input.material.writerProjection),
+        author: input.author,
+        blobAccessManifestHash: input.material.blobAccessManifestHash,
+        blobId: input.blobId,
+        contentKeyEpoch: input.contentKeyEpoch,
+        encrypted: input.material.encrypted,
+        manifestIdentity: input.material.manifestIdentity,
+        signedAt: input.signedAt,
+        targetHash: input.material.targetHash,
+    });
+    const stageId = await stageMultipartBlobAttachment({
+        organizationId: input.material.manifestIdentity.organizationId,
+        apiClient: input.apiClient,
+        encryption: input.material.encrypted,
+        multipart: input.multipart,
+        onMultipartProgress: input.onMultipartProgress,
+        onStageResolved: input.onStageResolved,
+        onStageUnavailable: input.onStageUnavailable,
+    });
+    if (!stageId) {
+        return null;
+    }
+    const request = blobAttachmentBindRequest({
+        body,
+        event,
+        material: input.material,
+        stageId,
+        writeHeader,
+    });
+    const response = await input.apiClient.bindBlobAttachment(input.blobId, request, {
+        expectedPaymentRequiredOrganizationId: input.material.manifestIdentity.organizationId,
+    });
+    if (!response) {
+        return null;
+    }
+    await assertBlobAttachmentBindResponse({
+        body,
+        bindingId: input.bindingId,
+        blobAccessManifestHash: input.material.blobAccessManifestHash,
+        blobId: input.blobId,
+        contentKeyBundle: input.material.contentKeyBundle,
+        documentId: input.documentId,
+        event,
+        manifestIdentity: input.material.manifestIdentity,
+        response,
+        slotId: input.slotId,
+        targetHash: input.material.targetHash,
+        targets: input.material.targets,
+        writeHeader,
+        writeHeaderHash,
+    });
+    return {
+        request,
+        response,
+        sha256: input.material.encrypted.sha256,
+        byteLength: input.material.encrypted.byteLength,
+        writeHeader,
+        writeHeaderHash,
+    };
+}
+async function uploadDocumentAttachmentImpl({ apiClient, author, blobId = crypto.randomUUID(), bindingId = crypto.randomUUID(), bytes, contentKey = crypto.getRandomValues(new Uint8Array(32)), contentKeyEpoch = 1, documentId, eventId = crypto.randomUUID(), execSql, expectedBindingId, isRemoteSyncBlocked, nonceSeed, multipart, onMultipartProgress, onStageResolved, onStageUnavailable, resolveProjectionUserKey, signedAt = new Date().toISOString(), slotId, sourceSnapshot, targetSecretKey, warmReferencedPrincipalPolicies, writerProjection, }) {
+    if (contentKey.byteLength !== 32) {
+        throw new Error("Blob content key must be 32 bytes");
+    }
+    const resolveProjectionUserKeyForUpload = requireProjectionUserKeyResolver(resolveProjectionUserKey, "Document attachment upload");
+    const resolvedMultipart = resolveMultipartUploadOptions(multipart);
+    const source = createBlobByteSource(bytes);
+    const buildMaterial = (freshWriterProjection) => buildBlobAttachmentMaterial({
+        apiClient,
+        bindingId,
+        blobId,
+        contentKey,
+        contentKeyEpoch,
+        documentId,
+        execSql,
+        isRemoteSyncBlocked,
+        nonceSeed,
+        partSize: resolvedMultipart.partSize,
+        resolveProjectionUserKey: resolveProjectionUserKeyForUpload,
+        source,
+        sourceSnapshot,
+        targetSecretKey,
+        warmReferencedPrincipalPolicies,
+        writerProjection: freshWriterProjection,
+    });
+    let material;
+    try {
+        material = await buildMaterial(writerProjection);
+    }
+    catch (error) {
+        if (!apiClient.evictDocumentWriterProjection ||
+            !shouldRetryWithFreshProjection(error, (message) => message.startsWith("Container writer projection KEK") &&
+                message.includes("could not be unwrapped"))) {
+            throw error;
+        }
+        // The attachment binds to this document; only its projection was stale, so
+        // evict just it rather than wiping the whole projection cache.
+        apiClient.evictDocumentWriterProjection(documentId);
+        material = await buildMaterial(undefined);
+    }
+    if (!material) {
+        return null;
+    }
+    const result = await stageAndBindBlobAttachment({
+        apiClient,
+        author,
+        bindingId,
+        blobId,
+        contentKeyEpoch,
+        documentId,
+        eventId,
+        expectedBindingId,
+        material,
+        multipart: resolvedMultipart,
+        onMultipartProgress,
+        onStageResolved,
+        onStageUnavailable,
+        signedAt,
+        slotId,
+    });
+    if (!result) {
+        return null;
+    }
+    return {
+        blobId,
+        bindingId,
+        writerProjection: material.writerProjection,
+        ...result,
+    };
+}
+export function uploadDocumentAttachment(input) {
+    return uploadDocumentAttachmentImpl({ ...input, sourceSnapshot: undefined });
+}
+/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */
+export function uploadPreparedDocumentAttachment(input) {
+    return uploadDocumentAttachmentImpl(input);
+}
+//# sourceMappingURL=index.js.map

package/workflows/blobs/upload/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAEL,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,6CAA6C,EAC7C,kBAAkB,GACnB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AASjG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAGL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAE9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AACxG,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,KAAK,UAAU,2BAA2B,CACxC,KAeiC;IAEjC,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAExD,MAAM,OAAO,GAAG,6CAA6C,CAAC;QAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAgC;QACpD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU;QACV,OAAO,EAAE,MAAM,kBAAkB,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO;YACP,gBAAgB;YAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC;KACH,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,6BAA6B,CAAC;QACjE,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,gBAAgB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC;QACvD,6BAA6B,EAAE,mBAAmB,CAChD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CACtD;QACD,0BAA0B,EAAE,mBAAmB,CAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CACpD;QACD,iBAAiB,EAAE,UAAU;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,sBAAsB;QACtB,gBAAgB;QAChB,SAAS;QACT,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAMlC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,4BAA4B,CAAC;QACrE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC;QAClE,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,mBAAmB,CAC9B,KAAK,CAAC,WAAW,EACjB,8BAA8B,CAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAgBzC;IAQC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC3E,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CACvD,KAAK,CAAC,MAAM,EACZ,OAAO,EACP;QACE,qCAAqC,EACnC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;KACjD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gCAAgC,CAAC;QACrC,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,WAAW;QACX,eAAe;KAChB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;QACvC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;QAC/C,WAAW;QACX,eAAe;KAChB,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,4BAA4B,CAAC,EAC1C,SAAS,EACT,MAAM,EACN,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,EAC5B,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,EAC/B,KAAK,EACL,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EACvD,eAAe,GAAG,CAAC,EACnB,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,cAAc,EACd,eAAe,EACf,+BAA+B,EAC/B,gBAAgB,GACsB;IACtC,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,iCAAiC,GAAG,gCAAgC,CACxE,wBAAwB,EACxB,4BAA4B,CAC7B,CAAC;IACF,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,CACpB,qBAAwE,EACxE,EAAE,CACF,2BAA2B,CAAC;QAC1B,SAAS;QACT,SAAS;QACT,MAAM;QACN,UAAU;QACV,eAAe;QACf,UAAU;QACV,OAAO;QACP,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,wBAAwB,EAAE,iCAAiC;QAC3D,MAAM;QACN,cAAc;QACd,eAAe;QACf,+BAA+B;QAC/B,gBAAgB,EAAE,qBAAqB;KACxC,CAAC,CAAC;IACL,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,SAAS,CAAC,6BAA6B;YACxC,CAAC,8BAA8B,CAC7B,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;gBACrD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAC7C,EACD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,2EAA2E;QAC3E,+DAA+D;QAC/D,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,SAAS;QACT,MAAM;QACN,SAAS;QACT,MAAM;QACN,eAAe;QACf,UAAU;QACV,OAAO;QACP,iBAAiB;QACjB,QAAQ;QACR,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB;QACnB,eAAe;QACf,kBAAkB;QAClB,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS;QACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,OAAO,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gCAAgC,CAC9C,KAA4C;IAE5C,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AttachmentBindAccessEventBody,\n  WriteHeader,\n} from \"@tearleads/crypto\";\nimport {\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n} from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentBindRequest,\n  BlobContentKeyBundleRequest,\n} from \"@tearleads/validators/request\";\nimport type { BlobAttachmentBindResponse } from \"@tearleads/validators/response\";\nimport {\n  type BlobByteSource,\n  createBlobByteSource,\n} from \"../../../data/blobs/blobContracts\";\nimport type { BlobSourceSnapshot } from \"../../../data/documents/blob/shared/blobSourceSnapshot\";\nimport { prepareBlobEncryption } from \"../../../data/documents/blob/shared/crypto\";\nimport {\n  signBlobAttachmentEvent,\n  signBlobAttachmentWriteHeader,\n} from \"../../../data/documents/blob/shared/events\";\nimport {\n  verifiedBlobWrapTargetsFromDocumentProjection,\n  wrapBlobContentKey,\n} from \"../../../data/documents/blob/shared/projection\";\nimport { assertBlobAttachmentBindResponse } from \"../../../data/documents/blob/shared/responses\";\nimport type {\n  BlobAttachmentApi,\n  BlobAttachmentMaterial,\n  MultipartStageResolvedListener,\n  MultipartUploadProgressListener,\n  UploadDocumentAttachmentInput,\n  UploadDocumentAttachmentResult,\n} from \"../../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../../data/documents/shared/readers\";\nimport {\n  type DocumentCreateAuthor,\n  type ProjectionVerificationOptions,\n  projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { shouldRetryWithFreshProjection } from \"../../documents/syncFailures/syncFailureClassification\";\nimport { resolveBlobMutationWriterProjection } from \"../verification/writerProjection\";\nimport { resolveMultipartUploadOptions } from \"./automaticMultipartUpload\";\nimport { stageMultipartBlobAttachment } from \"./multipartUpload\";\n\nasync function buildBlobAttachmentMaterial(\n  input: {\n    apiClient: BlobAttachmentApi;\n    bindingId: string;\n    blobId: string;\n    contentKey: Uint8Array;\n    contentKeyEpoch: number;\n    documentId: string;\n    execSql?: ExecSql | undefined;\n    isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n    nonceSeed?: Uint8Array | undefined;\n    partSize: number;\n    source: BlobByteSource;\n    sourceSnapshot?: BlobSourceSnapshot | undefined;\n    targetSecretKey: Uint8Array;\n    writerProjection?: UploadDocumentAttachmentInput[\"writerProjection\"];\n  } & ProjectionVerificationOptions,\n): Promise<BlobAttachmentMaterial | null> {\n  const resolved = await resolveBlobMutationWriterProjection({\n    apiClient: input.apiClient,\n    documentId: input.documentId,\n    errorLabel: \"Blob attachment\",\n    execSql: input.execSql,\n    isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n    writerProjection: input.writerProjection,\n    ...projectionVerificationOptions(input),\n  });\n  if (!resolved) {\n    return null;\n  }\n  const { manifestIdentity, writerProjection } = resolved;\n\n  const targets = verifiedBlobWrapTargetsFromDocumentProjection({\n    bindingId: input.bindingId,\n    documentId: input.documentId,\n    writerProjection,\n  });\n  const targetHash = await computeBlobContentKeyTargetHash(targets);\n  const contentKeyBundle: BlobContentKeyBundleRequest = {\n    contentKeyEpoch: input.contentKeyEpoch,\n    targetHash,\n    targets: await wrapBlobContentKey({\n      blobId: input.blobId,\n      contentKey: input.contentKey,\n      contentKeyEpoch: input.contentKeyEpoch,\n      execSql: input.execSql,\n      secretKey: input.targetSecretKey,\n      targets,\n      writerProjection,\n      ...projectionVerificationOptions(input),\n    }),\n  };\n  const encrypted = await prepareBlobEncryption({\n    blobId: input.blobId,\n    chunkSize: input.partSize,\n    contentKey: input.contentKey,\n    contentKeyBundle,\n    nonceSeed: input.nonceSeed,\n    organizationId: manifestIdentity.organizationId,\n    source: input.source,\n    sourceSnapshot: input.sourceSnapshot,\n  });\n  const blobAccessManifestHash = await computeBlobAccessManifestHash({\n    version: 1,\n    blobId: input.blobId,\n    organizationId: manifestIdentity.organizationId,\n    activeBindingIds: [input.bindingId],\n    documentManifestHashes: [manifestIdentity.manifestHash],\n    linkedContainerManifestHashes: uniqueSortedStrings(\n      targets.map((target) => target.containerManifestHash),\n    ),\n    linkedContainerKeyEpochIds: uniqueSortedStrings(\n      targets.map((target) => target.containerKeyEpochId),\n    ),\n    blobKeyTargetHash: targetHash,\n  });\n\n  return {\n    blobAccessManifestHash,\n    contentKeyBundle,\n    encrypted,\n    manifestIdentity,\n    targetHash,\n    targets,\n    writerProjection,\n  };\n}\n\nfunction blobAttachmentBindRequest(input: {\n  body: AttachmentBindAccessEventBody;\n  event: AccessEvent;\n  material: BlobAttachmentMaterial;\n  stageId: string;\n  writeHeader: WriteHeader;\n}): BlobAttachmentBindRequest {\n  return {\n    event: readCanonicalRecord(input.event, \"Blob attachment bind event\"),\n    body: readCanonicalRecord(input.body, \"Blob attachment bind body\"),\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.material.writerProjection,\n    ),\n    contentKeyBundle: input.material.contentKeyBundle,\n    stagedBlob: {\n      stageId: input.stageId,\n      writeHeader: readCanonicalRecord(\n        input.writeHeader,\n        \"Blob attachment write header\",\n      ),\n    },\n  };\n}\n\nasync function stageAndBindBlobAttachment(input: {\n  apiClient: BlobAttachmentApi;\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  contentKeyEpoch: number;\n  documentId: string;\n  eventId: string;\n  expectedBindingId: string | null;\n  material: BlobAttachmentMaterial;\n  multipart: NonNullable<UploadDocumentAttachmentInput[\"multipart\"]>;\n  onMultipartProgress?: MultipartUploadProgressListener | undefined;\n  onStageResolved?: MultipartStageResolvedListener | undefined;\n  onStageUnavailable?: ((stageId: string) => Promise<void>) | undefined;\n  signedAt: string;\n  slotId: string;\n}): Promise<{\n  request: BlobAttachmentBindRequest;\n  response: BlobAttachmentBindResponse;\n  sha256: string;\n  byteLength: number;\n  writeHeader: WriteHeader;\n  writeHeaderHash: string;\n} | null> {\n  const { body, event } = await signBlobAttachmentEvent({\n    author: input.author,\n    bindingId: input.bindingId,\n    blobId: input.blobId,\n    documentId: input.documentId,\n    eventId: input.eventId,\n    expectedBindingId: input.expectedBindingId,\n    manifestIdentity: input.material.manifestIdentity,\n    signedAt: input.signedAt,\n    slotId: input.slotId,\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.material.writerProjection,\n    ),\n  });\n  const { writeHeader, writeHeaderHash } = await signBlobAttachmentWriteHeader({\n    authorizingContainerPathRefs: authorizingContainerPathRefs(\n      input.material.writerProjection,\n    ),\n    author: input.author,\n    blobAccessManifestHash: input.material.blobAccessManifestHash,\n    blobId: input.blobId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encrypted: input.material.encrypted,\n    manifestIdentity: input.material.manifestIdentity,\n    signedAt: input.signedAt,\n    targetHash: input.material.targetHash,\n  });\n  const stageId = await stageMultipartBlobAttachment({\n    organizationId: input.material.manifestIdentity.organizationId,\n    apiClient: input.apiClient,\n    encryption: input.material.encrypted,\n    multipart: input.multipart,\n    onMultipartProgress: input.onMultipartProgress,\n    onStageResolved: input.onStageResolved,\n    onStageUnavailable: input.onStageUnavailable,\n  });\n  if (!stageId) {\n    return null;\n  }\n\n  const request = blobAttachmentBindRequest({\n    body,\n    event,\n    material: input.material,\n    stageId,\n    writeHeader,\n  });\n  const response = await input.apiClient.bindBlobAttachment(\n    input.blobId,\n    request,\n    {\n      expectedPaymentRequiredOrganizationId:\n        input.material.manifestIdentity.organizationId,\n    },\n  );\n  if (!response) {\n    return null;\n  }\n\n  await assertBlobAttachmentBindResponse({\n    body,\n    bindingId: input.bindingId,\n    blobAccessManifestHash: input.material.blobAccessManifestHash,\n    blobId: input.blobId,\n    contentKeyBundle: input.material.contentKeyBundle,\n    documentId: input.documentId,\n    event,\n    manifestIdentity: input.material.manifestIdentity,\n    response,\n    slotId: input.slotId,\n    targetHash: input.material.targetHash,\n    targets: input.material.targets,\n    writeHeader,\n    writeHeaderHash,\n  });\n\n  return {\n    request,\n    response,\n    sha256: input.material.encrypted.sha256,\n    byteLength: input.material.encrypted.byteLength,\n    writeHeader,\n    writeHeaderHash,\n  };\n}\n\ninterface PreparedUploadDocumentAttachmentInput\n  extends UploadDocumentAttachmentInput {\n  readonly sourceSnapshot?: BlobSourceSnapshot | undefined;\n  readonly onStageUnavailable?:\n    | ((stageId: string) => Promise<void>)\n    | undefined;\n}\n\nasync function uploadDocumentAttachmentImpl({\n  apiClient,\n  author,\n  blobId = crypto.randomUUID(),\n  bindingId = crypto.randomUUID(),\n  bytes,\n  contentKey = crypto.getRandomValues(new Uint8Array(32)),\n  contentKeyEpoch = 1,\n  documentId,\n  eventId = crypto.randomUUID(),\n  execSql,\n  expectedBindingId,\n  isRemoteSyncBlocked,\n  nonceSeed,\n  multipart,\n  onMultipartProgress,\n  onStageResolved,\n  onStageUnavailable,\n  resolveProjectionUserKey,\n  signedAt = new Date().toISOString(),\n  slotId,\n  sourceSnapshot,\n  targetSecretKey,\n  warmReferencedPrincipalPolicies,\n  writerProjection,\n}: PreparedUploadDocumentAttachmentInput): Promise<UploadDocumentAttachmentResult | null> {\n  if (contentKey.byteLength !== 32) {\n    throw new Error(\"Blob content key must be 32 bytes\");\n  }\n  const resolveProjectionUserKeyForUpload = requireProjectionUserKeyResolver(\n    resolveProjectionUserKey,\n    \"Document attachment upload\",\n  );\n  const resolvedMultipart = resolveMultipartUploadOptions(multipart);\n  const source = createBlobByteSource(bytes);\n\n  const buildMaterial = (\n    freshWriterProjection: UploadDocumentAttachmentInput[\"writerProjection\"],\n  ) =>\n    buildBlobAttachmentMaterial({\n      apiClient,\n      bindingId,\n      blobId,\n      contentKey,\n      contentKeyEpoch,\n      documentId,\n      execSql,\n      isRemoteSyncBlocked,\n      nonceSeed,\n      partSize: resolvedMultipart.partSize,\n      resolveProjectionUserKey: resolveProjectionUserKeyForUpload,\n      source,\n      sourceSnapshot,\n      targetSecretKey,\n      warmReferencedPrincipalPolicies,\n      writerProjection: freshWriterProjection,\n    });\n  let material: BlobAttachmentMaterial | null;\n  try {\n    material = await buildMaterial(writerProjection);\n  } catch (error) {\n    if (\n      !apiClient.evictDocumentWriterProjection ||\n      !shouldRetryWithFreshProjection(\n        error,\n        (message) =>\n          message.startsWith(\"Container writer projection KEK\") &&\n          message.includes(\"could not be unwrapped\"),\n      )\n    ) {\n      throw error;\n    }\n\n    // The attachment binds to this document; only its projection was stale, so\n    // evict just it rather than wiping the whole projection cache.\n    apiClient.evictDocumentWriterProjection(documentId);\n    material = await buildMaterial(undefined);\n  }\n  if (!material) {\n    return null;\n  }\n  const result = await stageAndBindBlobAttachment({\n    apiClient,\n    author,\n    bindingId,\n    blobId,\n    contentKeyEpoch,\n    documentId,\n    eventId,\n    expectedBindingId,\n    material,\n    multipart: resolvedMultipart,\n    onMultipartProgress,\n    onStageResolved,\n    onStageUnavailable,\n    signedAt,\n    slotId,\n  });\n  if (!result) {\n    return null;\n  }\n\n  return {\n    blobId,\n    bindingId,\n    writerProjection: material.writerProjection,\n    ...result,\n  };\n}\n\nexport function uploadDocumentAttachment(\n  input: UploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult | null> {\n  return uploadDocumentAttachmentImpl({ ...input, sourceSnapshot: undefined });\n}\n\n/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */\nexport function uploadPreparedDocumentAttachment(\n  input: PreparedUploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult | null> {\n  return uploadDocumentAttachmentImpl(input);\n}\n"]}