@tearleads/client-sdk 0.1.63 → 0.1.65

package/stores/documents/documentStore/attachmentUpload/attachmentStaging.js

@@ -0,0 +1,84 @@
+import { createBlobByteSource } from "../../../../workflows/blobs/index.js";
+import { runSerializedDocumentBlobMutation, runSerializedSqlMutation, } from "../../../../workflows/documents/index.js";
+import { assignLocalAttachmentSlots, upsertPendingAttachments, } from "../attachments/attachmentPersistence.js";
+import { setReadySnapshot } from "../state.js";
+import { isDocumentStoreSyncGenerationCurrent, } from "../sync/syncGeneration.js";
+function localAttachmentRecords(localId, pendingAttachments) {
+    return pendingAttachments.map((pendingAttachment) => ({
+        blobId: null,
+        byteLength: pendingAttachment.byteLength,
+        contentSha256: pendingAttachment.contentSha256,
+        detachedAt: null,
+        localId,
+        mimeType: pendingAttachment.mimeType,
+        slotId: pendingAttachment.slotId,
+        storageKey: pendingAttachment.storageKey,
+    }));
+}
+async function deleteStagedAttachmentBytes(input) {
+    const { state } = input;
+    const cleanupResults = await Promise.allSettled(input.pendingAttachments.map((attachment) => state.runtime.infra.blobStore.deleteBytes(attachment.storageKey)));
+    const failedCleanupCount = cleanupResults.filter((result) => result.status === "rejected").length;
+    if (failedCleanupCount > 0) {
+        state.runtime.util.log(`Documents: failed to roll back ${failedCleanupCount} staged attachment operation${failedCleanupCount === 1 ? "" : "s"}.`);
+    }
+}
+/**
+ * Roll back staged bytes that no committed row references. Like orphan
+ * reclaim, check every held and pending reference under the key's lock: an
+ * overlapping reset can leave a committed key referenced only by an upload.
+ */
+export async function deleteUnreferencedStagedAttachmentBytes(input) {
+    const { execSql } = input.generation;
+    const { state } = input;
+    let failedCleanupCount = 0;
+    for (const { storageKey } of input.pendingAttachments) {
+        try {
+            await runSerializedDocumentBlobMutation(execSql, storageKey, async () => {
+                const referenced = await runSerializedSqlMutation(execSql, (lockedExecSql) => state.persistence.orphanBlobs.isReferenced(lockedExecSql, storageKey));
+                if (!referenced)
+                    await state.runtime.infra.blobStore.deleteBytes(storageKey);
+            });
+        }
+        catch {
+            // A failed probe cannot prove that the atomic mutation rolled back, so
+            // the bytes stay; a failed delete leaves them for a later sweep.
+            failedCleanupCount += 1;
+        }
+    }
+    if (failedCleanupCount > 0)
+        state.runtime.util.log(`Documents: failed to roll back ${failedCleanupCount} staged attachment operation${failedCleanupCount === 1 ? "" : "s"}.`);
+}
+async function writePendingAttachmentBytes(input) {
+    for (const [index, pendingAttachment] of input.pendingAttachments.entries()) {
+        const sourceFile = input.files[index];
+        if (!sourceFile)
+            continue;
+        await input.state.runtime.infra.blobStore.writeByteSource(pendingAttachment.storageKey, createBlobByteSource(sourceFile.bytes));
+    }
+}
+export function installPendingAttachmentRows(input) {
+    const { localAttachments, pendingAttachments, state } = input;
+    assignLocalAttachmentSlots(state, localAttachments);
+    upsertPendingAttachments(state, pendingAttachments);
+    if (state.doc) {
+        setReadySnapshot(state, state.doc, state.snapshot.syncing, state.snapshot.text, state.snapshot.structuredFields);
+    }
+}
+export async function stagePendingAttachments(input) {
+    const { pendingAttachments, state } = input;
+    const localAttachments = localAttachmentRecords(state.localId, pendingAttachments);
+    try {
+        await writePendingAttachmentBytes(input);
+        if (!isDocumentStoreSyncGenerationCurrent(state, input.generation)) {
+            await deleteStagedAttachmentBytes({ pendingAttachments, state });
+            return null;
+        }
+        return { localAttachments, pendingAttachments };
+    }
+    catch (error) {
+        await deleteStagedAttachmentBytes({ pendingAttachments, state });
+        throw error;
+    }
+}
+//# sourceMappingURL=attachmentStaging.js.map

package/stores/documents/documentStore/attachmentUpload/attachmentStaging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentStaging.js","sourceRoot":"","sources":["attachmentStaging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAIL,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAA2B,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EAEL,oCAAoC,GACrC,MAAM,wBAAwB,CAAC;AAShC,SAAS,sBAAsB,CAC7B,OAAe,EACf,kBAA0D;IAE1D,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,iBAAiB,CAAC,UAAU;QACxC,aAAa,EAAE,iBAAiB,CAAC,aAAa;QAC9C,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,UAAU,EAAE,iBAAiB,CAAC,UAAU;KACzC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,UAAU,CAC7C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CACjE,CACF,CAAC;IACF,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAC9C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CACzC,CAAC,MAAM,CAAC;IACT,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kCAAkC,kBAAkB,+BAA+B,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,iCAAiC,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;gBACtE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAC/C,OAAO,EACP,CAAC,aAAa,EAAE,EAAE,CAChB,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,CACxC,aAAa,EACb,UAAU,CACX,CACJ,CAAC;gBACF,IAAI,CAAC,UAAU;oBACb,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,iEAAiE;YACjE,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,GAAG,CAAC;QACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,kCAAkC,kBAAkB,+BAA+B,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC1H,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAmC;IAEnC,KAAK,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CACvD,iBAAiB,CAAC,UAAU,EAC5B,oBAAoB,CAAC,UAAU,CAAC,KAAK,CAAC,CACvC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9D,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,gBAAgB,CACd,KAAK,EACL,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,QAAQ,CAAC,OAAO,EACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,gBAAgB,GAAG,sBAAsB,CAC7C,KAAK,CAAC,OAAO,EACb,kBAAkB,CACnB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,MAAM,2BAA2B,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,2BAA2B,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { createBlobByteSource } from \"../../../../workflows/blobs\";\nimport {\n  type AttachmentStagingRows,\n  type LocalAttachmentRecord,\n  type PendingAttachmentRecord,\n  runSerializedDocumentBlobMutation,\n  runSerializedSqlMutation,\n} from \"../../../../workflows/documents\";\nimport type { DocumentAttachmentUpload } from \"../../types\";\nimport {\n  assignLocalAttachmentSlots,\n  upsertPendingAttachments,\n} from \"../attachments/attachmentPersistence\";\nimport { type DocumentStoreState, setReadySnapshot } from \"../state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"../sync/syncGeneration\";\n\ninterface StagePendingAttachmentsInput {\n  files: ReadonlyArray<DocumentAttachmentUpload>;\n  generation: DocumentStoreSyncGeneration;\n  pendingAttachments: PendingAttachmentRecord[];\n  state: DocumentStoreState;\n}\n\nfunction localAttachmentRecords(\n  localId: string,\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>,\n): LocalAttachmentRecord[] {\n  return pendingAttachments.map((pendingAttachment) => ({\n    blobId: null,\n    byteLength: pendingAttachment.byteLength,\n    contentSha256: pendingAttachment.contentSha256,\n    detachedAt: null,\n    localId,\n    mimeType: pendingAttachment.mimeType,\n    slotId: pendingAttachment.slotId,\n    storageKey: pendingAttachment.storageKey,\n  }));\n}\n\nasync function deleteStagedAttachmentBytes(input: {\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>;\n  state: DocumentStoreState;\n}) {\n  const { state } = input;\n  const cleanupResults = await Promise.allSettled(\n    input.pendingAttachments.map((attachment) =>\n      state.runtime.infra.blobStore.deleteBytes(attachment.storageKey),\n    ),\n  );\n  const failedCleanupCount = cleanupResults.filter(\n    (result) => result.status === \"rejected\",\n  ).length;\n  if (failedCleanupCount > 0) {\n    state.runtime.util.log(\n      `Documents: failed to roll back ${failedCleanupCount} staged attachment operation${failedCleanupCount === 1 ? \"\" : \"s\"}.`,\n    );\n  }\n}\n\n/**\n * Roll back staged bytes that no committed row references. Like orphan\n * reclaim, check every held and pending reference under the key's lock: an\n * overlapping reset can leave a committed key referenced only by an upload.\n */\nexport async function deleteUnreferencedStagedAttachmentBytes(input: {\n  generation: DocumentStoreSyncGeneration;\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>;\n  state: DocumentStoreState;\n}): Promise<void> {\n  const { execSql } = input.generation;\n  const { state } = input;\n  let failedCleanupCount = 0;\n  for (const { storageKey } of input.pendingAttachments) {\n    try {\n      await runSerializedDocumentBlobMutation(execSql, storageKey, async () => {\n        const referenced = await runSerializedSqlMutation(\n          execSql,\n          (lockedExecSql) =>\n            state.persistence.orphanBlobs.isReferenced(\n              lockedExecSql,\n              storageKey,\n            ),\n        );\n        if (!referenced)\n          await state.runtime.infra.blobStore.deleteBytes(storageKey);\n      });\n    } catch {\n      // A failed probe cannot prove that the atomic mutation rolled back, so\n      // the bytes stay; a failed delete leaves them for a later sweep.\n      failedCleanupCount += 1;\n    }\n  }\n  if (failedCleanupCount > 0)\n    state.runtime.util.log(\n      `Documents: failed to roll back ${failedCleanupCount} staged attachment operation${failedCleanupCount === 1 ? \"\" : \"s\"}.`,\n    );\n}\n\nasync function writePendingAttachmentBytes(\n  input: StagePendingAttachmentsInput,\n): Promise<void> {\n  for (const [index, pendingAttachment] of input.pendingAttachments.entries()) {\n    const sourceFile = input.files[index];\n    if (!sourceFile) continue;\n    await input.state.runtime.infra.blobStore.writeByteSource(\n      pendingAttachment.storageKey,\n      createBlobByteSource(sourceFile.bytes),\n    );\n  }\n}\n\nexport function installPendingAttachmentRows(input: {\n  localAttachments: ReadonlyArray<LocalAttachmentRecord>;\n  pendingAttachments: ReadonlyArray<PendingAttachmentRecord>;\n  state: DocumentStoreState;\n}): void {\n  const { localAttachments, pendingAttachments, state } = input;\n  assignLocalAttachmentSlots(state, localAttachments);\n  upsertPendingAttachments(state, pendingAttachments);\n  if (state.doc) {\n    setReadySnapshot(\n      state,\n      state.doc,\n      state.snapshot.syncing,\n      state.snapshot.text,\n      state.snapshot.structuredFields,\n    );\n  }\n}\n\nexport async function stagePendingAttachments(\n  input: StagePendingAttachmentsInput,\n): Promise<AttachmentStagingRows | null> {\n  const { pendingAttachments, state } = input;\n  const localAttachments = localAttachmentRecords(\n    state.localId,\n    pendingAttachments,\n  );\n\n  try {\n    await writePendingAttachmentBytes(input);\n\n    if (!isDocumentStoreSyncGenerationCurrent(state, input.generation)) {\n      await deleteStagedAttachmentBytes({ pendingAttachments, state });\n      return null;\n    }\n    return { localAttachments, pendingAttachments };\n  } catch (error) {\n    await deleteStagedAttachmentBytes({ pendingAttachments, state });\n    throw error;\n  }\n}\n"]}

package/stores/documents/documentStore/attachmentUpload/attachmentUploadAttempt.js

@@ -0,0 +1,97 @@
+import { reportAndRethrowKeyingVerificationError } from "../../../../data/keyingProjectionVerification/error.js";
+import { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from "../../../../workflows/blobs/upload/index.js";
+export async function uploadAttachmentWithWriterProjectionRetry(input) {
+    let remoteSyncBlocked = false;
+    let checkedOrganizationId;
+    let resolvedMultipartStage;
+    const onStageResolved = async (stage) => {
+        resolvedMultipartStage = stage;
+        await input.baseUploadInput.onStageResolved?.(stage);
+    };
+    const baseUploadInput = {
+        ...input.baseUploadInput,
+        isRemoteSyncBlocked: (organizationId) => {
+            checkedOrganizationId = organizationId;
+            remoteSyncBlocked =
+                input.state.runtime.util.isRemoteSyncBlocked?.(organizationId) ?? false;
+            return remoteSyncBlocked;
+        },
+        onStageResolved,
+    };
+    let uploadError;
+    let uploadThrew = false;
+    let uploaded = await tryUploadDocumentAttachment({
+        documentId: input.state.record?.documentId ?? input.state.localId,
+        input: {
+            ...baseUploadInput,
+            writerProjection: input.writerProjection ?? undefined,
+        },
+        onError: (error) => {
+            uploadThrew = true;
+            uploadError = error;
+        },
+        reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,
+    });
+    if (!uploaded && checkedOrganizationId !== undefined) {
+        // The request itself may have produced the first 402 after the workflow's
+        // preflight check. Re-read the same verified manifest org so that response
+        // is treated as a billing pause even when there was no cached projection
+        // available to trigger the retry path below.
+        remoteSyncBlocked ||=
+            input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??
+                false;
+    }
+    if (!uploaded &&
+        input.writerProjection &&
+        !remoteSyncBlocked &&
+        !uploadThrew) {
+        // A stale cached writer projection may have caused an ambiguous null. Retry
+        // once with a fresh projection, but do not immediately replay a concrete
+        // thrown failure or an expected billing pause.
+        input.state.writerProjection = null;
+        // Binding can return null after multipart staging succeeded. Carry that
+        // resolved stage into the retry so it is resumed instead of orphaned.
+        const retryUploadInput = resolvedMultipartStage
+            ? {
+                ...baseUploadInput,
+                multipart: {
+                    ...(baseUploadInput.multipart ?? {}),
+                    partSize: resolvedMultipartStage.partSize,
+                    resumeStageId: resolvedMultipartStage.stageId,
+                },
+            }
+            : baseUploadInput;
+        uploaded = await tryUploadDocumentAttachment({
+            documentId: input.state.record?.documentId ?? input.state.localId,
+            input: retryUploadInput,
+            onError: (error) => {
+                uploadError = error;
+            },
+            reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,
+        });
+        if (!uploaded && checkedOrganizationId !== undefined) {
+            remoteSyncBlocked ||=
+                input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??
+                    false;
+        }
+    }
+    if (remoteSyncBlocked) {
+        uploadError = undefined;
+    }
+    return { error: uploadError, remoteSyncBlocked, uploaded };
+}
+async function tryUploadDocumentAttachment(input) {
+    try {
+        return await uploadDocumentAttachment(input.input);
+    }
+    catch (error) {
+        await reportAndRethrowKeyingVerificationError(error, input.reportSecurityIncident, {
+            objectId: input.documentId,
+            objectKind: "document",
+            operation: "document.attachment.upload",
+        });
+        input.onError(error);
+        return null;
+    }
+}
+//# sourceMappingURL=attachmentUploadAttempt.js.map

package/stores/documents/documentStore/attachmentUpload/attachmentUploadAttempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentUploadAttempt.js","sourceRoot":"","sources":["attachmentUploadAttempt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,gCAAgC,IAAI,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAGlH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAI/D;IAKC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,qBAAyC,CAAC;IAC9C,IAAI,sBAES,CAAC;IACd,MAAM,eAAe,GAAG,KAAK,EAAE,KAG9B,EAAE,EAAE;QACH,sBAAsB,GAAG,KAAK,CAAC;QAC/B,MAAM,KAAK,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,eAAe;QACxB,mBAAmB,EAAE,CAAC,cAAsB,EAAE,EAAE;YAC9C,qBAAqB,GAAG,cAAc,CAAC;YACvC,iBAAiB;gBACf,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YAC1E,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,eAAe;KAChB,CAAC;IACF,IAAI,WAAoB,CAAC;IACzB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QAC/C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO;QACjE,KAAK,EAAE;YACL,GAAG,eAAe;YAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;SACtD;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QACD,sBAAsB,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;KACxE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACrD,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6CAA6C;QAC7C,iBAAiB;YACf,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;gBACrE,KAAK,CAAC;IACV,CAAC;IACD,IACE,CAAC,QAAQ;QACT,KAAK,CAAC,gBAAgB;QACtB,CAAC,iBAAiB;QAClB,CAAC,WAAW,EACZ,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,+CAA+C;QAC/C,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;QACpC,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,gBAAgB,GAAG,sBAAsB;YAC7C,CAAC,CAAC;gBACE,GAAG,eAAe;gBAClB,SAAS,EAAE;oBACT,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC;oBACpC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;oBACzC,aAAa,EAAE,sBAAsB,CAAC,OAAO;iBAC9C;aACF;YACH,CAAC,CAAC,eAAe,CAAC;QACpB,QAAQ,GAAG,MAAM,2BAA2B,CAAC;YAC3C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO;YACjE,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,sBAAsB,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACrD,iBAAiB;gBACf,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;oBACrE,KAAK,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;YACE,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,4BAA4B;SACxC,CACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../../../data/keyingProjectionVerification/error\";\nimport { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from \"../../../../workflows/blobs/upload\";\nimport type { DocumentStoreState } from \"../state\";\n\nexport async function uploadAttachmentWithWriterProjectionRetry(input: {\n  baseUploadInput: Parameters<typeof uploadDocumentAttachment>[0];\n  state: DocumentStoreState;\n  writerProjection: DocumentStoreState[\"writerProjection\"];\n}): Promise<{\n  error: unknown;\n  remoteSyncBlocked: boolean;\n  uploaded: Awaited<ReturnType<typeof uploadDocumentAttachment>>;\n}> {\n  let remoteSyncBlocked = false;\n  let checkedOrganizationId: string | undefined;\n  let resolvedMultipartStage:\n    | { readonly partSize: number; readonly stageId: string }\n    | undefined;\n  const onStageResolved = async (stage: {\n    readonly partSize: number;\n    readonly stageId: string;\n  }) => {\n    resolvedMultipartStage = stage;\n    await input.baseUploadInput.onStageResolved?.(stage);\n  };\n  const baseUploadInput = {\n    ...input.baseUploadInput,\n    isRemoteSyncBlocked: (organizationId: string) => {\n      checkedOrganizationId = organizationId;\n      remoteSyncBlocked =\n        input.state.runtime.util.isRemoteSyncBlocked?.(organizationId) ?? false;\n      return remoteSyncBlocked;\n    },\n    onStageResolved,\n  };\n  let uploadError: unknown;\n  let uploadThrew = false;\n  let uploaded = await tryUploadDocumentAttachment({\n    documentId: input.state.record?.documentId ?? input.state.localId,\n    input: {\n      ...baseUploadInput,\n      writerProjection: input.writerProjection ?? undefined,\n    },\n    onError: (error) => {\n      uploadThrew = true;\n      uploadError = error;\n    },\n    reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,\n  });\n  if (!uploaded && checkedOrganizationId !== undefined) {\n    // The request itself may have produced the first 402 after the workflow's\n    // preflight check. Re-read the same verified manifest org so that response\n    // is treated as a billing pause even when there was no cached projection\n    // available to trigger the retry path below.\n    remoteSyncBlocked ||=\n      input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??\n      false;\n  }\n  if (\n    !uploaded &&\n    input.writerProjection &&\n    !remoteSyncBlocked &&\n    !uploadThrew\n  ) {\n    // A stale cached writer projection may have caused an ambiguous null. Retry\n    // once with a fresh projection, but do not immediately replay a concrete\n    // thrown failure or an expected billing pause.\n    input.state.writerProjection = null;\n    // Binding can return null after multipart staging succeeded. Carry that\n    // resolved stage into the retry so it is resumed instead of orphaned.\n    const retryUploadInput = resolvedMultipartStage\n      ? {\n          ...baseUploadInput,\n          multipart: {\n            ...(baseUploadInput.multipart ?? {}),\n            partSize: resolvedMultipartStage.partSize,\n            resumeStageId: resolvedMultipartStage.stageId,\n          },\n        }\n      : baseUploadInput;\n    uploaded = await tryUploadDocumentAttachment({\n      documentId: input.state.record?.documentId ?? input.state.localId,\n      input: retryUploadInput,\n      onError: (error) => {\n        uploadError = error;\n      },\n      reportSecurityIncident: input.state.runtime.util.reportSecurityIncident,\n    });\n    if (!uploaded && checkedOrganizationId !== undefined) {\n      remoteSyncBlocked ||=\n        input.state.runtime.util.isRemoteSyncBlocked?.(checkedOrganizationId) ??\n        false;\n    }\n  }\n\n  if (remoteSyncBlocked) {\n    uploadError = undefined;\n  }\n  return { error: uploadError, remoteSyncBlocked, uploaded };\n}\n\nasync function tryUploadDocumentAttachment(input: {\n  documentId: string;\n  input: Parameters<typeof uploadDocumentAttachment>[0];\n  onError: (error: unknown) => void;\n  reportSecurityIncident: DocumentStoreState[\"runtime\"][\"util\"][\"reportSecurityIncident\"];\n}): ReturnType<typeof uploadDocumentAttachment> {\n  try {\n    return await uploadDocumentAttachment(input.input);\n  } catch (error) {\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      input.reportSecurityIncident,\n      {\n        objectId: input.documentId,\n        objectKind: \"document\",\n        operation: \"document.attachment.upload\",\n      },\n    );\n    input.onError(error);\n    return null;\n  }\n}\n"]}

package/stores/documents/documentStore/attachmentUpload/attachmentUploadLane.js

@@ -0,0 +1,49 @@
+import { beginDomainSyncUploadLane, } from "../../../../workflows/sync/index.js";
+function getAttachmentUploadLaneLabel(name) {
+    return name ? `Upload ${name}` : "Attachment upload";
+}
+function getAttachmentUploadFailureTarget(pendingAttachment) {
+    return pendingAttachment.name
+        ? `${pendingAttachment.name} (slot ${pendingAttachment.slotId})`
+        : `slot ${pendingAttachment.slotId}`;
+}
+export function createAttachmentUploadFailedError(pendingAttachment, cause) {
+    const error = new Error(`Attachment upload failed for ${getAttachmentUploadFailureTarget(pendingAttachment)}.`);
+    if (cause !== undefined)
+        Reflect.set(error, "cause", cause);
+    return error;
+}
+/**
+ * Surfaces attachment uploads as observational lanes. The persisted blob id is
+ * the lane identity: slot ids repeat across documents, while a retry must keep
+ * updating the same row. Lane creation stays lazy until progress, failure, or
+ * completion so a billing block before any upload work does not add noise.
+ */
+export function createAttachmentUploadLaneReporter(input) {
+    const { blobId, domainScope, pendingAttachment } = input;
+    const laneRef = { current: null };
+    const ensureLane = () => {
+        laneRef.current ??= beginDomainSyncUploadLane(domainScope, `blob-upload:${blobId}`, {
+            blobStorageKey: pendingAttachment.storageKey,
+            label: getAttachmentUploadLaneLabel(pendingAttachment.name),
+        });
+        return laneRef.current;
+    };
+    return {
+        complete() {
+            // Completion must create/re-begin the lane too: a resumed stage can
+            // already be complete before it emits any per-part callbacks.
+            ensureLane().complete();
+        },
+        fail(error) {
+            ensureLane().fail(error);
+        },
+        failIfStarted(error) {
+            laneRef.current?.fail(error);
+        },
+        onMultipartProgress(progress) {
+            ensureLane().reportProgress(progress);
+        },
+    };
+}
+//# sourceMappingURL=attachmentUploadLane.js.map

package/stores/documents/documentStore/attachmentUpload/attachmentUploadLane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentUploadLane.js","sourceRoot":"","sources":["attachmentUploadLane.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,4BAA4B,CAAC;AASpC,SAAS,4BAA4B,CAAC,IAA+B;IACnE,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACvD,CAAC;AAED,SAAS,gCAAgC,CACvC,iBAA0C;IAE1C,OAAO,iBAAiB,CAAC,IAAI;QAC3B,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,UAAU,iBAAiB,CAAC,MAAM,GAAG;QAChE,CAAC,CAAC,QAAQ,iBAAiB,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,iBAA0C,EAC1C,KAAc;IAEd,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,gCAAgC,gCAAgC,CAAC,iBAAiB,CAAC,GAAG,CACvF,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAIlD;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACzD,MAAM,OAAO,GAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtE,MAAM,UAAU,GAAG,GAAmB,EAAE;QACtC,OAAO,CAAC,OAAO,KAAK,yBAAyB,CAC3C,WAAW,EACX,eAAe,MAAM,EAAE,EACvB;YACE,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,KAAK,EAAE,4BAA4B,CAAC,iBAAiB,CAAC,IAAI,CAAC;SAC5D,CACF,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ;YACN,oEAAoE;YACpE,8DAA8D;YAC9D,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,KAAc;YACjB,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,aAAa,CAAC,KAAc;YAC1B,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,mBAAmB,CAAC,QAAQ;YAC1B,UAAU,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../../../data/shared/domainScope\";\nimport type { MultipartUploadProgressListener } from \"../../../../workflows/blobs\";\nimport type { PendingAttachmentRecord } from \"../../../../workflows/documents\";\nimport {\n  beginDomainSyncUploadLane,\n  type UploadSyncLane,\n} from \"../../../../workflows/sync\";\n\nexport interface AttachmentUploadLaneReporter {\n  complete: () => void;\n  fail: (error: unknown) => void;\n  failIfStarted: (error: unknown) => void;\n  onMultipartProgress: MultipartUploadProgressListener;\n}\n\nfunction getAttachmentUploadLaneLabel(name: string | null | undefined): string {\n  return name ? `Upload ${name}` : \"Attachment upload\";\n}\n\nfunction getAttachmentUploadFailureTarget(\n  pendingAttachment: PendingAttachmentRecord,\n): string {\n  return pendingAttachment.name\n    ? `${pendingAttachment.name} (slot ${pendingAttachment.slotId})`\n    : `slot ${pendingAttachment.slotId}`;\n}\n\nexport function createAttachmentUploadFailedError(\n  pendingAttachment: PendingAttachmentRecord,\n  cause: unknown,\n): Error {\n  const error = new Error(\n    `Attachment upload failed for ${getAttachmentUploadFailureTarget(pendingAttachment)}.`,\n  );\n  if (cause !== undefined) Reflect.set(error, \"cause\", cause);\n\n  return error;\n}\n\n/**\n * Surfaces attachment uploads as observational lanes. The persisted blob id is\n * the lane identity: slot ids repeat across documents, while a retry must keep\n * updating the same row. Lane creation stays lazy until progress, failure, or\n * completion so a billing block before any upload work does not add noise.\n */\nexport function createAttachmentUploadLaneReporter(input: {\n  blobId: string;\n  domainScope: DomainScope;\n  pendingAttachment: PendingAttachmentRecord;\n}): AttachmentUploadLaneReporter {\n  const { blobId, domainScope, pendingAttachment } = input;\n  const laneRef: { current: UploadSyncLane | null } = { current: null };\n\n  const ensureLane = (): UploadSyncLane => {\n    laneRef.current ??= beginDomainSyncUploadLane(\n      domainScope,\n      `blob-upload:${blobId}`,\n      {\n        blobStorageKey: pendingAttachment.storageKey,\n        label: getAttachmentUploadLaneLabel(pendingAttachment.name),\n      },\n    );\n    return laneRef.current;\n  };\n\n  return {\n    complete() {\n      // Completion must create/re-begin the lane too: a resumed stage can\n      // already be complete before it emits any per-part callbacks.\n      ensureLane().complete();\n    },\n    fail(error: unknown) {\n      ensureLane().fail(error);\n    },\n    failIfStarted(error: unknown) {\n      laneRef.current?.fail(error);\n    },\n    onMultipartProgress(progress) {\n      ensureLane().reportProgress(progress);\n    },\n  };\n}\n"]}

package/stores/documents/documentStore/attachmentUpload/attachmentUploadResume.js

@@ -0,0 +1,95 @@
+import { createAesGcmIv } from "../../../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../../../internal/encoding/index.js";
+import { savePendingAttachmentUpload } from "../attachments/attachmentPersistence.js";
+import { isDocumentStoreSyncGenerationCurrent, } from "../sync/syncGeneration.js";
+function createPendingUploadIdentity(plaintextSha256) {
+    // Generated once and persisted before the first upload attempt. The source
+    // digest derives an envelope IV from this seed, then each chunk derives its
+    // IV. Reusing the material for unchanged bytes makes retries byte-identical.
+    return {
+        blobId: crypto.randomUUID(),
+        contentKey: bytesToBase64(crypto.getRandomValues(new Uint8Array(32))),
+        contentKeyEpoch: 1,
+        nonceSeed: bytesToBase64(createAesGcmIv()),
+        partSize: null,
+        plaintextSha256,
+        stageId: null,
+    };
+}
+/**
+ * Resolve and persist stable encryption and multipart inputs across retries.
+ *
+ * Every persist here is an UPSERT of the pending-attachment row, so each one
+ * is generation-gated: a store teardown (reset/discard) deletes that row on
+ * purpose, and a stale resume racing it would otherwise re-insert the row it
+ * just removed. Skipping the persist only costs retry resumability.
+ */
+export async function resolveAttachmentUploadResume(state, pendingAttachment, plaintextSha256, attachmentGeneration) {
+    let uploadIdentity = pendingAttachment.upload?.plaintextSha256 === plaintextSha256
+        ? pendingAttachment.upload
+        : createPendingUploadIdentity(plaintextSha256);
+    if (pendingAttachment.upload !== uploadIdentity &&
+        isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+        await savePendingAttachmentUpload(state, { ...pendingAttachment, upload: uploadIdentity }, attachmentGeneration);
+        if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+            pendingAttachment.upload = uploadIdentity;
+        }
+    }
+    const multipart = uploadIdentity.stageId !== null && uploadIdentity.partSize !== null
+        ? {
+            partSize: uploadIdentity.partSize,
+            resumeStageId: uploadIdentity.stageId,
+        }
+        : undefined;
+    const onStageResolved = async ({ partSize, stageId, }) => {
+        if (uploadIdentity.stageId === stageId &&
+            uploadIdentity.partSize === partSize) {
+            return;
+        }
+        if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+            return;
+        }
+        const nextUploadIdentity = { ...uploadIdentity, partSize, stageId };
+        await savePendingAttachmentUpload(state, { ...pendingAttachment, upload: nextUploadIdentity }, attachmentGeneration);
+        if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+            // Publish only after persistence succeeds: a failed save must leave the
+            // next attempt responsible for making this identity durable.
+            uploadIdentity = nextUploadIdentity;
+            pendingAttachment.upload = nextUploadIdentity;
+        }
+    };
+    return {
+        blobId: uploadIdentity.blobId,
+        contentKey: base64ToBytes(uploadIdentity.contentKey),
+        contentKeyEpoch: uploadIdentity.contentKeyEpoch,
+        nonceSeed: base64ToBytes(uploadIdentity.nonceSeed),
+        multipart,
+        onStageResolved,
+        onStageUnavailable: async (stageId, documentId) => {
+            if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||
+                pendingAttachment.upload?.stageId !== stageId)
+                return;
+            // Recheck after the ambiguous bind, including an immediate projection
+            // retry in this pass. A still-active commit must retain its identity for
+            // normal adoption on the next pass; a failed read proves nothing.
+            const bindings = await state.runtime.apiClient.listDocumentAttachments(documentId, { refresh: true });
+            if (!bindings)
+                throw new Error("Attachment recovery lookup failed.");
+            if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||
+                pendingAttachment.upload?.stageId !== stageId ||
+                bindings.some((binding) => binding.slotId === pendingAttachment.slotId &&
+                    binding.blobId === uploadIdentity.blobId))
+                return;
+            // A missing stage may have been consumed by a committed bind whose
+            // response was lost and whose slot was subsequently replaced/detached.
+            // That blob id is permanently reserved, so a replacement stage must use
+            // fresh crypto material and an id persisted before any bytes are sent.
+            const nextUploadIdentity = createPendingUploadIdentity(plaintextSha256);
+            await savePendingAttachmentUpload(state, { ...pendingAttachment, upload: nextUploadIdentity }, attachmentGeneration);
+            if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {
+                pendingAttachment.upload = nextUploadIdentity;
+            }
+        },
+    };
+}
+//# sourceMappingURL=attachmentUploadResume.js.map

package/stores/documents/documentStore/attachmentUpload/attachmentUploadResume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentUploadResume.js","sourceRoot":"","sources":["attachmentUploadResume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,OAAO,EAEL,oCAAoC,GACrC,MAAM,wBAAwB,CAAC;AAEhC,SAAS,2BAA2B,CAClC,eAAuB;IAEvB,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;QAC3B,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC;QAC1C,QAAQ,EAAE,IAAI;QACd,eAAe;QACf,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyB,EACzB,iBAA0C,EAC1C,eAAuB,EACvB,oBAAiD;IAEjD,IAAI,cAAc,GAChB,iBAAiB,CAAC,MAAM,EAAE,eAAe,KAAK,eAAe;QAC3D,CAAC,CAAC,iBAAiB,CAAC,MAAM;QAC1B,CAAC,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC;IACnD,IACE,iBAAiB,CAAC,MAAM,KAAK,cAAc;QAC3C,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EACjE,CAAC;QACD,MAAM,2BAA2B,CAC/B,KAAK,EACL,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,EAChD,oBAAoB,CACrB,CAAC;QACF,IAAI,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACtE,iBAAiB,CAAC,MAAM,GAAG,cAAc,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GACb,cAAc,CAAC,OAAO,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,KAAK,IAAI;QACjE,CAAC,CAAC;YACE,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,aAAa,EAAE,cAAc,CAAC,OAAO;SACtC;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,eAAe,GAAmC,KAAK,EAAE,EAC7D,QAAQ,EACR,OAAO,GACR,EAAE,EAAE;QACH,IACE,cAAc,CAAC,OAAO,KAAK,OAAO;YAClC,cAAc,CAAC,QAAQ,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,kBAAkB,GAAG,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpE,MAAM,2BAA2B,CAC/B,KAAK,EACL,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EACpD,oBAAoB,CACrB,CAAC;QACF,IAAI,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACtE,wEAAwE;YACxE,6DAA6D;YAC7D,cAAc,GAAG,kBAAkB,CAAC;YACpC,iBAAiB,CAAC,MAAM,GAAG,kBAAkB,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,MAAM;QAC7B,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;QACpD,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC;QAClD,SAAS;QACT,eAAe;QACf,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAChD,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC;gBAClE,iBAAiB,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO;gBAE7C,OAAO;YACT,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CACpE,UAAU,EACV,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACrE,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC;gBAClE,iBAAiB,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO;gBAC7C,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;oBAC3C,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,CAC3C;gBAED,OAAO;YACT,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,eAAe,CAAC,CAAC;YACxE,MAAM,2BAA2B,CAC/B,KAAK,EACL,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EACpD,oBAAoB,CACrB,CAAC;YACF,IAAI,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBACtE,iBAAiB,CAAC,MAAM,GAAG,kBAAkB,CAAC;YAChD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { createAesGcmIv } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type { MultipartStageResolvedListener } from \"../../../../workflows/blobs\";\nimport type {\n  PendingAttachmentRecord,\n  PendingAttachmentUploadIdentity,\n} from \"../../../../workflows/documents\";\nimport { savePendingAttachmentUpload } from \"../attachments/attachmentPersistence\";\nimport type { DocumentStoreState } from \"../state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent,\n} from \"../sync/syncGeneration\";\n\nfunction createPendingUploadIdentity(\n  plaintextSha256: string,\n): PendingAttachmentUploadIdentity {\n  // Generated once and persisted before the first upload attempt. The source\n  // digest derives an envelope IV from this seed, then each chunk derives its\n  // IV. Reusing the material for unchanged bytes makes retries byte-identical.\n  return {\n    blobId: crypto.randomUUID(),\n    contentKey: bytesToBase64(crypto.getRandomValues(new Uint8Array(32))),\n    contentKeyEpoch: 1,\n    nonceSeed: bytesToBase64(createAesGcmIv()),\n    partSize: null,\n    plaintextSha256,\n    stageId: null,\n  };\n}\n\nexport interface AttachmentUploadResume {\n  readonly blobId: string;\n  readonly contentKey: Uint8Array;\n  readonly contentKeyEpoch: number;\n  readonly nonceSeed: Uint8Array;\n  readonly multipart: { partSize: number; resumeStageId: string } | undefined;\n  readonly onStageResolved: MultipartStageResolvedListener;\n  readonly onStageUnavailable: (\n    stageId: string,\n    documentId: string,\n  ) => Promise<void>;\n}\n\n/**\n * Resolve and persist stable encryption and multipart inputs across retries.\n *\n * Every persist here is an UPSERT of the pending-attachment row, so each one\n * is generation-gated: a store teardown (reset/discard) deletes that row on\n * purpose, and a stale resume racing it would otherwise re-insert the row it\n * just removed. Skipping the persist only costs retry resumability.\n */\nexport async function resolveAttachmentUploadResume(\n  state: DocumentStoreState,\n  pendingAttachment: PendingAttachmentRecord,\n  plaintextSha256: string,\n  attachmentGeneration: DocumentStoreSyncGeneration,\n): Promise<AttachmentUploadResume> {\n  let uploadIdentity =\n    pendingAttachment.upload?.plaintextSha256 === plaintextSha256\n      ? pendingAttachment.upload\n      : createPendingUploadIdentity(plaintextSha256);\n  if (\n    pendingAttachment.upload !== uploadIdentity &&\n    isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)\n  ) {\n    await savePendingAttachmentUpload(\n      state,\n      { ...pendingAttachment, upload: uploadIdentity },\n      attachmentGeneration,\n    );\n    if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n      pendingAttachment.upload = uploadIdentity;\n    }\n  }\n\n  const multipart =\n    uploadIdentity.stageId !== null && uploadIdentity.partSize !== null\n      ? {\n          partSize: uploadIdentity.partSize,\n          resumeStageId: uploadIdentity.stageId,\n        }\n      : undefined;\n  const onStageResolved: MultipartStageResolvedListener = async ({\n    partSize,\n    stageId,\n  }) => {\n    if (\n      uploadIdentity.stageId === stageId &&\n      uploadIdentity.partSize === partSize\n    ) {\n      return;\n    }\n    if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n      return;\n    }\n    const nextUploadIdentity = { ...uploadIdentity, partSize, stageId };\n    await savePendingAttachmentUpload(\n      state,\n      { ...pendingAttachment, upload: nextUploadIdentity },\n      attachmentGeneration,\n    );\n    if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n      // Publish only after persistence succeeds: a failed save must leave the\n      // next attempt responsible for making this identity durable.\n      uploadIdentity = nextUploadIdentity;\n      pendingAttachment.upload = nextUploadIdentity;\n    }\n  };\n\n  return {\n    blobId: uploadIdentity.blobId,\n    contentKey: base64ToBytes(uploadIdentity.contentKey),\n    contentKeyEpoch: uploadIdentity.contentKeyEpoch,\n    nonceSeed: base64ToBytes(uploadIdentity.nonceSeed),\n    multipart,\n    onStageResolved,\n    onStageUnavailable: async (stageId, documentId) => {\n      if (\n        !isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||\n        pendingAttachment.upload?.stageId !== stageId\n      )\n        return;\n      // Recheck after the ambiguous bind, including an immediate projection\n      // retry in this pass. A still-active commit must retain its identity for\n      // normal adoption on the next pass; a failed read proves nothing.\n      const bindings = await state.runtime.apiClient.listDocumentAttachments(\n        documentId,\n        { refresh: true },\n      );\n      if (!bindings) throw new Error(\"Attachment recovery lookup failed.\");\n      if (\n        !isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration) ||\n        pendingAttachment.upload?.stageId !== stageId ||\n        bindings.some(\n          (binding) =>\n            binding.slotId === pendingAttachment.slotId &&\n            binding.blobId === uploadIdentity.blobId,\n        )\n      )\n        return;\n      // A missing stage may have been consumed by a committed bind whose\n      // response was lost and whose slot was subsequently replaced/detached.\n      // That blob id is permanently reserved, so a replacement stage must use\n      // fresh crypto material and an id persisted before any bytes are sent.\n      const nextUploadIdentity = createPendingUploadIdentity(plaintextSha256);\n      await savePendingAttachmentUpload(\n        state,\n        { ...pendingAttachment, upload: nextUploadIdentity },\n        attachmentGeneration,\n      );\n      if (isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n        pendingAttachment.upload = nextUploadIdentity;\n      }\n    },\n  };\n}\n"]}

package/stores/documents/documentStore/attachments/attachmentDetachState.js

@@ -0,0 +1,54 @@
+/**
+ * Keeps a local attachment row's detach marker consistent with the document.
+ *
+ * The invariant is one line: a local blob row is marked detached exactly when
+ * its slot is no longer in the document. The read models trust that marker to
+ * decide whether a blob is still referenced, so anything that writes these rows
+ * has to preserve it rather than restate what it believed the slots were.
+ *
+ * Two writers can otherwise clear a marker they never meant to touch: an upload
+ * that settles after the user removed its slot, and a hydration that captured
+ * the attachment list before an unlink and writes it back after. Both read the
+ * slot list, await, then save — so the slot they save may already be gone.
+ */
+import { getDocumentAttachments } from "../../../../data/documents/documentContent.js";
+function getLiveSlotIds(doc) {
+    return new Set(getDocumentAttachments(doc).map((attachment) => attachment.slotId));
+}
+/**
+ * Stamp records being written for slots the document no longer has as detached.
+ *
+ * The document is read here, at write time, rather than trusted from the
+ * caller's earlier snapshot — the Loro document is mutated in place, so this
+ * sees any unlink that landed while the caller was awaiting.
+ */
+export function withLocalAttachmentDetachState(attachments, doc) {
+    if (!doc) {
+        return [...attachments];
+    }
+    const detachedAt = new Date().toISOString();
+    const liveSlotIds = getLiveSlotIds(doc);
+    return attachments.map((attachment) => attachment.detachedAt === null && !liveSlotIds.has(attachment.slotId)
+        ? { ...attachment, detachedAt }
+        : attachment);
+}
+/**
+ * Report the loaded rows whose marker disagrees with the loaded document.
+ *
+ * A write can only be interrupted between marking the row and persisting the
+ * document, so a restart can find either half applied. Reconciling against the
+ * durable document at load makes the marker mean what it claims again: a slot
+ * the document still has is live, and a slot it dropped is detached.
+ */
+export function reconcileLocalAttachmentDetachState(attachments, doc) {
+    const detachedAt = new Date().toISOString();
+    const liveSlotIds = getLiveSlotIds(doc);
+    return attachments.flatMap((attachment) => {
+        const slotIsLive = liveSlotIds.has(attachment.slotId);
+        if (slotIsLive === (attachment.detachedAt === null)) {
+            return [];
+        }
+        return [{ ...attachment, detachedAt: slotIsLive ? null : detachedAt }];
+    });
+}
+//# sourceMappingURL=attachmentDetachState.js.map

package/stores/documents/documentStore/attachments/attachmentDetachState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentDetachState.js","sourceRoot":"","sources":["attachmentDetachState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAIpF,SAAS,cAAc,CAAC,GAAkB;IACxC,OAAO,IAAI,GAAG,CACZ,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAiD,EACjD,GAAyB;IAEzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QACnE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE;QAC/B,CAAC,CAAC,UAAU,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAiD,EACjD,GAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Keeps a local attachment row's detach marker consistent with the document.\n *\n * The invariant is one line: a local blob row is marked detached exactly when\n * its slot is no longer in the document. The read models trust that marker to\n * decide whether a blob is still referenced, so anything that writes these rows\n * has to preserve it rather than restate what it believed the slots were.\n *\n * Two writers can otherwise clear a marker they never meant to touch: an upload\n * that settles after the user removed its slot, and a hydration that captured\n * the attachment list before an unlink and writes it back after. Both read the\n * slot list, await, then save — so the slot they save may already be gone.\n */\nimport { getDocumentAttachments } from \"../../../../data/documents/documentContent\";\nimport type { LocalAttachmentRecord } from \"../../../../workflows/documents\";\nimport type { DocumentState } from \"../state\";\n\nfunction getLiveSlotIds(doc: DocumentState): ReadonlySet<string> {\n  return new Set(\n    getDocumentAttachments(doc).map((attachment) => attachment.slotId),\n  );\n}\n\n/**\n * Stamp records being written for slots the document no longer has as detached.\n *\n * The document is read here, at write time, rather than trusted from the\n * caller's earlier snapshot — the Loro document is mutated in place, so this\n * sees any unlink that landed while the caller was awaiting.\n */\nexport function withLocalAttachmentDetachState(\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n  doc: DocumentState | null,\n): LocalAttachmentRecord[] {\n  if (!doc) {\n    return [...attachments];\n  }\n\n  const detachedAt = new Date().toISOString();\n  const liveSlotIds = getLiveSlotIds(doc);\n  return attachments.map((attachment) =>\n    attachment.detachedAt === null && !liveSlotIds.has(attachment.slotId)\n      ? { ...attachment, detachedAt }\n      : attachment,\n  );\n}\n\n/**\n * Report the loaded rows whose marker disagrees with the loaded document.\n *\n * A write can only be interrupted between marking the row and persisting the\n * document, so a restart can find either half applied. Reconciling against the\n * durable document at load makes the marker mean what it claims again: a slot\n * the document still has is live, and a slot it dropped is detached.\n */\nexport function reconcileLocalAttachmentDetachState(\n  attachments: ReadonlyArray<LocalAttachmentRecord>,\n  doc: DocumentState,\n): LocalAttachmentRecord[] {\n  const detachedAt = new Date().toISOString();\n  const liveSlotIds = getLiveSlotIds(doc);\n  return attachments.flatMap((attachment) => {\n    const slotIsLive = liveSlotIds.has(attachment.slotId);\n    if (slotIsLive === (attachment.detachedAt === null)) {\n      return [];\n    }\n\n    return [{ ...attachment, detachedAt: slotIsLive ? null : detachedAt }];\n  });\n}\n"]}

package/stores/documents/documentStore/attachments/attachmentHydration.js

@@ -0,0 +1,90 @@
+/** Hydrate only bytes matching the current document's authenticated attachment intent. */
+import { getDocumentAttachments } from "../../../../data/documents/documentContent.js";
+import { hydrateDocumentAttachmentBlobs } from "../../../../workflows/blobs/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../../workflows/principals/runtimePolicyWarmer.js";
+import { runDocumentOrphanMaintenance } from "../orphanMaintenance.js";
+import { isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent, } from "../sync/syncGeneration.js";
+import { commitHydratedAttachment } from "./attachmentHydrationCommit.js";
+// A remote probe is evidence that bindings may have moved independently of
+// content. Capture its sequence before I/O so a hint arriving during hydration
+// survives for the trailing pass. Missing or changed local bytes always retry.
+const checkedSignals = new WeakMap();
+export async function hydrateAttachmentBlobs(state, currentDoc, currentRecord, expectedGeneration) {
+    const generationIsCurrent = () => !expectedGeneration || isSyncGenerationCurrent(state, expectedGeneration);
+    if (!generationIsCurrent())
+        return;
+    const runtime = state.runtime;
+    const encapsulationKeyPair = runtime.crypto.encapsulationKeyPair;
+    if (!encapsulationKeyPair ||
+        !runtime.auth.isAuthenticated ||
+        !runtime.state.online ||
+        !currentRecord?.documentId) {
+        return;
+    }
+    const attachments = getDocumentAttachments(currentDoc);
+    if (attachments.length === 0) {
+        return;
+    }
+    const signalSequence = state.remoteUpdateSignalSeq;
+    if (bindingsAlreadyChecked(state, currentDoc, currentRecord.documentId, attachments, signalSequence))
+        return;
+    const expectedStorageKeys = { ...state.attachmentStorageKeyBySlotId };
+    let bindingsChecked = false;
+    const hydratedBlobs = await hydrateDocumentAttachmentBlobs({
+        apiClient: runtime.apiClient,
+        onBindingsChecked: () => {
+            bindingsChecked = true;
+        },
+        attachments,
+        documentId: currentRecord.documentId,
+        execSql: runtime.infra.execSql,
+        localBlobIdBySlotId: state.attachmentBlobIdBySlotId,
+        localStorageKeyBySlotId: state.attachmentStorageKeyBySlotId,
+        log: runtime.util.log,
+        rejectedServedBindings: state.rejectedServedAttachmentBindings,
+        reportSecurityIncident: runtime.util.reportSecurityIncident,
+        resolveProjectionUserKey: expectedGeneration?.resolveProjectionUserKey ??
+            state.resolveProjectionUserKey,
+        targetSecretKey: encapsulationKeyPair.secretKey,
+        stillCurrent: generationIsCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
+    });
+    if (!generationIsCurrent())
+        return;
+    if (!hydratedBlobs) {
+        return;
+    }
+    for (const hydratedBlob of hydratedBlobs) {
+        await commitHydratedAttachment({
+            state,
+            currentDoc,
+            hydratedBlob,
+            generationIsCurrent,
+            expectedStorageKey: expectedStorageKeys[hydratedBlob.attachment.slotId] ?? null,
+        });
+    }
+    if (bindingsChecked &&
+        generationIsCurrent() &&
+        hydratedBlobs.every((blob) => state.attachmentBlobIdBySlotId[blob.attachment.slotId] ===
+            blob.binding.blobId)) {
+        checkedSignals.set(state, {
+            documentId: currentRecord.documentId,
+            document: new WeakRef(currentDoc),
+            sequence: signalSequence,
+        });
+    }
+    void runDocumentOrphanMaintenance(state);
+}
+function bindingsAlreadyChecked(state, currentDoc, documentId, attachments, signalSequence) {
+    const checked = checkedSignals.get(state);
+    const needsBindingProbe = signalSequence >
+        (checked?.documentId === documentId &&
+            checked.document.deref() === currentDoc
+            ? checked.sequence
+            : 0);
+    return (!needsBindingProbe &&
+        attachments.every((attachment) => state.attachmentStorageKeyBySlotId[attachment.slotId] &&
+            state.attachmentContentSha256BySlotId[attachment.slotId] ===
+                attachment.contentSha256));
+}
+//# sourceMappingURL=attachmentHydration.js.map

package/stores/documents/documentStore/attachments/attachmentHydration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentHydration.js","sourceRoot":"","sources":["attachmentHydration.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAEL,oCAAoC,IAAI,uBAAuB,GAChE,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,cAAc,GAAG,IAAI,OAAO,EAG/B,CAAC;AAEJ,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB,EACzB,UAAyB,EACzB,aAAoC,EACpC,kBAAgD;IAEhD,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACjE,IACE,CAAC,oBAAoB;QACrB,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QACrB,CAAC,aAAa,EAAE,UAAU,EAC1B,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACnD,IACE,sBAAsB,CACpB,KAAK,EACL,UAAU,EACV,aAAa,CAAC,UAAU,EACxB,WAAW,EACX,cAAc,CACf;QAED,OAAO;IAET,MAAM,mBAAmB,GAAG,EAAE,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;IACtE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,GAAG,EAAE;YACtB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,WAAW;QACX,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,mBAAmB,EAAE,KAAK,CAAC,wBAAwB;QACnD,uBAAuB,EAAE,KAAK,CAAC,4BAA4B;QAC3D,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,sBAAsB,EAAE,KAAK,CAAC,gCAAgC;QAC9D,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,wBAAwB,EACtB,kBAAkB,EAAE,wBAAwB;YAC5C,KAAK,CAAC,wBAAwB;QAChC,eAAe,EAAE,oBAAoB,CAAC,SAAS;QAC/C,YAAY,EAAE,mBAAmB;QACjC,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IACnC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,wBAAwB,CAAC;YAC7B,KAAK;YACL,UAAU;YACV,YAAY;YACZ,mBAAmB;YACnB,kBAAkB,EAChB,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IACE,eAAe;QACf,mBAAmB,EAAE;QACrB,aAAa,CAAC,KAAK,CACjB,CAAC,IAAI,EAAE,EAAE,CACP,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,MAAM,CACtB,EACD,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;YACxB,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,QAAQ,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC;YACjC,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAyB,EACzB,UAAyB,EACzB,UAAkB,EAClB,WAAsD,EACtD,cAAsB;IAEtB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,iBAAiB,GACrB,cAAc;QACd,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU;YACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,UAAU;YACrC,CAAC,CAAC,OAAO,CAAC,QAAQ;YAClB,CAAC,CAAC,CAAC,CAAC,CAAC;IACT,OAAO,CACL,CAAC,iBAAiB;QAClB,WAAW,CAAC,KAAK,CACf,CAAC,UAAU,EAAE,EAAE,CACb,KAAK,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC;YACrD,KAAK,CAAC,+BAA+B,CAAC,UAAU,CAAC,MAAM,CAAC;gBACtD,UAAU,CAAC,aAAa,CAC7B,CACF,CAAC;AACJ,CAAC","sourcesContent":["/** Hydrate only bytes matching the current document's authenticated attachment intent. */\n\nimport { getDocumentAttachments } from \"../../../../data/documents/documentContent\";\nimport { hydrateDocumentAttachmentBlobs } from \"../../../../workflows/blobs\";\nimport type { DocumentRecord } from \"../../../../workflows/documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../../workflows/principals/runtimePolicyWarmer\";\nimport { runDocumentOrphanMaintenance } from \"../orphanMaintenance\";\nimport type { DocumentState, DocumentStoreState } from \"../state\";\nimport {\n  type DocumentStoreSyncGeneration,\n  isDocumentStoreSyncGenerationCurrent as isSyncGenerationCurrent,\n} from \"../sync/syncGeneration\";\nimport { commitHydratedAttachment } from \"./attachmentHydrationCommit\";\n\n// A remote probe is evidence that bindings may have moved independently of\n// content. Capture its sequence before I/O so a hint arriving during hydration\n// survives for the trailing pass. Missing or changed local bytes always retry.\nconst checkedSignals = new WeakMap<\n  DocumentStoreState,\n  { documentId: string; document: WeakRef<DocumentState>; sequence: number }\n>();\n\nexport async function hydrateAttachmentBlobs(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  currentRecord: DocumentRecord | null,\n  expectedGeneration?: DocumentStoreSyncGeneration,\n) {\n  const generationIsCurrent = () =>\n    !expectedGeneration || isSyncGenerationCurrent(state, expectedGeneration);\n  if (!generationIsCurrent()) return;\n\n  const runtime = state.runtime;\n  const encapsulationKeyPair = runtime.crypto.encapsulationKeyPair;\n  if (\n    !encapsulationKeyPair ||\n    !runtime.auth.isAuthenticated ||\n    !runtime.state.online ||\n    !currentRecord?.documentId\n  ) {\n    return;\n  }\n\n  const attachments = getDocumentAttachments(currentDoc);\n  if (attachments.length === 0) {\n    return;\n  }\n\n  const signalSequence = state.remoteUpdateSignalSeq;\n  if (\n    bindingsAlreadyChecked(\n      state,\n      currentDoc,\n      currentRecord.documentId,\n      attachments,\n      signalSequence,\n    )\n  )\n    return;\n\n  const expectedStorageKeys = { ...state.attachmentStorageKeyBySlotId };\n  let bindingsChecked = false;\n  const hydratedBlobs = await hydrateDocumentAttachmentBlobs({\n    apiClient: runtime.apiClient,\n    onBindingsChecked: () => {\n      bindingsChecked = true;\n    },\n    attachments,\n    documentId: currentRecord.documentId,\n    execSql: runtime.infra.execSql,\n    localBlobIdBySlotId: state.attachmentBlobIdBySlotId,\n    localStorageKeyBySlotId: state.attachmentStorageKeyBySlotId,\n    log: runtime.util.log,\n    rejectedServedBindings: state.rejectedServedAttachmentBindings,\n    reportSecurityIncident: runtime.util.reportSecurityIncident,\n    resolveProjectionUserKey:\n      expectedGeneration?.resolveProjectionUserKey ??\n      state.resolveProjectionUserKey,\n    targetSecretKey: encapsulationKeyPair.secretKey,\n    stillCurrent: generationIsCurrent,\n    warmReferencedPrincipalPolicies:\n      createRuntimePrincipalPolicyWarmer(runtime),\n  });\n  if (!generationIsCurrent()) return;\n  if (!hydratedBlobs) {\n    return;\n  }\n\n  for (const hydratedBlob of hydratedBlobs) {\n    await commitHydratedAttachment({\n      state,\n      currentDoc,\n      hydratedBlob,\n      generationIsCurrent,\n      expectedStorageKey:\n        expectedStorageKeys[hydratedBlob.attachment.slotId] ?? null,\n    });\n  }\n  if (\n    bindingsChecked &&\n    generationIsCurrent() &&\n    hydratedBlobs.every(\n      (blob) =>\n        state.attachmentBlobIdBySlotId[blob.attachment.slotId] ===\n        blob.binding.blobId,\n    )\n  ) {\n    checkedSignals.set(state, {\n      documentId: currentRecord.documentId,\n      document: new WeakRef(currentDoc),\n      sequence: signalSequence,\n    });\n  }\n  void runDocumentOrphanMaintenance(state);\n}\n\nfunction bindingsAlreadyChecked(\n  state: DocumentStoreState,\n  currentDoc: DocumentState,\n  documentId: string,\n  attachments: ReturnType<typeof getDocumentAttachments>,\n  signalSequence: number,\n): boolean {\n  const checked = checkedSignals.get(state);\n  const needsBindingProbe =\n    signalSequence >\n    (checked?.documentId === documentId &&\n    checked.document.deref() === currentDoc\n      ? checked.sequence\n      : 0);\n  return (\n    !needsBindingProbe &&\n    attachments.every(\n      (attachment) =>\n        state.attachmentStorageKeyBySlotId[attachment.slotId] &&\n        state.attachmentContentSha256BySlotId[attachment.slotId] ===\n          attachment.contentSha256,\n    )\n  );\n}\n"]}

package/stores/documents/documentStore/attachments/attachmentHydrationCommit.js

@@ -0,0 +1,53 @@
+import { getDocumentAttachments } from "../../../../data/documents/documentContent.js";
+import { runSerializedDocumentBlobMutation, } from "../../../../workflows/documents/index.js";
+import { saveHydratedDocumentAttachment } from "../../../../workflows/documents/attachments/attachmentPersistence.js";
+import { installLocalAttachmentRecords, removeLocalAttachmentSlot, } from "./attachmentPersistence.js";
+export async function commitHydratedAttachment(input) {
+    const { state, currentDoc, hydratedBlob, expectedStorageKey, generationIsCurrent, } = input;
+    const runtime = state.runtime;
+    const expectedSnapshotEndVersion = state.record?.snapshotEndVersion ?? null;
+    const stillCurrent = () => generationIsCurrent() &&
+        state.doc === currentDoc &&
+        getDocumentAttachments(currentDoc).some((attachment) => attachment.slotId === hydratedBlob.attachment.slotId &&
+            attachment.contentSha256 === hydratedBlob.attachment.contentSha256);
+    await runSerializedDocumentBlobMutation(runtime.infra.execSql, hydratedBlob.storageKey, async () => {
+        if (!stillCurrent())
+            return;
+        await runtime.infra.blobStore.writeBytes(hydratedBlob.storageKey, hydratedBlob.bytes);
+        const attachment = {
+            blobId: hydratedBlob.binding.blobId,
+            // The held bytes' own size, not the document intent's: a served
+            // binding the intent has not recorded yet may differ in length, and
+            // preview gating reads the local record.
+            byteLength: hydratedBlob.bytes.byteLength,
+            contentSha256: hydratedBlob.contentSha256,
+            detachedAt: null,
+            localId: state.localId,
+            mimeType: hydratedBlob.attachment.mimeType,
+            slotId: hydratedBlob.attachment.slotId,
+            storageKey: hydratedBlob.storageKey,
+        };
+        const committed = await saveHydratedDocumentAttachment({
+            execSql: runtime.infra.execSql,
+            persistence: state.persistence,
+            attachment,
+            expectedStorageKey,
+            expectedSnapshotEndVersion,
+            stillCurrent,
+        });
+        if (committed && stillCurrent())
+            installLocalAttachmentRecords(state, [attachment], currentDoc);
+        else if (!committed && stillCurrent())
+            await refreshRefusedAttachmentSlot(input, stillCurrent);
+    });
+}
+async function refreshRefusedAttachmentSlot(input, stillCurrent) {
+    const { state, currentDoc, hydratedBlob } = input;
+    const rows = await state.persistence.listLocalAttachments(state.runtime.infra.execSql, state.localId);
+    if (!stillCurrent())
+        return;
+    const slotId = hydratedBlob.attachment.slotId;
+    removeLocalAttachmentSlot(state, slotId);
+    installLocalAttachmentRecords(state, rows.filter((row) => row.slotId === slotId), currentDoc);
+}
+//# sourceMappingURL=attachmentHydrationCommit.js.map