npm - @tearleads/client-sdk - Versions diffs - 0.1.76 → 0.1.78 - Mend

@tearleads/client-sdk 0.1.76 → 0.1.78

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (179) hide show

package/stores/documents/documentStore/sync/syncAttachments.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"syncAttachments.js","sourceRoot":"","sources":["syncAttachments.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAGlB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAEL,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,0CAA0C,CAAC;AASlD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAiBpD,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,UAAuC;IAEvC,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,oBAAiD;IAEjD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,qCAAqC,CAC/D,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC;IAElD,MAAM,QAAQ,GAA2B;QACvC,qBAAqB,EAAE,IAAI,GAAG,EAAE;QAChC,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,KAAK,MAAM,iBAAiB,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;YACvD,iBAAiB;YACjB,QAAQ;YACR,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,oBAAoB;YACpB,oBAAoB;YACpB,iBAAiB;YACjB,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YACtD,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACtD,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACzD,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAChC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;YACvD,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;QAC1D,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,gEAAgE;IAChE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,WAAW,GACf,iBAAiB,CAAC,MAAM,IAAI,IAAI;QAChC,0BAA0B,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAC1E,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qCAAqC,CAClD,KAAyB,EACzB,UAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,UAAwC;IAExC,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CACzB,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,CACX,CAAC;AACJ,CAAC;AAWD,KAAK,UAAU,0BAA0B,CACvC,KAAmC;IAEnC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACjD,MAAM,aAAa,GAAG,KAAK,CAAC,qBAAqB,CAAC,GAAG,CACnD,iBAAiB,CAAC,MAAM,CACzB,CAAC;IACF,IAAI,CAAC,eAAe,IAAI,aAAa,EAAE,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,kCAAkC,CAAC;QACpD,MAAM,EAAE,eAAe,CAAC,MAAM;QAC9B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,OAAO,EAAE,aAAa;YACtB,iBAAiB;YACjB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,KAAK;YACL,UAAU;SACX,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6BAA6B,CAAC;YAC5B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,KAAK;YACL,iBAAiB;YACjB,KAAK;YACL,UAAU;SACX,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,KAOxC;IACC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;IACzD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QAC7C,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,iBAAiB,EACf,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACrE,EAAE,SAAS,IAAI,IAAI;QACvB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACzD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QAC7C,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpC,MAAM,KAAK,CAAC,MAAM,CAAC,kBAAkB,CACnC,OAAO,EACP,KAAK,CAAC,aAAa,CAAC,gBAAgB,CACrC,CAAC;YACF,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC,SAAS;QACnE,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;IACzD,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB,EAAE,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,gBAAgB;QACzE,CAAC,CAAC,KAAK,CAAC,gBAAgB;QACxB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,yCAAyC,CAAC;YACpE,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK;YACL,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,iBAAiB,EAAE,CAAC;gBACtB,KAAK,CAAC,UAAU,CAAC,aAAa,CAC5B,IAAI,KAAK,CAAC,0DAA0D,CAAC,CACtE,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,6BAA6B,CAAC;gBAC5B,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB;gBAC9D,KAAK,EAAE,WAAW;gBAClB,iBAAiB;gBACjB,KAAK;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,wBAAwB,CAAC;YAC7B,qBAAqB,EAAE,KAAK,CAAC,aAAa,CAAC,qBAAqB;YAChE,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB;YAC9D,iBAAiB;YACjB,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB;YACtD,KAAK;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,0BAA0B;SAC3B,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6BAA6B,CAAC;YAC5B,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB;YAC9D,KAAK;YACL,iBAAiB;YACjB,KAAK;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAmC;IAEnC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC3C,2EAA2E;IAC3E,kEAAkE;IAClE,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/D,iBAAiB,CAAC,UAAU,CAC7B,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iFAAiF,CAClF,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB;QACjB,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IACH,4EAA4E;IAC5E,wEAAwE;IACxE,0CAA0C;IAC1C,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,UAAU,GAAG,kCAAkC,CAAC;QACpD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,iBAAiB;KAClB,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,+BAA+B,CAAC;QACtD,MAAM;QACN,aAAa,EAAE,KAAK;QACpB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,QAAQ;QACxB,UAAU;KACX,CAAC,CAAC;IACH,OAAO,4BAA4B,CAAC;QAClC,eAAe;QACf,aAAa,EAAE,KAAK;QACpB,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CAAC,KAMtC;IACC,MAAM,KAAK,GAAG,iCAAiC,CAC7C,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,KAAK,wBAAwB,CAC3B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,KAAK,EAAE,aAAa,EAAE,EAAE;QACtB,IACE,CAAC,oCAAoC,CACnC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,oBAAoB,CAC3B,EACD,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAC7B,aAAa,EACb,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAC7D;YACE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,IAAI;SACb,CACF,CAAC;IACJ,CAAC,CACF,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["import type { BlobSourceSnapshot } from \"../../../../data/documents/blob/shared/blobSourceSnapshot\";\nimport type { BlobByteSource } from \"../../../../workflows/blobs\";\nimport type { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from \"../../../../workflows/blobs/upload\";\nimport {\n clearDocumentSyncFailure,\n DOCUMENTS_APP_KIND,\n type DocumentRecord,\n type PendingAttachmentRecord,\n recordDocumentSyncFailure,\n resolveDocumentCreateAuthor,\n runSerializedSqlMutation,\n} from \"../../../../workflows/documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../../workflows/principals/runtimePolicyWarmer\";\nimport { markOriginatedDocuments } from \"../../../../workflows/sync\";\nimport { requestDocumentStoreSync } from \"../../registry\";\nimport {\n dropUnavailablePendingAttachment,\n pendingAttachmentMatchesIntent,\n resolveAttachmentSourceUpload,\n} from \"../attachmentUpload/attachmentSourceUpload\";\nimport { uploadAttachmentWithWriterProjectionRetry } from \"../attachmentUpload/attachmentUploadAttempt\";\nimport {\n type AttachmentUploadLaneReporter,\n createAttachmentUploadFailedError,\n createAttachmentUploadLaneReporter,\n} from \"../attachmentUpload/attachmentUploadLane\";\nimport type { AttachmentUploadResume } from \"../attachmentUpload/attachmentUploadResume\";\nimport type {\n DocumentAttachmentBinding,\n DocumentState,\n DocumentStoreState,\n EncapsulationKeyPair,\n PendingMutationSyncResult,\n} from \"../state\";\nimport {\n isNewPendingAttachmentSlot,\n removeSettledPendingAttachment,\n settleRecoveredAttachment,\n settleUploadedAttachment,\n} from \"./syncAttachmentSettlement\";\nimport {\n type DocumentStoreSyncGeneration,\n isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { ensureRemoteDocument } from \"./syncShared\";\n\n// Preserve transient failures for retry. Drop irrecoverable missing bytes so a\n// pending attachment cannot wedge the document sync lane across restarts.\ntype PendingAttachmentUploadOutcome =\n \| \"uploaded\"\n \| \"recovered\"\n \| \"retry\"\n \| \"dropped\";\n\ninterface AttachmentSyncProgress {\n activeBindingBySlotId: Map<string, DocumentAttachmentBinding>;\n fetchedRemoteBindings: boolean;\n settledAttachment: boolean;\n uploadedAttachment: boolean;\n}\n\nfunction rearmStaleAttachmentSync(\n state: DocumentStoreState,\n generation: DocumentStoreSyncGeneration,\n): void {\n if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n requestDocumentStoreSync(state);\n }\n}\n\nexport async function syncPendingAttachments(\n state: DocumentStoreState,\n nextRecord: DocumentRecord,\n encapsulationKeyPair: EncapsulationKeyPair,\n attachmentGeneration: DocumentStoreSyncGeneration,\n): Promise<PendingMutationSyncResult> {\n if (state.pendingAttachments.length === 0) {\n return { completed: false, nextRecord };\n }\n\n const currentDoc = state.doc;\n if (!currentDoc) {\n return { completed: false, nextRecord };\n }\n\n const currentRecord = await ensureRemoteDocumentForAttachmentSync(\n state,\n currentDoc,\n nextRecord,\n encapsulationKeyPair,\n attachmentGeneration,\n );\n if (!currentRecord?.documentId) {\n return { completed: false, nextRecord };\n }\n const remoteDocumentId = currentRecord.documentId;\n\n const progress: AttachmentSyncProgress = {\n activeBindingBySlotId: new Map(),\n fetchedRemoteBindings: false,\n settledAttachment: false,\n uploadedAttachment: false,\n };\n\n for (const pendingAttachment of [...state.pendingAttachments]) {\n if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n requestDocumentStoreSync(state);\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n const bindingsReady = await loadRemoteAttachmentBindings({\n pendingAttachment,\n progress,\n remoteDocumentId,\n state,\n });\n if (!bindingsReady) {\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n\n const outcome = await syncPendingAttachmentUpload({\n activeBindingBySlotId: progress.activeBindingBySlotId,\n attachmentGeneration,\n encapsulationKeyPair,\n pendingAttachment,\n remoteDocumentId,\n state,\n });\n if (outcome === \"retry\") {\n rearmStaleAttachmentSync(state, attachmentGeneration);\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n\n // Re-check after the upload's awaits: settling writes local rows, which a\n // teardown that happened mid-upload has just deleted on purpose.\n if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n requestDocumentStoreSync(state);\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n removeSettledPendingAttachment(state, currentDoc, pendingAttachment);\n if (outcome === \"uploaded\" \|\| outcome === \"recovered\") {\n progress.settledAttachment = true;\n }\n if (outcome === \"uploaded\") {\n progress.uploadedAttachment = true;\n }\n }\n\n if (!progress.settledAttachment) {\n return { completed: false, nextRecord: currentRecord };\n }\n\n // Only record the origination once a write landed: the server echoes a\n // document_update_created for it, and this lets the reconciler skip\n // rediscovering a delta we already have locally rather than cycling its lane\n // per uploaded file. Marking here (not before the loop) avoids a dangling id\n // that would suppress the next genuine remote update if every upload failed.\n if (progress.uploadedAttachment) {\n markOriginatedDocuments(state.runtime.state.domainScope, [\n remoteDocumentId,\n ]);\n }\n\n // A settled attachment pass invalidates any recorded failure itself: a\n // retried upload with no pending CRDT update never reaches the document\n // submission that would otherwise clear it, and the stale row would flag the\n // next unrelated edit as failed before it was attempted.\n await clearDocumentSyncFailure(state.runtime.infra.execSql, {\n appKind: DOCUMENTS_APP_KIND,\n localId: state.localId,\n });\n\n // The snapshot was already republished progressively inside the loop as each\n // attachment settled, so there is nothing left to publish here.\n return { completed: true, nextRecord: currentRecord };\n}\n\nasync function loadRemoteAttachmentBindings(input: {\n pendingAttachment: PendingAttachmentRecord;\n progress: AttachmentSyncProgress;\n remoteDocumentId: string;\n state: DocumentStoreState;\n}): Promise<boolean> {\n const { pendingAttachment, progress, state } = input;\n const freshUpload =\n pendingAttachment.upload == null &&\n isNewPendingAttachmentSlot(state, pendingAttachment);\n if (progress.fetchedRemoteBindings \|\| freshUpload) {\n return true;\n }\n\n const remoteBindings = await state.runtime.apiClient.listDocumentAttachments(\n input.remoteDocumentId,\n );\n if (!remoteBindings) {\n return false;\n }\n\n progress.fetchedRemoteBindings = true;\n for (const binding of remoteBindings) {\n progress.activeBindingBySlotId.set(binding.slotId, binding);\n }\n return true;\n}\n\nasync function ensureRemoteDocumentForAttachmentSync(\n state: DocumentStoreState,\n currentDoc: DocumentState,\n nextRecord: DocumentRecord,\n encapsulationKeyPair: EncapsulationKeyPair,\n generation?: DocumentStoreSyncGeneration,\n): Promise<DocumentRecord \| null> {\n if (nextRecord.documentId) {\n return nextRecord;\n }\n\n return ensureRemoteDocument(\n state,\n currentDoc,\n nextRecord,\n encapsulationKeyPair,\n generation,\n );\n}\n\ninterface PendingAttachmentUploadInput {\n activeBindingBySlotId: Map<string, DocumentAttachmentBinding>;\n attachmentGeneration: DocumentStoreSyncGeneration;\n encapsulationKeyPair: EncapsulationKeyPair;\n pendingAttachment: PendingAttachmentRecord;\n remoteDocumentId: string;\n state: DocumentStoreState;\n}\n\nasync function recoverCommittedAttachment(\n input: PendingAttachmentUploadInput,\n): Promise<boolean> {\n const { pendingAttachment, state } = input;\n const persistedUpload = pendingAttachment.upload;\n const activeBinding = input.activeBindingBySlotId.get(\n pendingAttachment.slotId,\n );\n if (!persistedUpload \|\| activeBinding?.blobId !== persistedUpload.blobId) {\n return false;\n }\n\n const uploadLane = createAttachmentUploadLaneReporter({\n blobId: persistedUpload.blobId,\n domainScope: state.runtime.state.domainScope,\n pendingAttachment,\n });\n try {\n await settleRecoveredAttachment({\n attachmentGeneration: input.attachmentGeneration,\n binding: activeBinding,\n pendingAttachment,\n remoteDocumentId: input.remoteDocumentId,\n state,\n uploadLane,\n });\n return true;\n } catch (error) {\n reportAttachmentUploadFailure({\n attachmentGeneration: input.attachmentGeneration,\n error,\n pendingAttachment,\n state,\n uploadLane,\n });\n throw error;\n }\n}\n\nfunction createAttachmentBaseUploadInput(input: {\n author: Parameters<typeof uploadDocumentAttachment>[0][\"author\"];\n pendingUpload: PendingAttachmentUploadInput;\n resume: AttachmentUploadResume;\n source: BlobByteSource;\n sourceSnapshot: BlobSourceSnapshot;\n uploadLane: AttachmentUploadLaneReporter;\n}): Parameters<typeof uploadDocumentAttachment>[0] {\n const { pendingAttachment, state } = input.pendingUpload;\n return {\n apiClient: state.runtime.apiClient,\n author: input.author,\n blobId: input.resume.blobId,\n bytes: input.source,\n contentKey: input.resume.contentKey,\n contentKeyEpoch: input.resume.contentKeyEpoch,\n documentId: input.pendingUpload.remoteDocumentId,\n execSql: state.runtime.infra.execSql,\n expectedBindingId:\n input.pendingUpload.activeBindingBySlotId.get(pendingAttachment.slotId)\n ?.bindingId ?? null,\n nonceSeed: input.resume.nonceSeed,\n multipart: input.resume.multipart,\n onMultipartProgress: input.uploadLane.onMultipartProgress,\n onStageResolved: input.resume.onStageResolved,\n onStageUnavailable: async (stageId) => {\n await input.resume.onStageUnavailable(\n stageId,\n input.pendingUpload.remoteDocumentId,\n );\n requestDocumentStoreSync(state);\n },\n resolveProjectionUserKey: state.resolveProjectionUserKey,\n slotId: pendingAttachment.slotId,\n sourceSnapshot: input.sourceSnapshot,\n targetSecretKey: input.pendingUpload.encapsulationKeyPair.secretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n state.runtime,\n ),\n };\n}\n\nasync function uploadPendingAttachmentBytes(input: {\n baseUploadInput: Parameters<typeof uploadDocumentAttachment>[0];\n pendingUpload: PendingAttachmentUploadInput;\n uploadLane: AttachmentUploadLaneReporter;\n}): Promise<PendingAttachmentUploadOutcome> {\n const { pendingAttachment, state } = input.pendingUpload;\n const writerProjection =\n state.writerProjection?.documentId === input.pendingUpload.remoteDocumentId\n ? state.writerProjection\n : null;\n const writerProjectionGeneration = state.writerProjectionGeneration;\n\n try {\n const uploadAttempt = await uploadAttachmentWithWriterProjectionRetry({\n baseUploadInput: input.baseUploadInput,\n state,\n writerProjection,\n });\n const { error: uploadError, remoteSyncBlocked, uploaded } = uploadAttempt;\n if (!uploaded) {\n if (remoteSyncBlocked) {\n input.uploadLane.failIfStarted(\n new Error(\"Attachment upload paused because remote sync is blocked.\"),\n );\n return \"retry\";\n }\n reportAttachmentUploadFailure({\n attachmentGeneration: input.pendingUpload.attachmentGeneration,\n error: uploadError,\n pendingAttachment,\n state,\n uploadLane: input.uploadLane,\n });\n return \"retry\";\n }\n\n await settleUploadedAttachment({\n activeBindingBySlotId: input.pendingUpload.activeBindingBySlotId,\n attachmentGeneration: input.pendingUpload.attachmentGeneration,\n pendingAttachment,\n remoteDocumentId: input.pendingUpload.remoteDocumentId,\n state,\n uploadLane: input.uploadLane,\n uploaded,\n writerProjectionGeneration,\n });\n return \"uploaded\";\n } catch (error) {\n reportAttachmentUploadFailure({\n attachmentGeneration: input.pendingUpload.attachmentGeneration,\n error,\n pendingAttachment,\n state,\n uploadLane: input.uploadLane,\n });\n throw error;\n }\n}\n\nasync function syncPendingAttachmentUpload(\n input: PendingAttachmentUploadInput,\n): Promise<PendingAttachmentUploadOutcome> {\n const { pendingAttachment, state } = input;\n // The binding fetch before this call awaits; a teardown during it must not\n // let a brand-new upload start against rows that no longer exist.\n if (\n !isDocumentStoreSyncGenerationCurrent(state, input.attachmentGeneration)\n ) {\n return \"retry\";\n }\n if (!pendingAttachmentMatchesIntent(input)) {\n return dropUnavailablePendingAttachment(input);\n }\n if (await recoverCommittedAttachment(input)) {\n return \"recovered\";\n }\n\n const source = await state.runtime.infra.blobStore.openByteSource(\n pendingAttachment.storageKey,\n );\n if (!source) {\n return dropUnavailablePendingAttachment(input);\n }\n\n const author = resolveDocumentCreateAuthor(state.runtime);\n if (!author) {\n state.runtime.util.log(\n \"Documents: skipped attachment upload because the writer context is unavailable.\",\n );\n return \"retry\";\n }\n\n const prepared = await resolveAttachmentSourceUpload({\n attachmentGeneration: input.attachmentGeneration,\n pendingAttachment,\n source,\n state,\n });\n // Preparation awaited (byte-source open plus resume resolution); a teardown\n // during those awaits must not let the upload itself start — its remote\n // commit could not be recalled once sent.\n if (\n !isDocumentStoreSyncGenerationCurrent(state, input.attachmentGeneration)\n ) {\n return \"retry\";\n }\n if (!prepared) return dropUnavailablePendingAttachment(input);\n const { resume, snapshot } = prepared;\n const uploadLane = createAttachmentUploadLaneReporter({\n blobId: resume.blobId,\n domainScope: state.runtime.state.domainScope,\n pendingAttachment,\n });\n const baseUploadInput = createAttachmentBaseUploadInput({\n author,\n pendingUpload: input,\n resume,\n source,\n sourceSnapshot: snapshot,\n uploadLane,\n });\n return uploadPendingAttachmentBytes({\n baseUploadInput,\n pendingUpload: input,\n uploadLane,\n });\n}\n\nfunction reportAttachmentUploadFailure(input: {\n attachmentGeneration: DocumentStoreSyncGeneration;\n error: unknown;\n pendingAttachment: PendingAttachmentRecord;\n state: DocumentStoreState;\n uploadLane: AttachmentUploadLaneReporter;\n}): void {\n const error = createAttachmentUploadFailedError(\n input.pendingAttachment,\n input.error,\n );\n input.uploadLane.fail(error);\n input.state.runtime.util.log(`Documents: ${error.message}`);\n // Surface the stuck upload in the write queue; a later successful sync pass\n // for the document clears the record. Validated inside the serialized\n // mutation: a teardown (reset/discard) racing this pass just cleared the\n // failure row, and re-recording it would resurrect a phantom queue entry\n // for work that no longer exists.\n void runSerializedSqlMutation(\n input.state.runtime.infra.execSql,\n async (lockedExecSql) => {\n if (\n !isDocumentStoreSyncGenerationCurrent(\n input.state,\n input.attachmentGeneration,\n )\n ) {\n return;\n }\n await recordDocumentSyncFailure(\n lockedExecSql,\n { appKind: DOCUMENTS_APP_KIND, localId: input.state.localId },\n {\n attemptedAt: new Date().toISOString(),\n message: error.message,\n status: null,\n },\n );\n },\n ).catch(() => undefined);\n}\n"]}
1	+ {"version":3,"file":"syncAttachments.js","sourceRoot":"","sources":["syncAttachments.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAGlB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAEL,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,0CAA0C,CAAC;AASlD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAiBpD,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,UAAuC;IAEvC,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,oBAAiD;IAEjD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,qCAAqC,CAC/D,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC;IAElD,MAAM,QAAQ,GAA2B;QACvC,qBAAqB,EAAE,IAAI,GAAG,EAAE;QAChC,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,KAAK,MAAM,iBAAiB,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;YACvD,iBAAiB;YACjB,QAAQ;YACR,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,oBAAoB;YACpB,oBAAoB;YACpB,iBAAiB;YACjB,gBAAgB;YAChB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YACtD,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,iBAAiB;gBACrC,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACtD,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACzD,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAChC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;YACvD,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;QAC1D,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,gEAAgE;IAChE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,WAAW,GACf,iBAAiB,CAAC,MAAM,IAAI,IAAI;QAChC,0BAA0B,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAC1E,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qCAAqC,CAClD,KAAyB,EACzB,UAAyB,EACzB,UAA0B,EAC1B,oBAA0C,EAC1C,UAAwC;IAExC,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CACzB,KAAK,EACL,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,UAAU,CACX,CAAC;AACJ,CAAC;AAWD,KAAK,UAAU,0BAA0B,CACvC,KAAmC;IAEnC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACjD,MAAM,aAAa,GAAG,KAAK,CAAC,qBAAqB,CAAC,GAAG,CACnD,iBAAiB,CAAC,MAAM,CACzB,CAAC;IACF,IAAI,CAAC,eAAe,IAAI,aAAa,EAAE,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,kCAAkC,CAAC;QACpD,MAAM,EAAE,eAAe,CAAC,MAAM;QAC9B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,OAAO,EAAE,aAAa;YACtB,iBAAiB;YACjB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,KAAK;YACL,UAAU;SACX,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6BAA6B,CAAC;YAC5B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,KAAK;YACL,iBAAiB;YACjB,KAAK;YACL,UAAU;SACX,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,KAOxC;IACC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;IACzD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QAC7C,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,iBAAiB,EACf,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACrE,EAAE,SAAS,IAAI,IAAI;QACvB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACzD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QAC7C,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpC,MAAM,KAAK,CAAC,MAAM,CAAC,kBAAkB,CACnC,OAAO,EACP,KAAK,CAAC,aAAa,CAAC,gBAAgB,CACrC,CAAC;YACF,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC,SAAS;QACnE,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAI3C;IACC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;IACzD,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB,EAAE,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,gBAAgB;QACzE,CAAC,CAAC,KAAK,CAAC,gBAAgB;QACxB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,yCAAyC,CAAC;YACpE,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK;YACL,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,iBAAiB,EAAE,CAAC;gBACtB,KAAK,CAAC,UAAU,CAAC,aAAa,CAC5B,IAAI,KAAK,CAAC,0DAA0D,CAAC,CACtE,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,6BAA6B,CAAC;gBAC5B,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB;gBAC9D,KAAK,EAAE,WAAW;gBAClB,iBAAiB;gBACjB,KAAK;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,wBAAwB,CAAC;YAC7B,qBAAqB,EAAE,KAAK,CAAC,aAAa,CAAC,qBAAqB;YAChE,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB;YAC9D,iBAAiB;YACjB,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB;YACtD,KAAK;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,0BAA0B;SAC3B,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6BAA6B,CAAC;YAC5B,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,oBAAoB;YAC9D,KAAK;YACL,iBAAiB;YACjB,KAAK;YACL,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAmC;IAEnC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC3C,2EAA2E;IAC3E,kEAAkE;IAClE,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/D,iBAAiB,CAAC,UAAU,CAC7B,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,iFAAiF,CAClF,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB;QACjB,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IACH,4EAA4E;IAC5E,wEAAwE;IACxE,0CAA0C;IAC1C,IACE,CAAC,oCAAoC,CAAC,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,UAAU,GAAG,kCAAkC,CAAC;QACpD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,iBAAiB;KAClB,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,+BAA+B,CAAC;QACtD,MAAM;QACN,aAAa,EAAE,KAAK;QACpB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,QAAQ;QACxB,UAAU;KACX,CAAC,CAAC;IACH,OAAO,4BAA4B,CAAC;QAClC,eAAe;QACf,aAAa,EAAE,KAAK;QACpB,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CAAC,KAMtC;IACC,MAAM,KAAK,GAAG,iCAAiC,CAC7C,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,KAAK,wBAAwB,CAC3B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC,KAAK,EAAE,aAAa,EAAE,EAAE;QACtB,IACE,CAAC,oCAAoC,CACnC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,oBAAoB,CAC3B,EACD,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAC7B,aAAa,EACb,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAC7D;YACE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,IAAI;SACb,CACF,CAAC;IACJ,CAAC,CACF,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["import type {\n BlobByteSource,\n BlobSourceSnapshot,\n} from \"../../../../workflows/blobs\";\nimport type { uploadPreparedDocumentAttachment as uploadDocumentAttachment } from \"../../../../workflows/blobs/upload\";\nimport {\n clearDocumentSyncFailure,\n DOCUMENTS_APP_KIND,\n type DocumentRecord,\n type PendingAttachmentRecord,\n recordDocumentSyncFailure,\n resolveDocumentCreateAuthor,\n runSerializedSqlMutation,\n} from \"../../../../workflows/documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../../workflows/principals/runtimePolicyWarmer\";\nimport { markOriginatedDocuments } from \"../../../../workflows/sync\";\nimport { requestDocumentStoreSync } from \"../../registry\";\nimport {\n dropUnavailablePendingAttachment,\n pendingAttachmentMatchesIntent,\n resolveAttachmentSourceUpload,\n} from \"../attachmentUpload/attachmentSourceUpload\";\nimport { uploadAttachmentWithWriterProjectionRetry } from \"../attachmentUpload/attachmentUploadAttempt\";\nimport {\n type AttachmentUploadLaneReporter,\n createAttachmentUploadFailedError,\n createAttachmentUploadLaneReporter,\n} from \"../attachmentUpload/attachmentUploadLane\";\nimport type { AttachmentUploadResume } from \"../attachmentUpload/attachmentUploadResume\";\nimport type {\n DocumentAttachmentBinding,\n DocumentState,\n DocumentStoreState,\n EncapsulationKeyPair,\n PendingMutationSyncResult,\n} from \"../state\";\nimport {\n isNewPendingAttachmentSlot,\n removeSettledPendingAttachment,\n settleRecoveredAttachment,\n settleUploadedAttachment,\n} from \"./syncAttachmentSettlement\";\nimport {\n type DocumentStoreSyncGeneration,\n isDocumentStoreSyncGenerationCurrent,\n} from \"./syncGeneration\";\nimport { ensureRemoteDocument } from \"./syncShared\";\n\n// Preserve transient failures for retry. Drop irrecoverable missing bytes so a\n// pending attachment cannot wedge the document sync lane across restarts.\ntype PendingAttachmentUploadOutcome =\n \| \"uploaded\"\n \| \"recovered\"\n \| \"retry\"\n \| \"dropped\";\n\ninterface AttachmentSyncProgress {\n activeBindingBySlotId: Map<string, DocumentAttachmentBinding>;\n fetchedRemoteBindings: boolean;\n settledAttachment: boolean;\n uploadedAttachment: boolean;\n}\n\nfunction rearmStaleAttachmentSync(\n state: DocumentStoreState,\n generation: DocumentStoreSyncGeneration,\n): void {\n if (!isDocumentStoreSyncGenerationCurrent(state, generation)) {\n requestDocumentStoreSync(state);\n }\n}\n\nexport async function syncPendingAttachments(\n state: DocumentStoreState,\n nextRecord: DocumentRecord,\n encapsulationKeyPair: EncapsulationKeyPair,\n attachmentGeneration: DocumentStoreSyncGeneration,\n): Promise<PendingMutationSyncResult> {\n if (state.pendingAttachments.length === 0) {\n return { completed: false, nextRecord };\n }\n\n const currentDoc = state.doc;\n if (!currentDoc) {\n return { completed: false, nextRecord };\n }\n\n const currentRecord = await ensureRemoteDocumentForAttachmentSync(\n state,\n currentDoc,\n nextRecord,\n encapsulationKeyPair,\n attachmentGeneration,\n );\n if (!currentRecord?.documentId) {\n return { completed: false, nextRecord };\n }\n const remoteDocumentId = currentRecord.documentId;\n\n const progress: AttachmentSyncProgress = {\n activeBindingBySlotId: new Map(),\n fetchedRemoteBindings: false,\n settledAttachment: false,\n uploadedAttachment: false,\n };\n\n for (const pendingAttachment of [...state.pendingAttachments]) {\n if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n requestDocumentStoreSync(state);\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n const bindingsReady = await loadRemoteAttachmentBindings({\n pendingAttachment,\n progress,\n remoteDocumentId,\n state,\n });\n if (!bindingsReady) {\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n\n const outcome = await syncPendingAttachmentUpload({\n activeBindingBySlotId: progress.activeBindingBySlotId,\n attachmentGeneration,\n encapsulationKeyPair,\n pendingAttachment,\n remoteDocumentId,\n state,\n });\n if (outcome === \"retry\") {\n rearmStaleAttachmentSync(state, attachmentGeneration);\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n\n // Re-check after the upload's awaits: settling writes local rows, which a\n // teardown that happened mid-upload has just deleted on purpose.\n if (!isDocumentStoreSyncGenerationCurrent(state, attachmentGeneration)) {\n requestDocumentStoreSync(state);\n return {\n completed: progress.settledAttachment,\n nextRecord: currentRecord,\n };\n }\n removeSettledPendingAttachment(state, currentDoc, pendingAttachment);\n if (outcome === \"uploaded\" \|\| outcome === \"recovered\") {\n progress.settledAttachment = true;\n }\n if (outcome === \"uploaded\") {\n progress.uploadedAttachment = true;\n }\n }\n\n if (!progress.settledAttachment) {\n return { completed: false, nextRecord: currentRecord };\n }\n\n // Only record the origination once a write landed: the server echoes a\n // document_update_created for it, and this lets the reconciler skip\n // rediscovering a delta we already have locally rather than cycling its lane\n // per uploaded file. Marking here (not before the loop) avoids a dangling id\n // that would suppress the next genuine remote update if every upload failed.\n if (progress.uploadedAttachment) {\n markOriginatedDocuments(state.runtime.state.domainScope, [\n remoteDocumentId,\n ]);\n }\n\n // A settled attachment pass invalidates any recorded failure itself: a\n // retried upload with no pending CRDT update never reaches the document\n // submission that would otherwise clear it, and the stale row would flag the\n // next unrelated edit as failed before it was attempted.\n await clearDocumentSyncFailure(state.runtime.infra.execSql, {\n appKind: DOCUMENTS_APP_KIND,\n localId: state.localId,\n });\n\n // The snapshot was already republished progressively inside the loop as each\n // attachment settled, so there is nothing left to publish here.\n return { completed: true, nextRecord: currentRecord };\n}\n\nasync function loadRemoteAttachmentBindings(input: {\n pendingAttachment: PendingAttachmentRecord;\n progress: AttachmentSyncProgress;\n remoteDocumentId: string;\n state: DocumentStoreState;\n}): Promise<boolean> {\n const { pendingAttachment, progress, state } = input;\n const freshUpload =\n pendingAttachment.upload == null &&\n isNewPendingAttachmentSlot(state, pendingAttachment);\n if (progress.fetchedRemoteBindings \|\| freshUpload) {\n return true;\n }\n\n const remoteBindings = await state.runtime.apiClient.listDocumentAttachments(\n input.remoteDocumentId,\n );\n if (!remoteBindings) {\n return false;\n }\n\n progress.fetchedRemoteBindings = true;\n for (const binding of remoteBindings) {\n progress.activeBindingBySlotId.set(binding.slotId, binding);\n }\n return true;\n}\n\nasync function ensureRemoteDocumentForAttachmentSync(\n state: DocumentStoreState,\n currentDoc: DocumentState,\n nextRecord: DocumentRecord,\n encapsulationKeyPair: EncapsulationKeyPair,\n generation?: DocumentStoreSyncGeneration,\n): Promise<DocumentRecord \| null> {\n if (nextRecord.documentId) {\n return nextRecord;\n }\n\n return ensureRemoteDocument(\n state,\n currentDoc,\n nextRecord,\n encapsulationKeyPair,\n generation,\n );\n}\n\ninterface PendingAttachmentUploadInput {\n activeBindingBySlotId: Map<string, DocumentAttachmentBinding>;\n attachmentGeneration: DocumentStoreSyncGeneration;\n encapsulationKeyPair: EncapsulationKeyPair;\n pendingAttachment: PendingAttachmentRecord;\n remoteDocumentId: string;\n state: DocumentStoreState;\n}\n\nasync function recoverCommittedAttachment(\n input: PendingAttachmentUploadInput,\n): Promise<boolean> {\n const { pendingAttachment, state } = input;\n const persistedUpload = pendingAttachment.upload;\n const activeBinding = input.activeBindingBySlotId.get(\n pendingAttachment.slotId,\n );\n if (!persistedUpload \|\| activeBinding?.blobId !== persistedUpload.blobId) {\n return false;\n }\n\n const uploadLane = createAttachmentUploadLaneReporter({\n blobId: persistedUpload.blobId,\n domainScope: state.runtime.state.domainScope,\n pendingAttachment,\n });\n try {\n await settleRecoveredAttachment({\n attachmentGeneration: input.attachmentGeneration,\n binding: activeBinding,\n pendingAttachment,\n remoteDocumentId: input.remoteDocumentId,\n state,\n uploadLane,\n });\n return true;\n } catch (error) {\n reportAttachmentUploadFailure({\n attachmentGeneration: input.attachmentGeneration,\n error,\n pendingAttachment,\n state,\n uploadLane,\n });\n throw error;\n }\n}\n\nfunction createAttachmentBaseUploadInput(input: {\n author: Parameters<typeof uploadDocumentAttachment>[0][\"author\"];\n pendingUpload: PendingAttachmentUploadInput;\n resume: AttachmentUploadResume;\n source: BlobByteSource;\n sourceSnapshot: BlobSourceSnapshot;\n uploadLane: AttachmentUploadLaneReporter;\n}): Parameters<typeof uploadDocumentAttachment>[0] {\n const { pendingAttachment, state } = input.pendingUpload;\n return {\n apiClient: state.runtime.apiClient,\n author: input.author,\n blobId: input.resume.blobId,\n bytes: input.source,\n contentKey: input.resume.contentKey,\n contentKeyEpoch: input.resume.contentKeyEpoch,\n documentId: input.pendingUpload.remoteDocumentId,\n execSql: state.runtime.infra.execSql,\n expectedBindingId:\n input.pendingUpload.activeBindingBySlotId.get(pendingAttachment.slotId)\n ?.bindingId ?? null,\n nonceSeed: input.resume.nonceSeed,\n multipart: input.resume.multipart,\n onMultipartProgress: input.uploadLane.onMultipartProgress,\n onStageResolved: input.resume.onStageResolved,\n onStageUnavailable: async (stageId) => {\n await input.resume.onStageUnavailable(\n stageId,\n input.pendingUpload.remoteDocumentId,\n );\n requestDocumentStoreSync(state);\n },\n resolveProjectionUserKey: state.resolveProjectionUserKey,\n slotId: pendingAttachment.slotId,\n sourceSnapshot: input.sourceSnapshot,\n targetSecretKey: input.pendingUpload.encapsulationKeyPair.secretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n state.runtime,\n ),\n };\n}\n\nasync function uploadPendingAttachmentBytes(input: {\n baseUploadInput: Parameters<typeof uploadDocumentAttachment>[0];\n pendingUpload: PendingAttachmentUploadInput;\n uploadLane: AttachmentUploadLaneReporter;\n}): Promise<PendingAttachmentUploadOutcome> {\n const { pendingAttachment, state } = input.pendingUpload;\n const writerProjection =\n state.writerProjection?.documentId === input.pendingUpload.remoteDocumentId\n ? state.writerProjection\n : null;\n const writerProjectionGeneration = state.writerProjectionGeneration;\n\n try {\n const uploadAttempt = await uploadAttachmentWithWriterProjectionRetry({\n baseUploadInput: input.baseUploadInput,\n state,\n writerProjection,\n });\n const { error: uploadError, remoteSyncBlocked, uploaded } = uploadAttempt;\n if (!uploaded) {\n if (remoteSyncBlocked) {\n input.uploadLane.failIfStarted(\n new Error(\"Attachment upload paused because remote sync is blocked.\"),\n );\n return \"retry\";\n }\n reportAttachmentUploadFailure({\n attachmentGeneration: input.pendingUpload.attachmentGeneration,\n error: uploadError,\n pendingAttachment,\n state,\n uploadLane: input.uploadLane,\n });\n return \"retry\";\n }\n\n await settleUploadedAttachment({\n activeBindingBySlotId: input.pendingUpload.activeBindingBySlotId,\n attachmentGeneration: input.pendingUpload.attachmentGeneration,\n pendingAttachment,\n remoteDocumentId: input.pendingUpload.remoteDocumentId,\n state,\n uploadLane: input.uploadLane,\n uploaded,\n writerProjectionGeneration,\n });\n return \"uploaded\";\n } catch (error) {\n reportAttachmentUploadFailure({\n attachmentGeneration: input.pendingUpload.attachmentGeneration,\n error,\n pendingAttachment,\n state,\n uploadLane: input.uploadLane,\n });\n throw error;\n }\n}\n\nasync function syncPendingAttachmentUpload(\n input: PendingAttachmentUploadInput,\n): Promise<PendingAttachmentUploadOutcome> {\n const { pendingAttachment, state } = input;\n // The binding fetch before this call awaits; a teardown during it must not\n // let a brand-new upload start against rows that no longer exist.\n if (\n !isDocumentStoreSyncGenerationCurrent(state, input.attachmentGeneration)\n ) {\n return \"retry\";\n }\n if (!pendingAttachmentMatchesIntent(input)) {\n return dropUnavailablePendingAttachment(input);\n }\n if (await recoverCommittedAttachment(input)) {\n return \"recovered\";\n }\n\n const source = await state.runtime.infra.blobStore.openByteSource(\n pendingAttachment.storageKey,\n );\n if (!source) {\n return dropUnavailablePendingAttachment(input);\n }\n\n const author = resolveDocumentCreateAuthor(state.runtime);\n if (!author) {\n state.runtime.util.log(\n \"Documents: skipped attachment upload because the writer context is unavailable.\",\n );\n return \"retry\";\n }\n\n const prepared = await resolveAttachmentSourceUpload({\n attachmentGeneration: input.attachmentGeneration,\n pendingAttachment,\n source,\n state,\n });\n // Preparation awaited (byte-source open plus resume resolution); a teardown\n // during those awaits must not let the upload itself start — its remote\n // commit could not be recalled once sent.\n if (\n !isDocumentStoreSyncGenerationCurrent(state, input.attachmentGeneration)\n ) {\n return \"retry\";\n }\n if (!prepared) return dropUnavailablePendingAttachment(input);\n const { resume, snapshot } = prepared;\n const uploadLane = createAttachmentUploadLaneReporter({\n blobId: resume.blobId,\n domainScope: state.runtime.state.domainScope,\n pendingAttachment,\n });\n const baseUploadInput = createAttachmentBaseUploadInput({\n author,\n pendingUpload: input,\n resume,\n source,\n sourceSnapshot: snapshot,\n uploadLane,\n });\n return uploadPendingAttachmentBytes({\n baseUploadInput,\n pendingUpload: input,\n uploadLane,\n });\n}\n\nfunction reportAttachmentUploadFailure(input: {\n attachmentGeneration: DocumentStoreSyncGeneration;\n error: unknown;\n pendingAttachment: PendingAttachmentRecord;\n state: DocumentStoreState;\n uploadLane: AttachmentUploadLaneReporter;\n}): void {\n const error = createAttachmentUploadFailedError(\n input.pendingAttachment,\n input.error,\n );\n input.uploadLane.fail(error);\n input.state.runtime.util.log(`Documents: ${error.message}`);\n // Surface the stuck upload in the write queue; a later successful sync pass\n // for the document clears the record. Validated inside the serialized\n // mutation: a teardown (reset/discard) racing this pass just cleared the\n // failure row, and re-recording it would resurrect a phantom queue entry\n // for work that no longer exists.\n void runSerializedSqlMutation(\n input.state.runtime.infra.execSql,\n async (lockedExecSql) => {\n if (\n !isDocumentStoreSyncGenerationCurrent(\n input.state,\n input.attachmentGeneration,\n )\n ) {\n return;\n }\n await recordDocumentSyncFailure(\n lockedExecSql,\n { appKind: DOCUMENTS_APP_KIND, localId: input.state.localId },\n {\n attemptedAt: new Date().toISOString(),\n message: error.message,\n status: null,\n },\n );\n },\n ).catch(() => undefined);\n}\n"]}

package/workflows/blobs/detach.js CHANGED Viewed

@@ -1,5 +1,5 @@
-import { signBlobAttachmentDetachEvent } from "../../data/documents/blob/shared/events.js";
-import { assertBlobAttachmentDetachResponse } from "../../data/documents/blob/shared/responses.js";
+import { signBlobAttachmentDetachEvent } from "../../data/blobs/attachments/events.js";
+import { assertBlobAttachmentDetachResponse } from "../../data/blobs/attachments/responses.js";
 import { authorizingContainerPathRefs } from "../../data/documents/shared/projection/index.js";
 import { readCanonicalRecord } from "../../data/keying/canonicalJson.js";
 import { requireProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";

package/workflows/blobs/detach.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"detach.js","sourceRoot":"","sources":["detach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,~~yCAAyC~~,CAAC;~~AACxF~~,OAAO,EAAE,kCAAkC,EAAE,MAAM,~~4CAA4C~~,CAAC;~~AAKhG~~,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,MAAM,EACN,SAAS,EACT,MAAM,EACN,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAC9B,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS;QACT,UAAU;QACV,UAAU,EAAE,wBAAwB;QACpC,OAAO;QACP,mBAAmB;QACnB,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC,CACxD,wBAAwB,EACxB,4BAA4B,CAC7B;QACD,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GACpE,QAAQ,CAAC;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;QACV,OAAO;QACP,gBAAgB;QAChB,QAAQ;QACR,MAAM;QACN,4BAA4B,EAAE,QAAQ;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,8BAA8B,CAAC;QACjE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAC9D,4BAA4B,EAAE,QAAQ;KACvC,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,CACnD,MAAM,EACN,SAAS,EACT,OAAO,EACP;QACE,qCAAqC,EAAE,gBAAgB,CAAC,cAAc;KACvE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAElD,kCAAkC,CAAC;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobAttachmentDetachRequest } from \"@tearleads/validators/request\";\nimport { signBlobAttachmentDetachEvent } from \"../../data/~~documents~~/~~blob~~/~~shared/~~events\";\nimport { assertBlobAttachmentDetachResponse } from \"../../data/~~documents~~/~~blob~~/~~shared/~~responses\";\nimport type {\n DetachDocumentAttachmentInput,\n DetachDocumentAttachmentResult,\n} from \"../../data/~~documents~~/~~blob~~/~~shared/~~types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { resolveBlobMutationWriterProjection } from \"./verification/writerProjection\";\n\nexport async function detachDocumentAttachment({\n apiClient,\n author,\n bindingId,\n blobId,\n documentId,\n eventId = crypto.randomUUID(),\n execSql,\n isRemoteSyncBlocked,\n resolveProjectionUserKey,\n signedAt = new Date().toISOString(),\n slotId,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: DetachDocumentAttachmentInput): Promise<DetachDocumentAttachmentResult \| null> {\n const resolved = await resolveBlobMutationWriterProjection({\n apiClient,\n documentId,\n errorLabel: \"Blob attachment detach\",\n execSql,\n isRemoteSyncBlocked,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n resolveProjectionUserKey: requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment detach\",\n ),\n writerProjection,\n });\n if (!resolved) {\n return null;\n }\n const { manifestIdentity, writerProjection: resolvedWriterProjection } =\n resolved;\n\n const pathRefs = authorizingContainerPathRefs(resolvedWriterProjection);\n const { body, event } = await signBlobAttachmentDetachEvent({\n author,\n bindingId,\n blobId,\n documentId,\n eventId,\n manifestIdentity,\n signedAt,\n slotId,\n authorizingContainerPathRefs: pathRefs,\n });\n const request: BlobAttachmentDetachRequest = {\n event: readCanonicalRecord(event, \"Blob attachment detach event\"),\n body: readCanonicalRecord(body, \"Blob attachment detach body\"),\n authorizingContainerPathRefs: pathRefs,\n };\n assertProjectionVerificationCurrent(stillCurrent);\n const response = await apiClient.detachBlobAttachment(\n blobId,\n bindingId,\n request,\n {\n expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,\n },\n );\n if (!response) {\n return null;\n }\n assertProjectionVerificationCurrent(stillCurrent);\n\n assertBlobAttachmentDetachResponse({\n bindingId,\n blobId,\n documentId,\n response,\n slotId,\n });\n\n return {\n request,\n response,\n writerProjection: resolvedWriterProjection,\n };\n}\n"]}
1	+ {"version":3,"file":"detach.js","sourceRoot":"","sources":["detach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAK5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,MAAM,EACN,SAAS,EACT,MAAM,EACN,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAC9B,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS;QACT,UAAU;QACV,UAAU,EAAE,wBAAwB;QACpC,OAAO;QACP,mBAAmB;QACnB,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC,CACxD,wBAAwB,EACxB,4BAA4B,CAC7B;QACD,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GACpE,QAAQ,CAAC;IAEX,MAAM,QAAQ,GAAG,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;QACV,OAAO;QACP,gBAAgB;QAChB,QAAQ;QACR,MAAM;QACN,4BAA4B,EAAE,QAAQ;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,8BAA8B,CAAC;QACjE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC;QAC9D,4BAA4B,EAAE,QAAQ;KACvC,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,CACnD,MAAM,EACN,SAAS,EACT,OAAO,EACP;QACE,qCAAqC,EAAE,gBAAgB,CAAC,cAAc;KACvE,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAElD,kCAAkC,CAAC;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC;AACJ,CAAC","sourcesContent":["import type { BlobAttachmentDetachRequest } from \"@tearleads/validators/request\";\nimport { signBlobAttachmentDetachEvent } from \"../../data/blobs/attachments/events\";\nimport { assertBlobAttachmentDetachResponse } from \"../../data/blobs/attachments/responses\";\nimport type {\n DetachDocumentAttachmentInput,\n DetachDocumentAttachmentResult,\n} from \"../../data/blobs/attachments/types\";\nimport { authorizingContainerPathRefs } from \"../../data/documents/shared/projection\";\nimport { readCanonicalRecord } from \"../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { resolveBlobMutationWriterProjection } from \"./verification/writerProjection\";\n\nexport async function detachDocumentAttachment({\n apiClient,\n author,\n bindingId,\n blobId,\n documentId,\n eventId = crypto.randomUUID(),\n execSql,\n isRemoteSyncBlocked,\n resolveProjectionUserKey,\n signedAt = new Date().toISOString(),\n slotId,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: DetachDocumentAttachmentInput): Promise<DetachDocumentAttachmentResult \| null> {\n const resolved = await resolveBlobMutationWriterProjection({\n apiClient,\n documentId,\n errorLabel: \"Blob attachment detach\",\n execSql,\n isRemoteSyncBlocked,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n resolveProjectionUserKey: requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment detach\",\n ),\n writerProjection,\n });\n if (!resolved) {\n return null;\n }\n const { manifestIdentity, writerProjection: resolvedWriterProjection } =\n resolved;\n\n const pathRefs = authorizingContainerPathRefs(resolvedWriterProjection);\n const { body, event } = await signBlobAttachmentDetachEvent({\n author,\n bindingId,\n blobId,\n documentId,\n eventId,\n manifestIdentity,\n signedAt,\n slotId,\n authorizingContainerPathRefs: pathRefs,\n });\n const request: BlobAttachmentDetachRequest = {\n event: readCanonicalRecord(event, \"Blob attachment detach event\"),\n body: readCanonicalRecord(body, \"Blob attachment detach body\"),\n authorizingContainerPathRefs: pathRefs,\n };\n assertProjectionVerificationCurrent(stillCurrent);\n const response = await apiClient.detachBlobAttachment(\n blobId,\n bindingId,\n request,\n {\n expectedPaymentRequiredOrganizationId: manifestIdentity.organizationId,\n },\n );\n if (!response) {\n return null;\n }\n assertProjectionVerificationCurrent(stillCurrent);\n\n assertBlobAttachmentDetachResponse({\n bindingId,\n blobId,\n documentId,\n response,\n slotId,\n });\n\n return {\n request,\n response,\n writerProjection: resolvedWriterProjection,\n };\n}\n"]}

package/workflows/blobs/hydration/blobChunkDecryption.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { deriveBlobChunkIv } from "../../../internal/crypto/index.js";
-import { contentRecordAdditionalDataBytes } from "../../../data/documents/blob/shared/crypto.js";
+import { contentRecordAdditionalDataBytes } from "../../../data/blobs/attachments/crypto.js";
 import { asWebCryptoBytes } from "../../../data/documents/shared/readers.js";
 export async function decryptBlobChunk(input) {
     const { encrypted, expectedBlobId, organizationId, recordKey, chunk } = input;

package/workflows/blobs/hydration/blobChunkDecryption.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"blobChunkDecryption.js","sourceRoot":"","sources":["blobChunkDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;~~AAEtD~~,OAAO,EAAE,gCAAgC,EAAE,MAAM,~~4CAA4C~~,CAAC;~~AAM9F~~,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAS1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAEC;IAED,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;QAChD,cAAc,EAAE,gCAAgC,CAAC;YAC/C,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,wBAAwB,EAAE,KAAK,CAAC,mBAAmB;YACnD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,cAAc;YACd,mBAAmB,EAAE,SAAS,CAAC,UAAU;SAC1C,CAAC;KACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CACnC,CACF,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,mBAAmB;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAEC;IAED,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,SAAS,CAAC,GAAG,CACX,MAAM,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC3C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { deriveBlobChunkIv } from \"@tearleads/crypto\";\nimport ~~type~~ { ~~BlobBytes~~ } from \"../../../data/blobs/~~blobContracts\";\nimport { contentRecordAdditionalDataBytes } from \"../../../data~~/~~documents/blob/shared/~~crypto\";\nimport type {\n BlobEncryptedBytesHeader,\n BlobEncryptedBytesRecord,\n BlobEncryptedChunk,\n} from \"../../../data/~~documents~~/~~blob~~/~~shared/~~types\";\nimport { asWebCryptoBytes } from \"../../../data/documents/shared/readers\";\n\ninterface BlobChunkDecryption {\n encrypted: BlobEncryptedBytesHeader;\n expectedBlobId: string;\n organizationId: string;\n recordKey: CryptoKey;\n}\n\nexport async function decryptBlobChunk(\n input: BlobChunkDecryption & {\n chunk: BlobEncryptedChunk;\n },\n): Promise<BlobBytes> {\n const { encrypted, expectedBlobId, organizationId, recordKey, chunk } = input;\n const plaintext = new Uint8Array(\n await crypto.subtle.decrypt(\n {\n name: \"AES-GCM\",\n iv: deriveBlobChunkIv(encrypted.iv, chunk.index),\n additionalData: contentRecordAdditionalDataBytes({\n blobId: expectedBlobId,\n chunkCount: encrypted.chunkCount,\n chunkIndex: chunk.index,\n chunkPlaintextByteLength: chunk.plaintextByteLength,\n chunkSize: encrypted.chunkSize,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n contentRecordId: encrypted.contentRecordId,\n metadataHash: encrypted.metadataHash,\n nonceDomainHash: encrypted.nonceDomainHash,\n organizationId,\n plaintextByteLength: encrypted.byteLength,\n }),\n },\n recordKey,\n asWebCryptoBytes(chunk.ciphertext),\n ),\n );\n if (plaintext.byteLength !== chunk.plaintextByteLength)\n throw new Error(\"Blob decrypted chunk byte length mismatch\");\n return plaintext;\n}\n\nexport async function decryptBlobChunks(\n input: Omit<BlobChunkDecryption, \"encrypted\"> & {\n encrypted: BlobEncryptedBytesRecord;\n },\n): Promise<BlobBytes> {\n const decrypted = new Uint8Array(input.encrypted.byteLength);\n for (const chunk of input.encrypted.chunks) {\n decrypted.set(\n await decryptBlobChunk({ ...input, chunk }),\n chunk.index * input.encrypted.chunkSize,\n );\n }\n return decrypted;\n}\n"]}
1	+ {"version":3,"file":"blobChunkDecryption.js","sourceRoot":"","sources":["blobChunkDecryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAO1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAS1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAEC;IAED,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;QAChD,cAAc,EAAE,gCAAgC,CAAC;YAC/C,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,wBAAwB,EAAE,KAAK,CAAC,mBAAmB;YACnD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,cAAc;YACd,mBAAmB,EAAE,SAAS,CAAC,UAAU;SAC1C,CAAC;KACH,EACD,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CACnC,CACF,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,mBAAmB;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAEC;IAED,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,SAAS,CAAC,GAAG,CACX,MAAM,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC3C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { deriveBlobChunkIv } from \"@tearleads/crypto\";\nimport { contentRecordAdditionalDataBytes } from \"../../../data/blobs/attachments/crypto\";\nimport type {\n BlobEncryptedBytesHeader,\n BlobEncryptedBytesRecord,\n BlobEncryptedChunk,\n} from \"../../../data/blobs/attachments/types\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport { asWebCryptoBytes } from \"../../../data/documents/shared/readers\";\n\ninterface BlobChunkDecryption {\n encrypted: BlobEncryptedBytesHeader;\n expectedBlobId: string;\n organizationId: string;\n recordKey: CryptoKey;\n}\n\nexport async function decryptBlobChunk(\n input: BlobChunkDecryption & {\n chunk: BlobEncryptedChunk;\n },\n): Promise<BlobBytes> {\n const { encrypted, expectedBlobId, organizationId, recordKey, chunk } = input;\n const plaintext = new Uint8Array(\n await crypto.subtle.decrypt(\n {\n name: \"AES-GCM\",\n iv: deriveBlobChunkIv(encrypted.iv, chunk.index),\n additionalData: contentRecordAdditionalDataBytes({\n blobId: expectedBlobId,\n chunkCount: encrypted.chunkCount,\n chunkIndex: chunk.index,\n chunkPlaintextByteLength: chunk.plaintextByteLength,\n chunkSize: encrypted.chunkSize,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n contentRecordId: encrypted.contentRecordId,\n metadataHash: encrypted.metadataHash,\n nonceDomainHash: encrypted.nonceDomainHash,\n organizationId,\n plaintextByteLength: encrypted.byteLength,\n }),\n },\n recordKey,\n asWebCryptoBytes(chunk.ciphertext),\n ),\n );\n if (plaintext.byteLength !== chunk.plaintextByteLength)\n throw new Error(\"Blob decrypted chunk byte length mismatch\");\n return plaintext;\n}\n\nexport async function decryptBlobChunks(\n input: Omit<BlobChunkDecryption, \"encrypted\"> & {\n encrypted: BlobEncryptedBytesRecord;\n },\n): Promise<BlobBytes> {\n const decrypted = new Uint8Array(input.encrypted.byteLength);\n for (const chunk of input.encrypted.chunks) {\n decrypted.set(\n await decryptBlobChunk({ ...input, chunk }),\n chunk.index * input.encrypted.chunkSize,\n );\n }\n return decrypted;\n}\n"]}

package/workflows/blobs/hydration/decrypt.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
+import type { BlobEncryptedBytesHeader, DecryptDocumentAttachmentBlobInput } from "../../../data/blobs/attachments/types.js";
 import type { BlobBytes } from "../../../data/blobs/blobContracts.js";
-import type { BlobEncryptedBytesHeader, DecryptDocumentAttachmentBlobInput } from "../../../data/documents/blob/shared/types.js";
 export type AttachmentBlobDecryptionInput = Omit<DecryptDocumentAttachmentBlobInput, "encryptedBytes"> & {
     encrypted: BlobEncryptedBytesHeader;
 };

package/workflows/blobs/hydration/decrypt.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { blobContentMetadataHash, bytesToHex, CONTENT_RECORD_ENCRYPTION_SUITE, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContentRecordNonceDomainHash, makeVerifiedBlobKekTargets, verifyWriteHeader, } from "../../../internal/crypto/index.js";
-import { deriveBlobContentRecordKey } from "../../../data/documents/blob/shared/crypto.js";
-import { unwrapBlobContentKey } from "../../../data/documents/blob/shared/projection.js";
-import { parseBlobEncryptedBytes, readBlobKekTarget, readDocumentManifestIdentity, sortBlobTargets, } from "../../../data/documents/blob/shared/readers.js";
-import { assertBlobContentKeyBundleTargetHash } from "../../../data/documents/blob/shared/responses.js";
+import { deriveBlobContentRecordKey } from "../../../data/blobs/attachments/crypto.js";
+import { unwrapBlobContentKey } from "../../../data/blobs/attachments/projection.js";
+import { parseBlobEncryptedBytes, readBlobKekTarget, readDocumentManifestIdentity, sortBlobTargets, } from "../../../data/blobs/attachments/readers.js";
+import { assertBlobContentKeyBundleTargetHash } from "../../../data/blobs/attachments/responses.js";
 import { importContentKeyMaterial } from "../../../data/documents/shared/contentRecordKeys.js";
 import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection/index.js";
 import { asWebCryptoBytes, readWriteHeader, uniqueSortedStrings, } from "../../../data/documents/shared/readers.js";

package/workflows/blobs/hydration/decrypt.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"decrypt.js","sourceRoot":"","sources":["decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AAKrG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6EAA6E,CAAC;AAEzH,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC9E,IACE,SAAS,CAAC,MAAM,KAAK,cAAc;QACnC,SAAS,CAAC,eAAe,KAAK,cAAc,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,SAAS,CAAC,eAAe,KAAK,gBAAgB,CAAC,eAAe;QAC9D,gBAAgB,CAAC,MAAM,KAAK,cAAc,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,oCAAoC,CAAC,gBAAgB,CAAC,CAAC;IAE7D,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,OAAO,EAAE,CAAC;QACV,cAAc;QACd,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,cAAc;QACxB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,eAAe,KAAK,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,uBAAuB,CAAC;QACzD,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,EAC5D,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,cAAc,EACd,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAK9B,MAAM,gCAAgC,GAAG,gCAAgC,CACvE,wBAAwB,EACxB,kCAAkC,CACnC,CAAC;IACF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;QACxD,OAAO;QACP,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,IAAI,qBAAwE,CAAC;IAC7E,MAAM,wCAAwC,CAAC,gBAAgB,EAAE;QAC/D,0BAA0B,EAAE,IAAI;QAChC,OAAO;QACP,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,qBAAqB,GAAG,aAAa,CAAC;QACxC,CAAC;QACD,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAClC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,4BAA4B,CAAC;QACjC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,cAAc;KACf,CAAC,CAAC;IACH,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,kBAAkB;QAClB,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC;QAClC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,SAAS;QACT,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,2BAA2B,CAAC;QAC1B,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU;QACV,SAAS;QACT,OAAO;QACP,iBAAiB,EAAE,OAAO,CAAC,SAAS;QACpC,SAAS,EAAE,eAAe;QAC1B,GAAG,mBAAmB;QACtB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,kBAAkB;QAClB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,cAAc;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oCAAoC,CACjD,KAAyC;IAEzC,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,uCAAuC,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAC/B,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CACvC,CACF,CACF,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc;QAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,GAAG,OAAO;QACV,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyC;IAEzC,OAAO,CAAC,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAI9B;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,kBAAkB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAI/C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAC7B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvC,iBAAiB,CAAC,MAAM,EAAE,8BAA8B,KAAK,GAAG,CAAC,CAClE,CACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,IACE,UAAU,KAAK,UAAU,CAAC,iBAAiB;QAC3C,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,KAAK,CAAC,wBAAwB;QAC9B,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACvD,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACtC,MAAM,CAAC,UAAU,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAC7D,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,6BAA6B;QAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC/D,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,0BAA0B;QAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7D,KAAK,EAAE,gCAAgC;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,6BAA6B,CAAC;QAC7D,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,6BAA6B,EAAE,UAAU,CAAC,6BAA6B;QACvE,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC,CAAC;IACH,IAAI,kBAAkB,KAAK,UAAU,CAAC,sBAAsB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAsD;IAEtD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,gBAAgB,CACrB,mBAAmB,CACjB,OAAO,CAAC,YAAY,CAAC,IAAI,EACzB,+BAA+B,CAChC,EACD,YAAY,EACZ,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAQ5C;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;QACxC,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;QAC5C,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;IACH,IACE,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,CAAC,YAAY;QACpD,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,iBAAiB,EAAE;YACjB,yBAAyB,EAAE,0BAA0B,CAAC;gBACpD,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;gBACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;aAC1D,CAAC,CAAC,wBAAwB;YAC3B,cAAc;YACd,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;SACzD;QACD,0BAA0B,EAAE,cAAc,CAAC,sBAAsB;QACjE,cAAc,EAAE;YACd,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;QACD,kBAAkB,EAAE,cAAc,CAAC,iBAAiB;QACpD,MAAM;QACN,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import {\n blobContentMetadataHash,\n bytesToHex,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContentRecordNonceDomainHash,\n makeVerifiedBlobKekTargets,\n verifyWriteHeader,\n} from \"@tearleads/crypto\";\nimport type { BlobKekTargetsResponse } from \"@tearleads/validators/response\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport { deriveBlobContentRecordKey } from \"../../../data/documents/blob/shared/crypto\";\nimport { unwrapBlobContentKey } from \"../../../data/documents/blob/shared/projection\";\nimport {\n parseBlobEncryptedBytes,\n readBlobKekTarget,\n readDocumentManifestIdentity,\n sortBlobTargets,\n} from \"../../../data/documents/blob/shared/readers\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../../data/documents/blob/shared/responses\";\nimport type {\n BlobEncryptedBytesHeader,\n DecryptDocumentAttachmentBlobInput,\n} from \"../../../data/documents/blob/shared/types\";\nimport { importContentKeyMaterial } from \"../../../data/documents/shared/contentRecordKeys\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport {\n asWebCryptoBytes,\n readWriteHeader,\n uniqueSortedStrings,\n} from \"../../../data/documents/shared/readers\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport {\n readRecordString,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport { resolveEventContainerPaths } from \"../../../data/keyingProjectionVerification/document/documentDependencyPaths\";\n\nimport { assertAttachmentBindingVerified } from \"../verification/attachmentBindingVerification\";\nimport { assertBlobWrapScopeVerified } from \"../verification/verifiedWrapScope\";\nimport { decryptBlobChunks } from \"./blobChunkDecryption\";\n\nasync function assertBlobEncryptionMetadata(input: {\n readonly contentKeyBundle: DecryptDocumentAttachmentBlobInput[\"binding\"][\"contentKeyBundle\"];\n readonly encrypted: BlobEncryptedBytesHeader;\n readonly expectedBlobId: string;\n readonly organizationId: string;\n}): Promise<void> {\n const { contentKeyBundle, encrypted, expectedBlobId, organizationId } = input;\n if (\n encrypted.blobId !== expectedBlobId \|\|\n encrypted.contentRecordId !== expectedBlobId\n ) {\n throw new Error(\"Blob encrypted bytes blob id mismatch\");\n }\n if (\n encrypted.contentKeyEpoch !== contentKeyBundle.contentKeyEpoch \|\|\n contentKeyBundle.blobId !== expectedBlobId\n ) {\n throw new Error(\"Blob encrypted bytes content-key bundle mismatch\");\n }\n await assertBlobContentKeyBundleTargetHash(contentKeyBundle);\n\n const expectedNonceDomainHash = await computeContentRecordNonceDomainHash({\n version: 1,\n organizationId,\n objectKind: \"blob\",\n objectId: expectedBlobId,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n contentRecordId: encrypted.contentRecordId,\n });\n if (encrypted.nonceDomainHash !== expectedNonceDomainHash) {\n throw new Error(\"Blob encrypted bytes nonce domain mismatch\");\n }\n const expectedMetadataHash = await blobContentMetadataHash({\n blobId: expectedBlobId,\n byteLength: encrypted.byteLength,\n chunkCount: encrypted.chunkCount,\n chunkSize: encrypted.chunkSize,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n });\n if (encrypted.metadataHash !== expectedMetadataHash) {\n throw new Error(\"Blob encrypted bytes metadata hash mismatch\");\n }\n}\n\nexport type AttachmentBlobDecryptionInput = Omit<\n DecryptDocumentAttachmentBlobInput,\n \"encryptedBytes\"\n> & {\n encrypted: BlobEncryptedBytesHeader;\n};\n\n/** Verifies metadata and authority; the caller must still authenticate ciphertext. */\nexport async function prepareDocumentAttachmentBlobDecryption({\n binding,\n encrypted,\n expectedDocumentId,\n expectedSlotId,\n execSql,\n resolveProjectionUserKey,\n targetSecretKey,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: AttachmentBlobDecryptionInput): Promise<{\n contentKey: Uint8Array;\n recordKey: CryptoKey;\n organizationId: string;\n}> {\n const requiredResolveProjectionUserKey = requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment blob decrypt\",\n );\n const verificationOptions = projectionVerificationOptions({\n execSql,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n resolveProjectionUserKey: requiredResolveProjectionUserKey,\n });\n let documentAuthorization: DocumentWriterProjectionAuthorization \| undefined;\n await assertDocumentWriterProjectionConsistent(writerProjection, {\n allowStaleContentKeyBundle: true,\n execSql,\n onVerifiedAuthorization: (authorization) => {\n documentAuthorization = authorization;\n },\n ...verificationOptions,\n });\n const { documentId, organizationId } =\n readDocumentManifestIdentity(writerProjection);\n await assertBlobEncryptionMetadata({\n contentKeyBundle: binding.contentKeyBundle,\n encrypted,\n expectedBlobId: binding.blobId,\n organizationId,\n });\n await assertAttachmentBindingVerified({\n authorization: documentAuthorization,\n binding,\n expectedDocumentId,\n expectedSlotId,\n resolveProjectionUserKey: requiredResolveProjectionUserKey,\n });\n await assertBlobWriteHeaderVerified({\n authorization: documentAuthorization,\n binding,\n encrypted,\n organizationId,\n resolveProjectionUserKey: requiredResolveProjectionUserKey,\n });\n\n if (!documentAuthorization)\n throw new Error(\"Blob document authorization is unavailable\");\n assertBlobWrapScopeVerified({\n authorization: documentAuthorization,\n binding,\n documentId,\n });\n const contentKey = await unwrapBlobContentKey({\n blobId: binding.blobId,\n contentKeyBundle: binding.contentKeyBundle,\n documentId,\n encrypted,\n execSql,\n expectedBindingId: binding.bindingId,\n secretKey: targetSecretKey,\n ...verificationOptions,\n writerProjection,\n });\n const contentKeyMaterial = await importContentKeyMaterial(contentKey);\n const recordKey = await deriveBlobContentRecordKey({\n blobId: binding.blobId,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n contentKeyMaterial,\n contentRecordId: encrypted.contentRecordId,\n organizationId,\n usage: \"decrypt\",\n });\n return { contentKey, recordKey, organizationId };\n}\n\nasync function decryptDocumentAttachmentBlobWithKey(\n input: DecryptDocumentAttachmentBlobInput,\n): Promise<{ bytes: BlobBytes; contentKey: Uint8Array }> {\n const encrypted = parseBlobEncryptedBytes(input.encryptedBytes);\n const context = await prepareDocumentAttachmentBlobDecryption({\n ...input,\n encrypted,\n });\n const header = readWriteHeader(\n input.binding.writeHeader,\n \"Attachment blob write header\",\n );\n const ciphertextHash = bytesToHex(\n new Uint8Array(\n await crypto.subtle.digest(\n \"SHA-256\",\n asWebCryptoBytes(input.encryptedBytes),\n ),\n ),\n );\n if (header.ciphertextHash !== ciphertextHash)\n throw new Error(\"Attachment blob write header does not match ciphertext\");\n const bytes = await decryptBlobChunks({\n ...context,\n encrypted,\n expectedBlobId: input.binding.blobId,\n });\n return { bytes, contentKey: context.contentKey };\n}\n\nexport async function decryptDocumentAttachmentBlob(\n input: DecryptDocumentAttachmentBlobInput,\n): Promise<BlobBytes> {\n return (await decryptDocumentAttachmentBlobWithKey(input)).bytes;\n}\n\nfunction assertStringSetEquals(input: {\n readonly actual: readonly string[];\n readonly expected: readonly string[];\n readonly label: string;\n}): void {\n const actual = uniqueSortedStrings(input.actual);\n const expected = uniqueSortedStrings(input.expected);\n if (\n actual.length !== expected.length \|\|\n actual.some((value, index) => value !== expected[index])\n ) {\n throw new Error(`${input.label} is inconsistent`);\n }\n}\n\nasync function verifiedBlobKekTargetsForBinding(input: {\n readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n readonly requireBindingMembership: boolean;\n readonly projection: BlobKekTargetsResponse \| undefined;\n}) {\n const { binding, projection } = input;\n if (!projection) {\n throw new Error(\"Attachment binding lacks blob KEK verification material\");\n }\n const targets = sortBlobTargets(\n projection.targets.map((target, index) =>\n readBlobKekTarget(target, `Attachment blob KEK target[${index}]`),\n ),\n );\n const targetHash = await computeBlobContentKeyTargetHash(targets);\n if (\n targetHash !== projection.blobKeyTargetHash \|\|\n projection.blobId !== binding.blobId\n ) {\n throw new Error(\"Attachment blob KEK target hash is inconsistent\");\n }\n if (\n input.requireBindingMembership &&\n (!projection.activeBindingIds.includes(binding.bindingId) \|\|\n !targets.some(\n (target) =>\n target.bindingId === binding.bindingId &&\n target.documentId === attachmentBindingDocumentId(binding),\n ))\n ) {\n throw new Error(\"Attachment binding is absent from blob KEK targets\");\n }\n assertStringSetEquals({\n actual: projection.linkedContainerManifestHashes,\n expected: targets.map((target) => target.containerManifestHash),\n label: \"Attachment blob container manifests\",\n });\n assertStringSetEquals({\n actual: projection.linkedContainerKeyEpochIds,\n expected: targets.map((target) => target.containerKeyEpochId),\n label: \"Attachment blob container KEKs\",\n });\n const accessManifestHash = await computeBlobAccessManifestHash({\n version: 1,\n blobId: projection.blobId,\n organizationId: projection.organizationId,\n activeBindingIds: projection.activeBindingIds,\n documentManifestHashes: projection.documentManifestHashes,\n linkedContainerManifestHashes: projection.linkedContainerManifestHashes,\n linkedContainerKeyEpochIds: projection.linkedContainerKeyEpochIds,\n blobKeyTargetHash: projection.blobKeyTargetHash,\n });\n if (accessManifestHash !== projection.blobAccessManifestHash) {\n throw new Error(\"Attachment blob access manifest hash is inconsistent\");\n }\n return makeVerifiedBlobKekTargets({ ...projection, targets });\n}\n\nfunction attachmentBindingDocumentId(\n binding: DecryptDocumentAttachmentBlobInput[\"binding\"],\n): string {\n if (!binding.bindingEvent) {\n throw new Error(\"Attachment binding lacks a signed event\");\n }\n return readRecordString(\n readCanonicalRecord(\n binding.bindingEvent.body,\n \"Attachment binding event body\",\n ),\n \"documentId\",\n \"Attachment binding event body\",\n );\n}\n\nasync function assertBlobWriteHeaderVerified(input: {\n readonly authorization: DocumentWriterProjectionAuthorization \| undefined;\n readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n readonly encrypted: BlobEncryptedBytesHeader;\n readonly organizationId: string;\n readonly resolveProjectionUserKey: ReturnType<\n typeof requireProjectionUserKeyResolver\n >;\n}): Promise<void> {\n if (!input.authorization \|\| !input.binding.writeHeader) {\n throw new Error(\"Attachment blob lacks verified write authority\");\n }\n const header = readWriteHeader(\n input.binding.writeHeader,\n \"Attachment blob write header\",\n );\n const writer = await input.resolveProjectionUserKey(header.writerUserId);\n if (!writer) {\n throw new Error(\"Attachment blob writer identity is unavailable\");\n }\n await verifiedBlobKekTargetsForBinding({\n binding: input.binding,\n projection: input.binding.blobKekTargets,\n requireBindingMembership: true,\n });\n const blobKekTargets = await verifiedBlobKekTargetsForBinding({\n binding: input.binding,\n projection: input.binding.writeAuthorization,\n // The signed binding proves which slot exposes the blob now. Writer\n // authorization describes the older target set committed when the bytes\n // were written, so a later valid binding need not appear in that set.\n requireBindingMembership: false,\n });\n if (\n header.metadataHash !== input.encrypted.metadataHash \|\|\n header.contentKeyEpoch !== input.encrypted.contentKeyEpoch \|\|\n header.contentRecordId !== input.encrypted.contentRecordId \|\|\n header.nonceDomainHash !== input.encrypted.nonceDomainHash\n ) {\n throw new Error(\"Attachment blob write header does not match ciphertext\");\n }\n const verified = await verifyWriteHeader({\n authorizationMembership: \"referenced\",\n blobAuthorization: {\n authorizingContainerPaths: resolveEventContainerPaths({\n containerPathByManifestHash:\n input.authorization.containerPathByManifestHash,\n dependencyManifestHashes: header.dependencyManifestHashes,\n }).dependencyContainerPaths,\n blobKekTargets,\n principalPolicies: input.authorization.principalPolicies,\n },\n expectedAccessManifestHash: blobKekTargets.blobAccessManifestHash,\n expectedObject: {\n objectKind: \"blob\",\n objectId: input.binding.blobId,\n organizationId: input.organizationId,\n },\n expectedTargetHash: blobKekTargets.blobKeyTargetHash,\n header,\n writerPublicKey: writer.signingPublicKey,\n });\n if (!verified.ok) {\n throw verified.error;\n }\n}\n"]}
1	+ {"version":3,"file":"decrypt.js","sourceRoot":"","sources":["decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AAMjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,wCAAwC,EAAE,MAAM,2CAA2C,CAAC;AACrG,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6EAA6E,CAAC;AAEzH,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC9E,IACE,SAAS,CAAC,MAAM,KAAK,cAAc;QACnC,SAAS,CAAC,eAAe,KAAK,cAAc,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,SAAS,CAAC,eAAe,KAAK,gBAAgB,CAAC,eAAe;QAC9D,gBAAgB,CAAC,MAAM,KAAK,cAAc,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,oCAAoC,CAAC,gBAAgB,CAAC,CAAC;IAE7D,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,OAAO,EAAE,CAAC;QACV,cAAc;QACd,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,cAAc;QACxB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,eAAe,KAAK,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,uBAAuB,CAAC;QACzD,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,EAC5D,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,cAAc,EACd,OAAO,EACP,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,+BAA+B,EAC/B,gBAAgB,GACc;IAK9B,MAAM,gCAAgC,GAAG,gCAAgC,CACvE,wBAAwB,EACxB,kCAAkC,CACnC,CAAC;IACF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;QACxD,OAAO;QACP,YAAY;QACZ,+BAA+B;QAC/B,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,IAAI,qBAAwE,CAAC;IAC7E,MAAM,wCAAwC,CAAC,gBAAgB,EAAE;QAC/D,0BAA0B,EAAE,IAAI;QAChC,OAAO;QACP,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,qBAAqB,GAAG,aAAa,CAAC;QACxC,CAAC;QACD,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAClC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,4BAA4B,CAAC;QACjC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,cAAc;KACf,CAAC,CAAC;IACH,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,kBAAkB;QAClB,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC;QAClC,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,SAAS;QACT,cAAc;QACd,wBAAwB,EAAE,gCAAgC;KAC3D,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,2BAA2B,CAAC;QAC1B,aAAa,EAAE,qBAAqB;QACpC,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU;QACV,SAAS;QACT,OAAO;QACP,iBAAiB,EAAE,OAAO,CAAC,SAAS;QACpC,SAAS,EAAE,eAAe;QAC1B,GAAG,mBAAmB;QACtB,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,kBAAkB;QAClB,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,cAAc;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oCAAoC,CACjD,KAAyC;IAEzC,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,uCAAuC,CAAC;QAC5D,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAC/B,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CACvC,CACF,CACF,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc;QAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,GAAG,OAAO;QACV,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyC;IAEzC,OAAO,CAAC,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAI9B;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,kBAAkB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAI/C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAC7B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvC,iBAAiB,CAAC,MAAM,EAAE,8BAA8B,KAAK,GAAG,CAAC,CAClE,CACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,IACE,UAAU,KAAK,UAAU,CAAC,iBAAiB;QAC3C,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,KAAK,CAAC,wBAAwB;QAC9B,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACvD,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACtC,MAAM,CAAC,UAAU,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAC7D,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,6BAA6B;QAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC/D,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IACH,qBAAqB,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,0BAA0B;QAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7D,KAAK,EAAE,gCAAgC;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,6BAA6B,CAAC;QAC7D,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,6BAA6B,EAAE,UAAU,CAAC,6BAA6B;QACvE,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC,CAAC;IACH,IAAI,kBAAkB,KAAK,UAAU,CAAC,sBAAsB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAsD;IAEtD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,gBAAgB,CACrB,mBAAmB,CACjB,OAAO,CAAC,YAAY,CAAC,IAAI,EACzB,+BAA+B,CAChC,EACD,YAAY,EACZ,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,KAQ5C;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,OAAO,CAAC,WAAW,EACzB,8BAA8B,CAC/B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;QACxC,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;QAC5C,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;IACH,IACE,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,CAAC,YAAY;QACpD,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,CAAC,eAAe,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,uBAAuB,EAAE,YAAY;QACrC,iBAAiB,EAAE;YACjB,yBAAyB,EAAE,0BAA0B,CAAC;gBACpD,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;gBACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;aAC1D,CAAC,CAAC,wBAAwB;YAC3B,cAAc;YACd,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;SACzD;QACD,0BAA0B,EAAE,cAAc,CAAC,sBAAsB;QACjE,cAAc,EAAE;YACd,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;QACD,kBAAkB,EAAE,cAAc,CAAC,iBAAiB;QACpD,MAAM;QACN,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import {\n blobContentMetadataHash,\n bytesToHex,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContentRecordNonceDomainHash,\n makeVerifiedBlobKekTargets,\n verifyWriteHeader,\n} from \"@tearleads/crypto\";\nimport type { BlobKekTargetsResponse } from \"@tearleads/validators/response\";\nimport { deriveBlobContentRecordKey } from \"../../../data/blobs/attachments/crypto\";\nimport { unwrapBlobContentKey } from \"../../../data/blobs/attachments/projection\";\nimport {\n parseBlobEncryptedBytes,\n readBlobKekTarget,\n readDocumentManifestIdentity,\n sortBlobTargets,\n} from \"../../../data/blobs/attachments/readers\";\nimport { assertBlobContentKeyBundleTargetHash } from \"../../../data/blobs/attachments/responses\";\nimport type {\n BlobEncryptedBytesHeader,\n DecryptDocumentAttachmentBlobInput,\n} from \"../../../data/blobs/attachments/types\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport { importContentKeyMaterial } from \"../../../data/documents/shared/contentRecordKeys\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../data/documents/shared/projection\";\nimport {\n asWebCryptoBytes,\n readWriteHeader,\n uniqueSortedStrings,\n} from \"../../../data/documents/shared/readers\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport type { DocumentWriterProjectionAuthorization } from \"../../../data/keyingProjectionVerification\";\nimport {\n readRecordString,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport { resolveEventContainerPaths } from \"../../../data/keyingProjectionVerification/document/documentDependencyPaths\";\n\nimport { assertAttachmentBindingVerified } from \"../verification/attachmentBindingVerification\";\nimport { assertBlobWrapScopeVerified } from \"../verification/verifiedWrapScope\";\nimport { decryptBlobChunks } from \"./blobChunkDecryption\";\n\nasync function assertBlobEncryptionMetadata(input: {\n readonly contentKeyBundle: DecryptDocumentAttachmentBlobInput[\"binding\"][\"contentKeyBundle\"];\n readonly encrypted: BlobEncryptedBytesHeader;\n readonly expectedBlobId: string;\n readonly organizationId: string;\n}): Promise<void> {\n const { contentKeyBundle, encrypted, expectedBlobId, organizationId } = input;\n if (\n encrypted.blobId !== expectedBlobId \|\|\n encrypted.contentRecordId !== expectedBlobId\n ) {\n throw new Error(\"Blob encrypted bytes blob id mismatch\");\n }\n if (\n encrypted.contentKeyEpoch !== contentKeyBundle.contentKeyEpoch \|\|\n contentKeyBundle.blobId !== expectedBlobId\n ) {\n throw new Error(\"Blob encrypted bytes content-key bundle mismatch\");\n }\n await assertBlobContentKeyBundleTargetHash(contentKeyBundle);\n\n const expectedNonceDomainHash = await computeContentRecordNonceDomainHash({\n version: 1,\n organizationId,\n objectKind: \"blob\",\n objectId: expectedBlobId,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n contentRecordId: encrypted.contentRecordId,\n });\n if (encrypted.nonceDomainHash !== expectedNonceDomainHash) {\n throw new Error(\"Blob encrypted bytes nonce domain mismatch\");\n }\n const expectedMetadataHash = await blobContentMetadataHash({\n blobId: expectedBlobId,\n byteLength: encrypted.byteLength,\n chunkCount: encrypted.chunkCount,\n chunkSize: encrypted.chunkSize,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n });\n if (encrypted.metadataHash !== expectedMetadataHash) {\n throw new Error(\"Blob encrypted bytes metadata hash mismatch\");\n }\n}\n\nexport type AttachmentBlobDecryptionInput = Omit<\n DecryptDocumentAttachmentBlobInput,\n \"encryptedBytes\"\n> & {\n encrypted: BlobEncryptedBytesHeader;\n};\n\n/** Verifies metadata and authority; the caller must still authenticate ciphertext. */\nexport async function prepareDocumentAttachmentBlobDecryption({\n binding,\n encrypted,\n expectedDocumentId,\n expectedSlotId,\n execSql,\n resolveProjectionUserKey,\n targetSecretKey,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: AttachmentBlobDecryptionInput): Promise<{\n contentKey: Uint8Array;\n recordKey: CryptoKey;\n organizationId: string;\n}> {\n const requiredResolveProjectionUserKey = requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment blob decrypt\",\n );\n const verificationOptions = projectionVerificationOptions({\n execSql,\n stillCurrent,\n warmReferencedPrincipalPolicies,\n resolveProjectionUserKey: requiredResolveProjectionUserKey,\n });\n let documentAuthorization: DocumentWriterProjectionAuthorization \| undefined;\n await assertDocumentWriterProjectionConsistent(writerProjection, {\n allowStaleContentKeyBundle: true,\n execSql,\n onVerifiedAuthorization: (authorization) => {\n documentAuthorization = authorization;\n },\n ...verificationOptions,\n });\n const { documentId, organizationId } =\n readDocumentManifestIdentity(writerProjection);\n await assertBlobEncryptionMetadata({\n contentKeyBundle: binding.contentKeyBundle,\n encrypted,\n expectedBlobId: binding.blobId,\n organizationId,\n });\n await assertAttachmentBindingVerified({\n authorization: documentAuthorization,\n binding,\n expectedDocumentId,\n expectedSlotId,\n resolveProjectionUserKey: requiredResolveProjectionUserKey,\n });\n await assertBlobWriteHeaderVerified({\n authorization: documentAuthorization,\n binding,\n encrypted,\n organizationId,\n resolveProjectionUserKey: requiredResolveProjectionUserKey,\n });\n\n if (!documentAuthorization)\n throw new Error(\"Blob document authorization is unavailable\");\n assertBlobWrapScopeVerified({\n authorization: documentAuthorization,\n binding,\n documentId,\n });\n const contentKey = await unwrapBlobContentKey({\n blobId: binding.blobId,\n contentKeyBundle: binding.contentKeyBundle,\n documentId,\n encrypted,\n execSql,\n expectedBindingId: binding.bindingId,\n secretKey: targetSecretKey,\n ...verificationOptions,\n writerProjection,\n });\n const contentKeyMaterial = await importContentKeyMaterial(contentKey);\n const recordKey = await deriveBlobContentRecordKey({\n blobId: binding.blobId,\n contentKeyEpoch: encrypted.contentKeyEpoch,\n contentKeyMaterial,\n contentRecordId: encrypted.contentRecordId,\n organizationId,\n usage: \"decrypt\",\n });\n return { contentKey, recordKey, organizationId };\n}\n\nasync function decryptDocumentAttachmentBlobWithKey(\n input: DecryptDocumentAttachmentBlobInput,\n): Promise<{ bytes: BlobBytes; contentKey: Uint8Array }> {\n const encrypted = parseBlobEncryptedBytes(input.encryptedBytes);\n const context = await prepareDocumentAttachmentBlobDecryption({\n ...input,\n encrypted,\n });\n const header = readWriteHeader(\n input.binding.writeHeader,\n \"Attachment blob write header\",\n );\n const ciphertextHash = bytesToHex(\n new Uint8Array(\n await crypto.subtle.digest(\n \"SHA-256\",\n asWebCryptoBytes(input.encryptedBytes),\n ),\n ),\n );\n if (header.ciphertextHash !== ciphertextHash)\n throw new Error(\"Attachment blob write header does not match ciphertext\");\n const bytes = await decryptBlobChunks({\n ...context,\n encrypted,\n expectedBlobId: input.binding.blobId,\n });\n return { bytes, contentKey: context.contentKey };\n}\n\nexport async function decryptDocumentAttachmentBlob(\n input: DecryptDocumentAttachmentBlobInput,\n): Promise<BlobBytes> {\n return (await decryptDocumentAttachmentBlobWithKey(input)).bytes;\n}\n\nfunction assertStringSetEquals(input: {\n readonly actual: readonly string[];\n readonly expected: readonly string[];\n readonly label: string;\n}): void {\n const actual = uniqueSortedStrings(input.actual);\n const expected = uniqueSortedStrings(input.expected);\n if (\n actual.length !== expected.length \|\|\n actual.some((value, index) => value !== expected[index])\n ) {\n throw new Error(`${input.label} is inconsistent`);\n }\n}\n\nasync function verifiedBlobKekTargetsForBinding(input: {\n readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n readonly requireBindingMembership: boolean;\n readonly projection: BlobKekTargetsResponse \| undefined;\n}) {\n const { binding, projection } = input;\n if (!projection) {\n throw new Error(\"Attachment binding lacks blob KEK verification material\");\n }\n const targets = sortBlobTargets(\n projection.targets.map((target, index) =>\n readBlobKekTarget(target, `Attachment blob KEK target[${index}]`),\n ),\n );\n const targetHash = await computeBlobContentKeyTargetHash(targets);\n if (\n targetHash !== projection.blobKeyTargetHash \|\|\n projection.blobId !== binding.blobId\n ) {\n throw new Error(\"Attachment blob KEK target hash is inconsistent\");\n }\n if (\n input.requireBindingMembership &&\n (!projection.activeBindingIds.includes(binding.bindingId) \|\|\n !targets.some(\n (target) =>\n target.bindingId === binding.bindingId &&\n target.documentId === attachmentBindingDocumentId(binding),\n ))\n ) {\n throw new Error(\"Attachment binding is absent from blob KEK targets\");\n }\n assertStringSetEquals({\n actual: projection.linkedContainerManifestHashes,\n expected: targets.map((target) => target.containerManifestHash),\n label: \"Attachment blob container manifests\",\n });\n assertStringSetEquals({\n actual: projection.linkedContainerKeyEpochIds,\n expected: targets.map((target) => target.containerKeyEpochId),\n label: \"Attachment blob container KEKs\",\n });\n const accessManifestHash = await computeBlobAccessManifestHash({\n version: 1,\n blobId: projection.blobId,\n organizationId: projection.organizationId,\n activeBindingIds: projection.activeBindingIds,\n documentManifestHashes: projection.documentManifestHashes,\n linkedContainerManifestHashes: projection.linkedContainerManifestHashes,\n linkedContainerKeyEpochIds: projection.linkedContainerKeyEpochIds,\n blobKeyTargetHash: projection.blobKeyTargetHash,\n });\n if (accessManifestHash !== projection.blobAccessManifestHash) {\n throw new Error(\"Attachment blob access manifest hash is inconsistent\");\n }\n return makeVerifiedBlobKekTargets({ ...projection, targets });\n}\n\nfunction attachmentBindingDocumentId(\n binding: DecryptDocumentAttachmentBlobInput[\"binding\"],\n): string {\n if (!binding.bindingEvent) {\n throw new Error(\"Attachment binding lacks a signed event\");\n }\n return readRecordString(\n readCanonicalRecord(\n binding.bindingEvent.body,\n \"Attachment binding event body\",\n ),\n \"documentId\",\n \"Attachment binding event body\",\n );\n}\n\nasync function assertBlobWriteHeaderVerified(input: {\n readonly authorization: DocumentWriterProjectionAuthorization \| undefined;\n readonly binding: DecryptDocumentAttachmentBlobInput[\"binding\"];\n readonly encrypted: BlobEncryptedBytesHeader;\n readonly organizationId: string;\n readonly resolveProjectionUserKey: ReturnType<\n typeof requireProjectionUserKeyResolver\n >;\n}): Promise<void> {\n if (!input.authorization \|\| !input.binding.writeHeader) {\n throw new Error(\"Attachment blob lacks verified write authority\");\n }\n const header = readWriteHeader(\n input.binding.writeHeader,\n \"Attachment blob write header\",\n );\n const writer = await input.resolveProjectionUserKey(header.writerUserId);\n if (!writer) {\n throw new Error(\"Attachment blob writer identity is unavailable\");\n }\n await verifiedBlobKekTargetsForBinding({\n binding: input.binding,\n projection: input.binding.blobKekTargets,\n requireBindingMembership: true,\n });\n const blobKekTargets = await verifiedBlobKekTargetsForBinding({\n binding: input.binding,\n projection: input.binding.writeAuthorization,\n // The signed binding proves which slot exposes the blob now. Writer\n // authorization describes the older target set committed when the bytes\n // were written, so a later valid binding need not appear in that set.\n requireBindingMembership: false,\n });\n if (\n header.metadataHash !== input.encrypted.metadataHash \|\|\n header.contentKeyEpoch !== input.encrypted.contentKeyEpoch \|\|\n header.contentRecordId !== input.encrypted.contentRecordId \|\|\n header.nonceDomainHash !== input.encrypted.nonceDomainHash\n ) {\n throw new Error(\"Attachment blob write header does not match ciphertext\");\n }\n const verified = await verifyWriteHeader({\n authorizationMembership: \"referenced\",\n blobAuthorization: {\n authorizingContainerPaths: resolveEventContainerPaths({\n containerPathByManifestHash:\n input.authorization.containerPathByManifestHash,\n dependencyManifestHashes: header.dependencyManifestHashes,\n }).dependencyContainerPaths,\n blobKekTargets,\n principalPolicies: input.authorization.principalPolicies,\n },\n expectedAccessManifestHash: blobKekTargets.blobAccessManifestHash,\n expectedObject: {\n objectKind: \"blob\",\n objectId: input.binding.blobId,\n organizationId: input.organizationId,\n },\n expectedTargetHash: blobKekTargets.blobKeyTargetHash,\n header,\n writerPublicKey: writer.signingPublicKey,\n });\n if (!verified.ok) {\n throw verified.error;\n }\n}\n"]}

package/workflows/blobs/index.d.ts CHANGED Viewed

@@ -1,3 +1,6 @@
+export { type BlobSourceSnapshot, inspectBlobSource, } from "../../data/blobs/attachments/blobSourceSnapshot.js";
+export { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from "../../data/blobs/attachments/crypto.js";
+export type { MultipartStageResolvedListener, MultipartUploadProgress, MultipartUploadProgressListener, } from "../../data/blobs/attachments/types.js";
 export type { BlobByteSource, BlobByteSourceInput, BlobBytes, BlobStore, } from "../../data/blobs/blobContracts.js";
 export { blobByteSourceInputLength, createBlobByteSource, readBlobByteSource, } from "../../data/blobs/blobContracts.js";
 export { createBlobStore } from "../../data/blobs/createBlobStore.js";
@@ -5,7 +8,6 @@ export type { EncryptedBlobStoreCipher, EncryptedBlobStoreKey, EncryptedBlobStor
 export { createEncryptedBlobStore, createLazyEncryptedBlobStore, wrapEncryptedBlobStore, } from "../../data/blobs/encryptedBlobStore.js";
 export { createMemoryBlobStore } from "../../data/blobs/memoryBlobStore.js";
 export { purgeOpfsBlobStore } from "../../data/blobs/opfsBlobStore.js";
-export type { MultipartStageResolvedListener, MultipartUploadProgress, MultipartUploadProgressListener, } from "../../data/documents/blob/shared/types.js";
 export { decryptDocumentAttachmentBlob } from "./hydration/decrypt.js";
 export { hydrateDocumentAttachmentBlobs } from "./hydration/hydrate.js";
 export { uploadDocumentAttachment } from "./upload/index.js";

package/workflows/blobs/index.js CHANGED Viewed

@@ -1,3 +1,6 @@
+// Document stores snapshot an attachment's source before queueing its upload.
+export { inspectBlobSource, } from "../../data/blobs/attachments/blobSourceSnapshot.js";
+export { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from "../../data/blobs/attachments/crypto.js";
 export { blobByteSourceInputLength, createBlobByteSource, readBlobByteSource, } from "../../data/blobs/blobContracts.js";
 export { createBlobStore } from "../../data/blobs/createBlobStore.js";
 export { createEncryptedBlobStore, createLazyEncryptedBlobStore, wrapEncryptedBlobStore, } from "../../data/blobs/encryptedBlobStore.js";

package/workflows/blobs/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"~~AAMA~~,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAOnE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;~~AAMpE~~,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC","sourcesContent":["~~export~~ type {\n BlobByteSource,\n BlobByteSourceInput,\n BlobBytes,\n BlobStore,\n} from \"../../data/blobs/blobContracts\";\nexport {\n blobByteSourceInputLength,\n createBlobByteSource,\n readBlobByteSource,\n} from \"../../data/blobs/blobContracts\";\nexport { createBlobStore } from \"../../data/blobs/createBlobStore\";\nexport type {\n EncryptedBlobStoreCipher,\n EncryptedBlobStoreKey,\n EncryptedBlobStoreOptions,\n WrapEncryptedBlobStoreOptions,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport {\n createEncryptedBlobStore,\n createLazyEncryptedBlobStore,\n wrapEncryptedBlobStore,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport { createMemoryBlobStore } from \"../../data/blobs/memoryBlobStore\";\nexport { purgeOpfsBlobStore } from \"../../data/blobs/opfsBlobStore\";\nexport ~~type~~ {~~\n MultipartStageResolvedListener,\n MultipartUploadProgress,\n MultipartUploadProgressListener,\n}~~ ~~from \"../../data/documents/blob/shared/types\";\nexport {~~ decryptDocumentAttachmentBlob } from \"./hydration/decrypt\";\nexport { hydrateDocumentAttachmentBlobs } from \"./hydration/hydrate\";\nexport { uploadDocumentAttachment } from \"./upload\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAEL,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAYpF,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAOnE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC","sourcesContent":["// Document stores snapshot an attachment's source before queueing its upload.\nexport {\n type BlobSourceSnapshot,\n inspectBlobSource,\n} from \"../../data/blobs/attachments/blobSourceSnapshot\";\nexport { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from \"../../data/blobs/attachments/crypto\";\nexport type {\n MultipartStageResolvedListener,\n MultipartUploadProgress,\n MultipartUploadProgressListener,\n} from \"../../data/blobs/attachments/types\";\nexport type {\n BlobByteSource,\n BlobByteSourceInput,\n BlobBytes,\n BlobStore,\n} from \"../../data/blobs/blobContracts\";\nexport {\n blobByteSourceInputLength,\n createBlobByteSource,\n readBlobByteSource,\n} from \"../../data/blobs/blobContracts\";\nexport { createBlobStore } from \"../../data/blobs/createBlobStore\";\nexport type {\n EncryptedBlobStoreCipher,\n EncryptedBlobStoreKey,\n EncryptedBlobStoreOptions,\n WrapEncryptedBlobStoreOptions,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport {\n createEncryptedBlobStore,\n createLazyEncryptedBlobStore,\n wrapEncryptedBlobStore,\n} from \"../../data/blobs/encryptedBlobStore\";\nexport { createMemoryBlobStore } from \"../../data/blobs/memoryBlobStore\";\nexport { purgeOpfsBlobStore } from \"../../data/blobs/opfsBlobStore\";\nexport { decryptDocumentAttachmentBlob } from \"./hydration/decrypt\";\nexport { hydrateDocumentAttachmentBlobs } from \"./hydration/hydrate\";\nexport { uploadDocumentAttachment } from \"./upload\";\n"]}

package/workflows/blobs/upload/automaticMultipartUpload.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from "../../../data/documents/blob/shared/crypto.js";
+import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from "../../../data/blobs/attachments/crypto.js";
 export function resolveMultipartUploadOptions(multipart) {
     const resolved = multipart ?? { partSize: DEFAULT_BLOB_CHUNK_SIZE_BYTES };
     if (resolved.partSize !== DEFAULT_BLOB_CHUNK_SIZE_BYTES) {

package/workflows/blobs/upload/automaticMultipartUpload.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"automaticMultipartUpload.js","sourceRoot":"","sources":["automaticMultipartUpload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,~~4CAA4C~~,CAAC;~~AAG3F~~,MAAM,UAAU,6BAA6B,CAC3C,SAAqD;IAErD,MAAM,QAAQ,GAAG,SAAS,IAAI,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,6BAA6B,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from \"../../../data/~~documents~~/~~blob~~/~~shared/~~crypto\";\nimport type { UploadDocumentAttachmentInput } from \"../../../data/~~documents~~/~~blob~~/~~shared/~~types\";\n\nexport function resolveMultipartUploadOptions(\n multipart: UploadDocumentAttachmentInput[\"multipart\"],\n): NonNullable<UploadDocumentAttachmentInput[\"multipart\"]> {\n const resolved = multipart ?? { partSize: DEFAULT_BLOB_CHUNK_SIZE_BYTES };\n if (resolved.partSize !== DEFAULT_BLOB_CHUNK_SIZE_BYTES) {\n throw new Error(\"Multipart blob chunk size must be exactly 5 MiB\");\n }\n return resolved;\n}\n"]}
1	+ {"version":3,"file":"automaticMultipartUpload.js","sourceRoot":"","sources":["automaticMultipartUpload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAGvF,MAAM,UAAU,6BAA6B,CAC3C,SAAqD;IAErD,MAAM,QAAQ,GAAG,SAAS,IAAI,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,6BAA6B,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { DEFAULT_BLOB_CHUNK_SIZE_BYTES } from \"../../../data/blobs/attachments/crypto\";\nimport type { UploadDocumentAttachmentInput } from \"../../../data/blobs/attachments/types\";\n\nexport function resolveMultipartUploadOptions(\n multipart: UploadDocumentAttachmentInput[\"multipart\"],\n): NonNullable<UploadDocumentAttachmentInput[\"multipart\"]> {\n const resolved = multipart ?? { partSize: DEFAULT_BLOB_CHUNK_SIZE_BYTES };\n if (resolved.partSize !== DEFAULT_BLOB_CHUNK_SIZE_BYTES) {\n throw new Error(\"Multipart blob chunk size must be exactly 5 MiB\");\n }\n return resolved;\n}\n"]}

package/workflows/blobs/upload/index.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
-import type { BlobSourceSnapshot } from "../../../data/documents/blob/shared/blobSourceSnapshot.js";
-import type { UploadDocumentAttachmentInput, UploadDocumentAttachmentResult } from "../../../data/documents/blob/shared/types.js";
+import type { BlobSourceSnapshot } from "../../../data/blobs/attachments/blobSourceSnapshot.js";
+import type { UploadDocumentAttachmentInput, UploadDocumentAttachmentResult } from "../../../data/blobs/attachments/types.js";
 interface PreparedUploadDocumentAttachmentInput extends UploadDocumentAttachmentInput {
     readonly sourceSnapshot?: BlobSourceSnapshot | undefined;
     readonly onStageUnavailable?: ((stageId: string) => Promise<void>) | undefined;

package/workflows/blobs/upload/index.js CHANGED Viewed

@@ -1,9 +1,9 @@
 import { computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, } from "../../../internal/crypto/index.js";
+import { prepareBlobEncryption } from "../../../data/blobs/attachments/crypto.js";
+import { signBlobAttachmentEvent, signBlobAttachmentWriteHeader, } from "../../../data/blobs/attachments/events.js";
+import { verifiedBlobWrapTargetsFromDocumentProjection, wrapBlobContentKey, } from "../../../data/blobs/attachments/projection.js";
+import { assertBlobAttachmentBindResponse } from "../../../data/blobs/attachments/responses.js";
 import { createBlobByteSource, } from "../../../data/blobs/blobContracts.js";
-import { prepareBlobEncryption } from "../../../data/documents/blob/shared/crypto.js";
-import { signBlobAttachmentEvent, signBlobAttachmentWriteHeader, } from "../../../data/documents/blob/shared/events.js";
-import { verifiedBlobWrapTargetsFromDocumentProjection, wrapBlobContentKey, } from "../../../data/documents/blob/shared/projection.js";
-import { assertBlobAttachmentBindResponse } from "../../../data/documents/blob/shared/responses.js";
 import { authorizingContainerPathRefs } from "../../../data/documents/shared/projection/index.js";
 import { uniqueSortedStrings } from "../../../data/documents/shared/readers.js";
 import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";

package/workflows/blobs/upload/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAEL,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,6CAA6C,EAC7C,kBAAkB,GACnB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AASjG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAGL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAE9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AACxG,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,KAAK,UAAU,2BAA2B,CACxC,KAeiC;IAEjC,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAExD,MAAM,OAAO,GAAG,6CAA6C,CAAC;QAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAgC;QACpD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU;QACV,OAAO,EAAE,MAAM,kBAAkB,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO;YACP,gBAAgB;YAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC;KACH,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,6BAA6B,CAAC;QACjE,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,gBAAgB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC;QACvD,6BAA6B,EAAE,mBAAmB,CAChD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CACtD;QACD,0BAA0B,EAAE,mBAAmB,CAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CACpD;QACD,iBAAiB,EAAE,UAAU;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,sBAAsB;QACtB,gBAAgB;QAChB,SAAS;QACT,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAMlC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,4BAA4B,CAAC;QACrE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC;QAClE,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,mBAAmB,CAC9B,KAAK,CAAC,WAAW,EACjB,8BAA8B,CAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAgBzC;IAQC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC3E,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CACvD,KAAK,CAAC,MAAM,EACZ,OAAO,EACP;QACE,qCAAqC,EACnC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;KACjD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gCAAgC,CAAC;QACrC,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,WAAW;QACX,eAAe;KAChB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;QACvC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;QAC/C,WAAW;QACX,eAAe;KAChB,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,4BAA4B,CAAC,EAC1C,SAAS,EACT,MAAM,EACN,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,EAC5B,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,EAC/B,KAAK,EACL,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EACvD,eAAe,GAAG,CAAC,EACnB,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,cAAc,EACd,eAAe,EACf,+BAA+B,EAC/B,gBAAgB,GACsB;IACtC,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,iCAAiC,GAAG,gCAAgC,CACxE,wBAAwB,EACxB,4BAA4B,CAC7B,CAAC;IACF,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,CACpB,qBAAwE,EACxE,EAAE,CACF,2BAA2B,CAAC;QAC1B,SAAS;QACT,SAAS;QACT,MAAM;QACN,UAAU;QACV,eAAe;QACf,UAAU;QACV,OAAO;QACP,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,wBAAwB,EAAE,iCAAiC;QAC3D,MAAM;QACN,cAAc;QACd,eAAe;QACf,+BAA+B;QAC/B,gBAAgB,EAAE,qBAAqB;KACxC,CAAC,CAAC;IACL,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,SAAS,CAAC,6BAA6B;YACxC,CAAC,8BAA8B,CAC7B,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;gBACrD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAC7C,EACD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,2EAA2E;QAC3E,+DAA+D;QAC/D,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,SAAS;QACT,MAAM;QACN,SAAS;QACT,MAAM;QACN,eAAe;QACf,UAAU;QACV,OAAO;QACP,iBAAiB;QACjB,QAAQ;QACR,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB;QACnB,eAAe;QACf,kBAAkB;QAClB,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS;QACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,OAAO,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gCAAgC,CAC9C,KAA4C;IAE5C,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import type {\n AccessEvent,\n AttachmentBindAccessEventBody,\n WriteHeader,\n} from \"@tearleads/crypto\";\nimport {\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n} from \"@tearleads/crypto\";\nimport type {\n BlobAttachmentBindRequest,\n BlobContentKeyBundleRequest,\n} from \"@tearleads/validators/request\";\nimport type { BlobAttachmentBindResponse } from \"@tearleads/validators/response\";\nimport {\n type BlobByteSource,\n createBlobByteSource,\n} from \"../../../data/blobs/blobContracts\";\nimport type { BlobSourceSnapshot } from \"../../../data/documents/blob/shared/blobSourceSnapshot\";\nimport { prepareBlobEncryption } from \"../../../data/documents/blob/shared/crypto\";\nimport {\n signBlobAttachmentEvent,\n signBlobAttachmentWriteHeader,\n} from \"../../../data/documents/blob/shared/events\";\nimport {\n verifiedBlobWrapTargetsFromDocumentProjection,\n wrapBlobContentKey,\n} from \"../../../data/documents/blob/shared/projection\";\nimport { assertBlobAttachmentBindResponse } from \"../../../data/documents/blob/shared/responses\";\nimport type {\n BlobAttachmentApi,\n BlobAttachmentMaterial,\n MultipartStageResolvedListener,\n MultipartUploadProgressListener,\n UploadDocumentAttachmentInput,\n UploadDocumentAttachmentResult,\n} from \"../../../data/documents/blob/shared/types\";\nimport { authorizingContainerPathRefs } from \"../../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../../data/documents/shared/readers\";\nimport {\n type DocumentCreateAuthor,\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { shouldRetryWithFreshProjection } from \"../../documents/syncFailures/syncFailureClassification\";\nimport { resolveBlobMutationWriterProjection } from \"../verification/writerProjection\";\nimport { resolveMultipartUploadOptions } from \"./automaticMultipartUpload\";\nimport { stageMultipartBlobAttachment } from \"./multipartUpload\";\n\nasync function buildBlobAttachmentMaterial(\n input: {\n apiClient: BlobAttachmentApi;\n bindingId: string;\n blobId: string;\n contentKey: Uint8Array;\n contentKeyEpoch: number;\n documentId: string;\n execSql?: ExecSql \| undefined;\n isRemoteSyncBlocked?: ((organizationId: string) => boolean) \| undefined;\n nonceSeed?: Uint8Array \| undefined;\n partSize: number;\n source: BlobByteSource;\n sourceSnapshot?: BlobSourceSnapshot \| undefined;\n targetSecretKey: Uint8Array;\n writerProjection?: UploadDocumentAttachmentInput[\"writerProjection\"];\n } & ProjectionVerificationOptions,\n): Promise<BlobAttachmentMaterial \| null> {\n const resolved = await resolveBlobMutationWriterProjection({\n apiClient: input.apiClient,\n documentId: input.documentId,\n errorLabel: \"Blob attachment\",\n execSql: input.execSql,\n isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n writerProjection: input.writerProjection,\n ...projectionVerificationOptions(input),\n });\n if (!resolved) {\n return null;\n }\n const { manifestIdentity, writerProjection } = resolved;\n\n const targets = verifiedBlobWrapTargetsFromDocumentProjection({\n bindingId: input.bindingId,\n documentId: input.documentId,\n writerProjection,\n });\n const targetHash = await computeBlobContentKeyTargetHash(targets);\n const contentKeyBundle: BlobContentKeyBundleRequest = {\n contentKeyEpoch: input.contentKeyEpoch,\n targetHash,\n targets: await wrapBlobContentKey({\n blobId: input.blobId,\n contentKey: input.contentKey,\n contentKeyEpoch: input.contentKeyEpoch,\n execSql: input.execSql,\n secretKey: input.targetSecretKey,\n targets,\n writerProjection,\n ...projectionVerificationOptions(input),\n }),\n };\n const encrypted = await prepareBlobEncryption({\n blobId: input.blobId,\n chunkSize: input.partSize,\n contentKey: input.contentKey,\n contentKeyBundle,\n nonceSeed: input.nonceSeed,\n organizationId: manifestIdentity.organizationId,\n source: input.source,\n sourceSnapshot: input.sourceSnapshot,\n });\n const blobAccessManifestHash = await computeBlobAccessManifestHash({\n version: 1,\n blobId: input.blobId,\n organizationId: manifestIdentity.organizationId,\n activeBindingIds: [input.bindingId],\n documentManifestHashes: [manifestIdentity.manifestHash],\n linkedContainerManifestHashes: uniqueSortedStrings(\n targets.map((target) => target.containerManifestHash),\n ),\n linkedContainerKeyEpochIds: uniqueSortedStrings(\n targets.map((target) => target.containerKeyEpochId),\n ),\n blobKeyTargetHash: targetHash,\n });\n\n return {\n blobAccessManifestHash,\n contentKeyBundle,\n encrypted,\n manifestIdentity,\n targetHash,\n targets,\n writerProjection,\n };\n}\n\nfunction blobAttachmentBindRequest(input: {\n body: AttachmentBindAccessEventBody;\n event: AccessEvent;\n material: BlobAttachmentMaterial;\n stageId: string;\n writeHeader: WriteHeader;\n}): BlobAttachmentBindRequest {\n return {\n event: readCanonicalRecord(input.event, \"Blob attachment bind event\"),\n body: readCanonicalRecord(input.body, \"Blob attachment bind body\"),\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.material.writerProjection,\n ),\n contentKeyBundle: input.material.contentKeyBundle,\n stagedBlob: {\n stageId: input.stageId,\n writeHeader: readCanonicalRecord(\n input.writeHeader,\n \"Blob attachment write header\",\n ),\n },\n };\n}\n\nasync function stageAndBindBlobAttachment(input: {\n apiClient: BlobAttachmentApi;\n author: DocumentCreateAuthor;\n bindingId: string;\n blobId: string;\n contentKeyEpoch: number;\n documentId: string;\n eventId: string;\n expectedBindingId: string \| null;\n material: BlobAttachmentMaterial;\n multipart: NonNullable<UploadDocumentAttachmentInput[\"multipart\"]>;\n onMultipartProgress?: MultipartUploadProgressListener \| undefined;\n onStageResolved?: MultipartStageResolvedListener \| undefined;\n onStageUnavailable?: ((stageId: string) => Promise<void>) \| undefined;\n signedAt: string;\n slotId: string;\n}): Promise<{\n request: BlobAttachmentBindRequest;\n response: BlobAttachmentBindResponse;\n sha256: string;\n byteLength: number;\n writeHeader: WriteHeader;\n writeHeaderHash: string;\n} \| null> {\n const { body, event } = await signBlobAttachmentEvent({\n author: input.author,\n bindingId: input.bindingId,\n blobId: input.blobId,\n documentId: input.documentId,\n eventId: input.eventId,\n expectedBindingId: input.expectedBindingId,\n manifestIdentity: input.material.manifestIdentity,\n signedAt: input.signedAt,\n slotId: input.slotId,\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.material.writerProjection,\n ),\n });\n const { writeHeader, writeHeaderHash } = await signBlobAttachmentWriteHeader({\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.material.writerProjection,\n ),\n author: input.author,\n blobAccessManifestHash: input.material.blobAccessManifestHash,\n blobId: input.blobId,\n contentKeyEpoch: input.contentKeyEpoch,\n encrypted: input.material.encrypted,\n manifestIdentity: input.material.manifestIdentity,\n signedAt: input.signedAt,\n targetHash: input.material.targetHash,\n });\n const stageId = await stageMultipartBlobAttachment({\n organizationId: input.material.manifestIdentity.organizationId,\n apiClient: input.apiClient,\n encryption: input.material.encrypted,\n multipart: input.multipart,\n onMultipartProgress: input.onMultipartProgress,\n onStageResolved: input.onStageResolved,\n onStageUnavailable: input.onStageUnavailable,\n });\n if (!stageId) {\n return null;\n }\n\n const request = blobAttachmentBindRequest({\n body,\n event,\n material: input.material,\n stageId,\n writeHeader,\n });\n const response = await input.apiClient.bindBlobAttachment(\n input.blobId,\n request,\n {\n expectedPaymentRequiredOrganizationId:\n input.material.manifestIdentity.organizationId,\n },\n );\n if (!response) {\n return null;\n }\n\n await assertBlobAttachmentBindResponse({\n body,\n bindingId: input.bindingId,\n blobAccessManifestHash: input.material.blobAccessManifestHash,\n blobId: input.blobId,\n contentKeyBundle: input.material.contentKeyBundle,\n documentId: input.documentId,\n event,\n manifestIdentity: input.material.manifestIdentity,\n response,\n slotId: input.slotId,\n targetHash: input.material.targetHash,\n targets: input.material.targets,\n writeHeader,\n writeHeaderHash,\n });\n\n return {\n request,\n response,\n sha256: input.material.encrypted.sha256,\n byteLength: input.material.encrypted.byteLength,\n writeHeader,\n writeHeaderHash,\n };\n}\n\ninterface PreparedUploadDocumentAttachmentInput\n extends UploadDocumentAttachmentInput {\n readonly sourceSnapshot?: BlobSourceSnapshot \| undefined;\n readonly onStageUnavailable?:\n \| ((stageId: string) => Promise<void>)\n \| undefined;\n}\n\nasync function uploadDocumentAttachmentImpl({\n apiClient,\n author,\n blobId = crypto.randomUUID(),\n bindingId = crypto.randomUUID(),\n bytes,\n contentKey = crypto.getRandomValues(new Uint8Array(32)),\n contentKeyEpoch = 1,\n documentId,\n eventId = crypto.randomUUID(),\n execSql,\n expectedBindingId,\n isRemoteSyncBlocked,\n nonceSeed,\n multipart,\n onMultipartProgress,\n onStageResolved,\n onStageUnavailable,\n resolveProjectionUserKey,\n signedAt = new Date().toISOString(),\n slotId,\n sourceSnapshot,\n targetSecretKey,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: PreparedUploadDocumentAttachmentInput): Promise<UploadDocumentAttachmentResult \| null> {\n if (contentKey.byteLength !== 32) {\n throw new Error(\"Blob content key must be 32 bytes\");\n }\n const resolveProjectionUserKeyForUpload = requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment upload\",\n );\n const resolvedMultipart = resolveMultipartUploadOptions(multipart);\n const source = createBlobByteSource(bytes);\n\n const buildMaterial = (\n freshWriterProjection: UploadDocumentAttachmentInput[\"writerProjection\"],\n ) =>\n buildBlobAttachmentMaterial({\n apiClient,\n bindingId,\n blobId,\n contentKey,\n contentKeyEpoch,\n documentId,\n execSql,\n isRemoteSyncBlocked,\n nonceSeed,\n partSize: resolvedMultipart.partSize,\n resolveProjectionUserKey: resolveProjectionUserKeyForUpload,\n source,\n sourceSnapshot,\n targetSecretKey,\n warmReferencedPrincipalPolicies,\n writerProjection: freshWriterProjection,\n });\n let material: BlobAttachmentMaterial \| null;\n try {\n material = await buildMaterial(writerProjection);\n } catch (error) {\n if (\n !apiClient.evictDocumentWriterProjection \|\|\n !shouldRetryWithFreshProjection(\n error,\n (message) =>\n message.startsWith(\"Container writer projection KEK\") &&\n message.includes(\"could not be unwrapped\"),\n )\n ) {\n throw error;\n }\n\n // The attachment binds to this document; only its projection was stale, so\n // evict just it rather than wiping the whole projection cache.\n apiClient.evictDocumentWriterProjection(documentId);\n material = await buildMaterial(undefined);\n }\n if (!material) {\n return null;\n }\n const result = await stageAndBindBlobAttachment({\n apiClient,\n author,\n bindingId,\n blobId,\n contentKeyEpoch,\n documentId,\n eventId,\n expectedBindingId,\n material,\n multipart: resolvedMultipart,\n onMultipartProgress,\n onStageResolved,\n onStageUnavailable,\n signedAt,\n slotId,\n });\n if (!result) {\n return null;\n }\n\n return {\n blobId,\n bindingId,\n writerProjection: material.writerProjection,\n ...result,\n };\n}\n\nexport function uploadDocumentAttachment(\n input: UploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult \| null> {\n return uploadDocumentAttachmentImpl({ ...input, sourceSnapshot: undefined });\n}\n\n/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */\nexport function uploadPreparedDocumentAttachment(\n input: PreparedUploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult \| null> {\n return uploadDocumentAttachmentImpl(input);\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,6CAA6C,EAC7C,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAS7F,OAAO,EAEL,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAGL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAE9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AACxG,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,KAAK,UAAU,2BAA2B,CACxC,KAeiC;IAEjC,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAExD,MAAM,OAAO,GAAG,6CAA6C,CAAC;QAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAgC;QACpD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU;QACV,OAAO,EAAE,MAAM,kBAAkB,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO;YACP,gBAAgB;YAChB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC;KACH,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,6BAA6B,CAAC;QACjE,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,gBAAgB,CAAC,cAAc;QAC/C,gBAAgB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC;QACvD,6BAA6B,EAAE,mBAAmB,CAChD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CACtD;QACD,0BAA0B,EAAE,mBAAmB,CAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CACpD;QACD,iBAAiB,EAAE,UAAU;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,sBAAsB;QACtB,gBAAgB;QAChB,SAAS;QACT,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAMlC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,4BAA4B,CAAC;QACrE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC;QAClE,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,mBAAmB,CAC9B,KAAK,CAAC,WAAW,EACjB,8BAA8B,CAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAgBzC;IAQC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,MAAM,6BAA6B,CAAC;QAC3E,4BAA4B,EAAE,4BAA4B,CACxD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CACvD,KAAK,CAAC,MAAM,EACZ,OAAO,EACP;QACE,qCAAqC,EACnC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc;KACjD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gCAAgC,CAAC;QACrC,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,WAAW;QACX,eAAe;KAChB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;QACvC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;QAC/C,WAAW;QACX,eAAe;KAChB,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,4BAA4B,CAAC,EAC1C,SAAS,EACT,MAAM,EACN,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,EAC5B,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,EAC/B,KAAK,EACL,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EACvD,eAAe,GAAG,CAAC,EACnB,UAAU,EACV,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,EAC7B,OAAO,EACP,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACnC,MAAM,EACN,cAAc,EACd,eAAe,EACf,+BAA+B,EAC/B,gBAAgB,GACsB;IACtC,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,iCAAiC,GAAG,gCAAgC,CACxE,wBAAwB,EACxB,4BAA4B,CAC7B,CAAC;IACF,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,CACpB,qBAAwE,EACxE,EAAE,CACF,2BAA2B,CAAC;QAC1B,SAAS;QACT,SAAS;QACT,MAAM;QACN,UAAU;QACV,eAAe;QACf,UAAU;QACV,OAAO;QACP,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,wBAAwB,EAAE,iCAAiC;QAC3D,MAAM;QACN,cAAc;QACd,eAAe;QACf,+BAA+B;QAC/B,gBAAgB,EAAE,qBAAqB;KACxC,CAAC,CAAC;IACL,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,SAAS,CAAC,6BAA6B;YACxC,CAAC,8BAA8B,CAC7B,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;gBACrD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAC7C,EACD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,2EAA2E;QAC3E,+DAA+D;QAC/D,SAAS,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,SAAS;QACT,MAAM;QACN,SAAS;QACT,MAAM;QACN,eAAe;QACf,UAAU;QACV,OAAO;QACP,iBAAiB;QACjB,QAAQ;QACR,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB;QACnB,eAAe;QACf,kBAAkB;QAClB,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS;QACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,OAAO,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gCAAgC,CAC9C,KAA4C;IAE5C,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import type {\n AccessEvent,\n AttachmentBindAccessEventBody,\n WriteHeader,\n} from \"@tearleads/crypto\";\nimport {\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n} from \"@tearleads/crypto\";\nimport type {\n BlobAttachmentBindRequest,\n BlobContentKeyBundleRequest,\n} from \"@tearleads/validators/request\";\nimport type { BlobAttachmentBindResponse } from \"@tearleads/validators/response\";\nimport type { BlobSourceSnapshot } from \"../../../data/blobs/attachments/blobSourceSnapshot\";\nimport { prepareBlobEncryption } from \"../../../data/blobs/attachments/crypto\";\nimport {\n signBlobAttachmentEvent,\n signBlobAttachmentWriteHeader,\n} from \"../../../data/blobs/attachments/events\";\nimport {\n verifiedBlobWrapTargetsFromDocumentProjection,\n wrapBlobContentKey,\n} from \"../../../data/blobs/attachments/projection\";\nimport { assertBlobAttachmentBindResponse } from \"../../../data/blobs/attachments/responses\";\nimport type {\n BlobAttachmentApi,\n BlobAttachmentMaterial,\n MultipartStageResolvedListener,\n MultipartUploadProgressListener,\n UploadDocumentAttachmentInput,\n UploadDocumentAttachmentResult,\n} from \"../../../data/blobs/attachments/types\";\nimport {\n type BlobByteSource,\n createBlobByteSource,\n} from \"../../../data/blobs/blobContracts\";\nimport { authorizingContainerPathRefs } from \"../../../data/documents/shared/projection\";\nimport { uniqueSortedStrings } from \"../../../data/documents/shared/readers\";\nimport {\n type DocumentCreateAuthor,\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { shouldRetryWithFreshProjection } from \"../../documents/syncFailures/syncFailureClassification\";\nimport { resolveBlobMutationWriterProjection } from \"../verification/writerProjection\";\nimport { resolveMultipartUploadOptions } from \"./automaticMultipartUpload\";\nimport { stageMultipartBlobAttachment } from \"./multipartUpload\";\n\nasync function buildBlobAttachmentMaterial(\n input: {\n apiClient: BlobAttachmentApi;\n bindingId: string;\n blobId: string;\n contentKey: Uint8Array;\n contentKeyEpoch: number;\n documentId: string;\n execSql?: ExecSql \| undefined;\n isRemoteSyncBlocked?: ((organizationId: string) => boolean) \| undefined;\n nonceSeed?: Uint8Array \| undefined;\n partSize: number;\n source: BlobByteSource;\n sourceSnapshot?: BlobSourceSnapshot \| undefined;\n targetSecretKey: Uint8Array;\n writerProjection?: UploadDocumentAttachmentInput[\"writerProjection\"];\n } & ProjectionVerificationOptions,\n): Promise<BlobAttachmentMaterial \| null> {\n const resolved = await resolveBlobMutationWriterProjection({\n apiClient: input.apiClient,\n documentId: input.documentId,\n errorLabel: \"Blob attachment\",\n execSql: input.execSql,\n isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n writerProjection: input.writerProjection,\n ...projectionVerificationOptions(input),\n });\n if (!resolved) {\n return null;\n }\n const { manifestIdentity, writerProjection } = resolved;\n\n const targets = verifiedBlobWrapTargetsFromDocumentProjection({\n bindingId: input.bindingId,\n documentId: input.documentId,\n writerProjection,\n });\n const targetHash = await computeBlobContentKeyTargetHash(targets);\n const contentKeyBundle: BlobContentKeyBundleRequest = {\n contentKeyEpoch: input.contentKeyEpoch,\n targetHash,\n targets: await wrapBlobContentKey({\n blobId: input.blobId,\n contentKey: input.contentKey,\n contentKeyEpoch: input.contentKeyEpoch,\n execSql: input.execSql,\n secretKey: input.targetSecretKey,\n targets,\n writerProjection,\n ...projectionVerificationOptions(input),\n }),\n };\n const encrypted = await prepareBlobEncryption({\n blobId: input.blobId,\n chunkSize: input.partSize,\n contentKey: input.contentKey,\n contentKeyBundle,\n nonceSeed: input.nonceSeed,\n organizationId: manifestIdentity.organizationId,\n source: input.source,\n sourceSnapshot: input.sourceSnapshot,\n });\n const blobAccessManifestHash = await computeBlobAccessManifestHash({\n version: 1,\n blobId: input.blobId,\n organizationId: manifestIdentity.organizationId,\n activeBindingIds: [input.bindingId],\n documentManifestHashes: [manifestIdentity.manifestHash],\n linkedContainerManifestHashes: uniqueSortedStrings(\n targets.map((target) => target.containerManifestHash),\n ),\n linkedContainerKeyEpochIds: uniqueSortedStrings(\n targets.map((target) => target.containerKeyEpochId),\n ),\n blobKeyTargetHash: targetHash,\n });\n\n return {\n blobAccessManifestHash,\n contentKeyBundle,\n encrypted,\n manifestIdentity,\n targetHash,\n targets,\n writerProjection,\n };\n}\n\nfunction blobAttachmentBindRequest(input: {\n body: AttachmentBindAccessEventBody;\n event: AccessEvent;\n material: BlobAttachmentMaterial;\n stageId: string;\n writeHeader: WriteHeader;\n}): BlobAttachmentBindRequest {\n return {\n event: readCanonicalRecord(input.event, \"Blob attachment bind event\"),\n body: readCanonicalRecord(input.body, \"Blob attachment bind body\"),\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.material.writerProjection,\n ),\n contentKeyBundle: input.material.contentKeyBundle,\n stagedBlob: {\n stageId: input.stageId,\n writeHeader: readCanonicalRecord(\n input.writeHeader,\n \"Blob attachment write header\",\n ),\n },\n };\n}\n\nasync function stageAndBindBlobAttachment(input: {\n apiClient: BlobAttachmentApi;\n author: DocumentCreateAuthor;\n bindingId: string;\n blobId: string;\n contentKeyEpoch: number;\n documentId: string;\n eventId: string;\n expectedBindingId: string \| null;\n material: BlobAttachmentMaterial;\n multipart: NonNullable<UploadDocumentAttachmentInput[\"multipart\"]>;\n onMultipartProgress?: MultipartUploadProgressListener \| undefined;\n onStageResolved?: MultipartStageResolvedListener \| undefined;\n onStageUnavailable?: ((stageId: string) => Promise<void>) \| undefined;\n signedAt: string;\n slotId: string;\n}): Promise<{\n request: BlobAttachmentBindRequest;\n response: BlobAttachmentBindResponse;\n sha256: string;\n byteLength: number;\n writeHeader: WriteHeader;\n writeHeaderHash: string;\n} \| null> {\n const { body, event } = await signBlobAttachmentEvent({\n author: input.author,\n bindingId: input.bindingId,\n blobId: input.blobId,\n documentId: input.documentId,\n eventId: input.eventId,\n expectedBindingId: input.expectedBindingId,\n manifestIdentity: input.material.manifestIdentity,\n signedAt: input.signedAt,\n slotId: input.slotId,\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.material.writerProjection,\n ),\n });\n const { writeHeader, writeHeaderHash } = await signBlobAttachmentWriteHeader({\n authorizingContainerPathRefs: authorizingContainerPathRefs(\n input.material.writerProjection,\n ),\n author: input.author,\n blobAccessManifestHash: input.material.blobAccessManifestHash,\n blobId: input.blobId,\n contentKeyEpoch: input.contentKeyEpoch,\n encrypted: input.material.encrypted,\n manifestIdentity: input.material.manifestIdentity,\n signedAt: input.signedAt,\n targetHash: input.material.targetHash,\n });\n const stageId = await stageMultipartBlobAttachment({\n organizationId: input.material.manifestIdentity.organizationId,\n apiClient: input.apiClient,\n encryption: input.material.encrypted,\n multipart: input.multipart,\n onMultipartProgress: input.onMultipartProgress,\n onStageResolved: input.onStageResolved,\n onStageUnavailable: input.onStageUnavailable,\n });\n if (!stageId) {\n return null;\n }\n\n const request = blobAttachmentBindRequest({\n body,\n event,\n material: input.material,\n stageId,\n writeHeader,\n });\n const response = await input.apiClient.bindBlobAttachment(\n input.blobId,\n request,\n {\n expectedPaymentRequiredOrganizationId:\n input.material.manifestIdentity.organizationId,\n },\n );\n if (!response) {\n return null;\n }\n\n await assertBlobAttachmentBindResponse({\n body,\n bindingId: input.bindingId,\n blobAccessManifestHash: input.material.blobAccessManifestHash,\n blobId: input.blobId,\n contentKeyBundle: input.material.contentKeyBundle,\n documentId: input.documentId,\n event,\n manifestIdentity: input.material.manifestIdentity,\n response,\n slotId: input.slotId,\n targetHash: input.material.targetHash,\n targets: input.material.targets,\n writeHeader,\n writeHeaderHash,\n });\n\n return {\n request,\n response,\n sha256: input.material.encrypted.sha256,\n byteLength: input.material.encrypted.byteLength,\n writeHeader,\n writeHeaderHash,\n };\n}\n\ninterface PreparedUploadDocumentAttachmentInput\n extends UploadDocumentAttachmentInput {\n readonly sourceSnapshot?: BlobSourceSnapshot \| undefined;\n readonly onStageUnavailable?:\n \| ((stageId: string) => Promise<void>)\n \| undefined;\n}\n\nasync function uploadDocumentAttachmentImpl({\n apiClient,\n author,\n blobId = crypto.randomUUID(),\n bindingId = crypto.randomUUID(),\n bytes,\n contentKey = crypto.getRandomValues(new Uint8Array(32)),\n contentKeyEpoch = 1,\n documentId,\n eventId = crypto.randomUUID(),\n execSql,\n expectedBindingId,\n isRemoteSyncBlocked,\n nonceSeed,\n multipart,\n onMultipartProgress,\n onStageResolved,\n onStageUnavailable,\n resolveProjectionUserKey,\n signedAt = new Date().toISOString(),\n slotId,\n sourceSnapshot,\n targetSecretKey,\n warmReferencedPrincipalPolicies,\n writerProjection,\n}: PreparedUploadDocumentAttachmentInput): Promise<UploadDocumentAttachmentResult \| null> {\n if (contentKey.byteLength !== 32) {\n throw new Error(\"Blob content key must be 32 bytes\");\n }\n const resolveProjectionUserKeyForUpload = requireProjectionUserKeyResolver(\n resolveProjectionUserKey,\n \"Document attachment upload\",\n );\n const resolvedMultipart = resolveMultipartUploadOptions(multipart);\n const source = createBlobByteSource(bytes);\n\n const buildMaterial = (\n freshWriterProjection: UploadDocumentAttachmentInput[\"writerProjection\"],\n ) =>\n buildBlobAttachmentMaterial({\n apiClient,\n bindingId,\n blobId,\n contentKey,\n contentKeyEpoch,\n documentId,\n execSql,\n isRemoteSyncBlocked,\n nonceSeed,\n partSize: resolvedMultipart.partSize,\n resolveProjectionUserKey: resolveProjectionUserKeyForUpload,\n source,\n sourceSnapshot,\n targetSecretKey,\n warmReferencedPrincipalPolicies,\n writerProjection: freshWriterProjection,\n });\n let material: BlobAttachmentMaterial \| null;\n try {\n material = await buildMaterial(writerProjection);\n } catch (error) {\n if (\n !apiClient.evictDocumentWriterProjection \|\|\n !shouldRetryWithFreshProjection(\n error,\n (message) =>\n message.startsWith(\"Container writer projection KEK\") &&\n message.includes(\"could not be unwrapped\"),\n )\n ) {\n throw error;\n }\n\n // The attachment binds to this document; only its projection was stale, so\n // evict just it rather than wiping the whole projection cache.\n apiClient.evictDocumentWriterProjection(documentId);\n material = await buildMaterial(undefined);\n }\n if (!material) {\n return null;\n }\n const result = await stageAndBindBlobAttachment({\n apiClient,\n author,\n bindingId,\n blobId,\n contentKeyEpoch,\n documentId,\n eventId,\n expectedBindingId,\n material,\n multipart: resolvedMultipart,\n onMultipartProgress,\n onStageResolved,\n onStageUnavailable,\n signedAt,\n slotId,\n });\n if (!result) {\n return null;\n }\n\n return {\n blobId,\n bindingId,\n writerProjection: material.writerProjection,\n ...result,\n };\n}\n\nexport function uploadDocumentAttachment(\n input: UploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult \| null> {\n return uploadDocumentAttachmentImpl({ ...input, sourceSnapshot: undefined });\n}\n\n/** Internal upload path for a source snapshot produced by `inspectBlobSource`. */\nexport function uploadPreparedDocumentAttachment(\n input: PreparedUploadDocumentAttachmentInput,\n): Promise<UploadDocumentAttachmentResult \| null> {\n return uploadDocumentAttachmentImpl(input);\n}\n"]}

package/workflows/blobs/upload/multipartFirstParts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"multipartFirstParts.js","sourceRoot":"","sources":["multipartFirstParts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EACL,yBAAyB,GAG1B,MAAM,4BAA4B,CAAC;~~AAEpC~~,OAAO,EACL,yBAAyB,EAEzB,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;~~AA2B1C~~,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAClC,QAAwC;IAExC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,KAAa;IAEb,MAAM,OAAO,GAAG,CAAC,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAgB;IACnD,OAAO,UAAU,CACf,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,UAA8B,EAC9B,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,yBAAyB,CAAC,CACvE,CAAC;IACF,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACtD,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,uBAAuB,SAAS,GAAG,CAAC,mCAAmC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAClL,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,WAAW,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmD,EACnD,KAA8D;IAE9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GACX,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAC/C,KAAK,CAAC,IAAI,KAAK,CAAC;QAChB,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,CACL,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC,UAAU;gBAC5C,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU;gBAC3C,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAC5B,OAA6B,EAC7B,UAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACxE,CAAC","sourcesContent":["import { describeMultipartBlobPart } from \"@tearleads/api-client\";\nimport { bytesToHex } from \"@tearleads/crypto\";\nimport type { InitiateMultipartBlobStageResponse } from \"@tearleads/validators/response\";\nimport {\n MAX_INITIATE_PART_UPLOADS,\n type MultipartBlobPartDescriptor,\n type MultipartBlobPartUploadSource,\n} from \"@tearleads/validators/util\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport {\n acquireBlobTransferPermit,\n type BlobTransferPermit,\n tryAcquireBlobTransferPermit,\n} from \"../../../data/blobs/transferPool\";\~~nimport type { BlobEncryptionPlan } from \"../../../data/documents/blob/shared/crypto\";\~~n\nexport interface PreparedMultipartPart {\n readonly bytes: BlobBytes;\n readonly sha256: string;\n}\n\n/*\n A first part's bytes and the transfer-pool permit that pays for them: the\n * bytes exist before their upload can start, so they hold a slot of the\n * client's byte-I/O bound until the upload that sends them releases it.\n /\nexport interface PreparedFirstPart extends PreparedMultipartPart {\n readonly permit: BlobTransferPermit;\n}\n\n/\n The parts a new stage's upload starts with, encrypted once up front: their\n * descriptors ride on the stage initiation, and their bytes are handed to the\n * upload workers instead of being encrypted a second time.\n /\nexport interface MultipartFirstParts {\n readonly descriptors: readonly MultipartBlobPartDescriptor[];\n readonly prepared: Map<number, PreparedFirstPart>;\n}\n\n/* Return the pool slots of first parts no upload consumed. /\nexport function releasePreparedParts(\n prepared: Map<number, PreparedFirstPart>,\n): void {\n for (const part of prepared.values()) {\n part.permit.release();\n }\n prepared.clear();\n}\n\n/\n One permit is awaited; more are taken only if free right now. Two uploads\n * each waiting for a second slot while holding a first could otherwise\n * deadlock the pool, since a held slot frees only when its part uploads.\n /\nasync function acquireFirstPartPermits(\n client: object,\n limit: number,\n): Promise<BlobTransferPermit[]> {\n const permits = [await acquireBlobTransferPermit(client)];\n while (permits.length < limit) {\n const permit = tryAcquireBlobTransferPermit(client);\n if (!permit) break;\n permits.push(permit);\n }\n return permits;\n}\n\n/\n Where each part's bytes go. Sources the stage initiation issued are used\n * once; a store that cannot sign (`api`) needs no per-part authorization at\n * all, and a part with no source authorizes just before it is sent.\n /\nexport interface MultipartPartSources {\n readonly apiTransport: boolean;\n readonly issued: Map<number, MultipartBlobPartUploadSource>;\n}\n\nexport async function sha256BytesHex(bytes: BlobBytes): Promise<string> {\n return bytesToHex(\n new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes)),\n );\n}\n\nexport async function prepareFirstMultipartParts(\n client: object,\n encryption: BlobEncryptionPlan,\n concurrency: number,\n): Promise<MultipartFirstParts> {\n const permits = await acquireFirstPartPermits(\n client,\n Math.min(encryption.partCount, concurrency, MAX_INITIATE_PART_UPLOADS),\n );\n const descriptors: MultipartBlobPartDescriptor[] = [];\n const prepared = new Map<number, PreparedFirstPart>();\n try {\n for (const [partIndex, permit] of permits.entries()) {\n const bytes = await encryption.encryptPart(partIndex);\n if (bytes.byteLength !== encryption.getPartByteLength(partIndex)) {\n throw new Error(\n `Encrypted blob part ${partIndex + 1} byte length mismatch: expected ${encryption.getPartByteLength(partIndex).toLocaleString()}, received ${bytes.byteLength.toLocaleString()}.`,\n );\n }\n const sha256 = await sha256BytesHex(bytes);\n prepared.set(partIndex, { bytes, permit, sha256 });\n descriptors.push(describeMultipartBlobPart(partIndex + 1, bytes));\n }\n } catch (error) {\n for (const permit of permits) permit.release();\n throw error;\n }\n return { descriptors, prepared };\n}\n\n/\n The initiation must return exactly one source per described part, for that\n * part's number, length, and checksum, and every source of one stage must use\n * the same transport.\n /\nexport function readIssuedPartSources(\n descriptors: readonly MultipartBlobPartDescriptor[],\n stage: Pick<InitiateMultipartBlobStageResponse, \"partUploads\">,\n): MultipartPartSources {\n const issued = new Map<number, MultipartBlobPartUploadSource>();\n const kinds = new Set(stage.partUploads.map((upload) => upload.source.kind));\n const matches =\n stage.partUploads.length === descriptors.length &&\n kinds.size === 1 &&\n descriptors.every((descriptor, index) => {\n const upload = stage.partUploads[index];\n return (\n upload?.partNumber === descriptor.partNumber &&\n upload.byteLength === descriptor.byteLength &&\n upload.contentMd5 === descriptor.contentMd5\n );\n });\n if (!matches) {\n throw new Error(\n \"Multipart blob stage initiation part uploads do not match its request.\",\n );\n }\n for (const upload of stage.partUploads) {\n issued.set(upload.partNumber, upload.source);\n }\n return { apiTransport: kinds.has(\"api\"), issued };\n}\n\n/* Use each issued source once; retries and later parts authorize anew. */\nexport function takePartSource(\n sources: MultipartPartSources,\n partNumber: number,\n): MultipartBlobPartUploadSource \| undefined {\n const issued = sources.issued.get(partNumber);\n sources.issued.delete(partNumber);\n return issued ?? (sources.apiTransport ? { kind: \"api\" } : undefined);\n}\n"]}
1	+ {"version":3,"file":"multipartFirstParts.js","sourceRoot":"","sources":["multipartFirstParts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EACL,yBAAyB,GAG1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,yBAAyB,EAEzB,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AA0B1C,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAClC,QAAwC;IAExC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,KAAa;IAEb,MAAM,OAAO,GAAG,CAAC,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAgB;IACnD,OAAO,UAAU,CACf,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,UAA8B,EAC9B,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,yBAAyB,CAAC,CACvE,CAAC;IACF,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACtD,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,uBAAuB,SAAS,GAAG,CAAC,mCAAmC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAClL,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,WAAW,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmD,EACnD,KAA8D;IAE9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GACX,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAC/C,KAAK,CAAC,IAAI,KAAK,CAAC;QAChB,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,CACL,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC,UAAU;gBAC5C,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU;gBAC3C,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAC5B,OAA6B,EAC7B,UAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACxE,CAAC","sourcesContent":["import { describeMultipartBlobPart } from \"@tearleads/api-client\";\nimport { bytesToHex } from \"@tearleads/crypto\";\nimport type { InitiateMultipartBlobStageResponse } from \"@tearleads/validators/response\";\nimport {\n MAX_INITIATE_PART_UPLOADS,\n type MultipartBlobPartDescriptor,\n type MultipartBlobPartUploadSource,\n} from \"@tearleads/validators/util\";\nimport type { BlobEncryptionPlan } from \"../../../data/blobs/attachments/crypto\";\nimport type { BlobBytes } from \"../../../data/blobs/blobContracts\";\nimport {\n acquireBlobTransferPermit,\n type BlobTransferPermit,\n tryAcquireBlobTransferPermit,\n} from \"../../../data/blobs/transferPool\";\n\nexport interface PreparedMultipartPart {\n readonly bytes: BlobBytes;\n readonly sha256: string;\n}\n\n/*\n A first part's bytes and the transfer-pool permit that pays for them: the\n * bytes exist before their upload can start, so they hold a slot of the\n * client's byte-I/O bound until the upload that sends them releases it.\n /\nexport interface PreparedFirstPart extends PreparedMultipartPart {\n readonly permit: BlobTransferPermit;\n}\n\n/\n The parts a new stage's upload starts with, encrypted once up front: their\n * descriptors ride on the stage initiation, and their bytes are handed to the\n * upload workers instead of being encrypted a second time.\n /\nexport interface MultipartFirstParts {\n readonly descriptors: readonly MultipartBlobPartDescriptor[];\n readonly prepared: Map<number, PreparedFirstPart>;\n}\n\n/* Return the pool slots of first parts no upload consumed. /\nexport function releasePreparedParts(\n prepared: Map<number, PreparedFirstPart>,\n): void {\n for (const part of prepared.values()) {\n part.permit.release();\n }\n prepared.clear();\n}\n\n/\n One permit is awaited; more are taken only if free right now. Two uploads\n * each waiting for a second slot while holding a first could otherwise\n * deadlock the pool, since a held slot frees only when its part uploads.\n /\nasync function acquireFirstPartPermits(\n client: object,\n limit: number,\n): Promise<BlobTransferPermit[]> {\n const permits = [await acquireBlobTransferPermit(client)];\n while (permits.length < limit) {\n const permit = tryAcquireBlobTransferPermit(client);\n if (!permit) break;\n permits.push(permit);\n }\n return permits;\n}\n\n/\n Where each part's bytes go. Sources the stage initiation issued are used\n * once; a store that cannot sign (`api`) needs no per-part authorization at\n * all, and a part with no source authorizes just before it is sent.\n /\nexport interface MultipartPartSources {\n readonly apiTransport: boolean;\n readonly issued: Map<number, MultipartBlobPartUploadSource>;\n}\n\nexport async function sha256BytesHex(bytes: BlobBytes): Promise<string> {\n return bytesToHex(\n new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes)),\n );\n}\n\nexport async function prepareFirstMultipartParts(\n client: object,\n encryption: BlobEncryptionPlan,\n concurrency: number,\n): Promise<MultipartFirstParts> {\n const permits = await acquireFirstPartPermits(\n client,\n Math.min(encryption.partCount, concurrency, MAX_INITIATE_PART_UPLOADS),\n );\n const descriptors: MultipartBlobPartDescriptor[] = [];\n const prepared = new Map<number, PreparedFirstPart>();\n try {\n for (const [partIndex, permit] of permits.entries()) {\n const bytes = await encryption.encryptPart(partIndex);\n if (bytes.byteLength !== encryption.getPartByteLength(partIndex)) {\n throw new Error(\n `Encrypted blob part ${partIndex + 1} byte length mismatch: expected ${encryption.getPartByteLength(partIndex).toLocaleString()}, received ${bytes.byteLength.toLocaleString()}.`,\n );\n }\n const sha256 = await sha256BytesHex(bytes);\n prepared.set(partIndex, { bytes, permit, sha256 });\n descriptors.push(describeMultipartBlobPart(partIndex + 1, bytes));\n }\n } catch (error) {\n for (const permit of permits) permit.release();\n throw error;\n }\n return { descriptors, prepared };\n}\n\n/\n The initiation must return exactly one source per described part, for that\n * part's number, length, and checksum, and every source of one stage must use\n * the same transport.\n /\nexport function readIssuedPartSources(\n descriptors: readonly MultipartBlobPartDescriptor[],\n stage: Pick<InitiateMultipartBlobStageResponse, \"partUploads\">,\n): MultipartPartSources {\n const issued = new Map<number, MultipartBlobPartUploadSource>();\n const kinds = new Set(stage.partUploads.map((upload) => upload.source.kind));\n const matches =\n stage.partUploads.length === descriptors.length &&\n kinds.size === 1 &&\n descriptors.every((descriptor, index) => {\n const upload = stage.partUploads[index];\n return (\n upload?.partNumber === descriptor.partNumber &&\n upload.byteLength === descriptor.byteLength &&\n upload.contentMd5 === descriptor.contentMd5\n );\n });\n if (!matches) {\n throw new Error(\n \"Multipart blob stage initiation part uploads do not match its request.\",\n );\n }\n for (const upload of stage.partUploads) {\n issued.set(upload.partNumber, upload.source);\n }\n return { apiTransport: kinds.has(\"api\"), issued };\n}\n\n/* Use each issued source once; retries and later parts authorize anew. */\nexport function takePartSource(\n sources: MultipartPartSources,\n partNumber: number,\n): MultipartBlobPartUploadSource \| undefined {\n const issued = sources.issued.get(partNumber);\n sources.issued.delete(partNumber);\n return issued ?? (sources.apiTransport ? { kind: \"api\" } : undefined);\n}\n"]}

package/workflows/blobs/upload/multipartStageFailures.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"multipartStageFailures.js","sourceRoot":"","sources":["multipartStageFailures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAUlF,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,2BAA2B,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC5E,OAAO,OAAO;QACZ,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,0BAA0B,OAAO,EAAE;QACtD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrB,CAAC;AAED,SAAS,+BAA+B,CACtC,OAAmC;IAEnC,OAAO,CACL,OAAO,EAAE,IAAI,KAAK,MAAM;QACxB,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG;YACtB,OAAO,CAAC,IAAI,KAAK,gCAAgC,CAAC,QAAQ,CAAC;YAC3D,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG;gBACrB,OAAO,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;KACxC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,0BAA0B,CAAC;YACzB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,uDAAuD,KAAK,CAAC,OAAO,GAAG;YACjF,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { MULTIPART_BLOB_STAGE_ERROR_CODES } from \"@tearleads/validators/response\";\nimport type { BlobAttachmentApi } from \"../../../data/~~documents~~/~~blob~~/~~shared/~~types\";\n\ntype RequestFailureInput = Parameters<\n NonNullable<BlobAttachmentApi[\"getRequestFailure\"]>\n>[0];\ntype RequestFailure = ReturnType<\n NonNullable<BlobAttachmentApi[\"getRequestFailure\"]>\n>;\n\nexport function multipartStagePath(stageId: string): string {\n return `/blobs/stages/multipart/${encodeURIComponent(stageId)}`;\n}\n\nexport function multipartApiFailureMessage(input: {\n readonly apiClient: BlobAttachmentApi;\n readonly fallback: string;\n readonly request: RequestFailureInput;\n}): string {\n const failure = input.apiClient.getRequestFailure?.(input.request)?.message;\n return failure\n ? `${input.fallback} Last request failure: ${failure}`\n : input.fallback;\n}\n\nfunction provesMultipartStageReplacement(\n failure: RequestFailure \| undefined,\n): boolean {\n return (\n failure?.kind === \"http\" &&\n ((failure.status === 404 &&\n failure.code === MULTIPART_BLOB_STAGE_ERROR_CODES.notFound) \|\|\n (failure.status === 409 &&\n failure.code === MULTIPART_BLOB_STAGE_ERROR_CODES.expired))\n );\n}\n\nexport async function assertMultipartStageReplaceable(input: {\n readonly apiClient: BlobAttachmentApi;\n readonly onStageUnavailable?:\n \| ((stageId: string) => Promise<void>)\n \| undefined;\n readonly stageId: string;\n}): Promise<void> {\n const request = {\n method: \"GET\" as const,\n path: multipartStagePath(input.stageId),\n };\n const failure = input.apiClient.getRequestFailure?.(request);\n if (!provesMultipartStageReplacement(failure)) {\n throw new Error(\n multipartApiFailureMessage({\n apiClient: input.apiClient,\n fallback: `Multipart blob resume stage lookup failed for stage ${input.stageId}.`,\n request,\n }),\n );\n }\n if (input.onStageUnavailable) {\n await input.onStageUnavailable(input.stageId);\n throw new Error(\n \"Multipart stage is unavailable; upload attempt stopped for recovery.\",\n );\n }\n}\n"]}
1	+ {"version":3,"file":"multipartStageFailures.js","sourceRoot":"","sources":["multipartStageFailures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAUlF,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,2BAA2B,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC5E,OAAO,OAAO;QACZ,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,0BAA0B,OAAO,EAAE;QACtD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrB,CAAC;AAED,SAAS,+BAA+B,CACtC,OAAmC;IAEnC,OAAO,CACL,OAAO,EAAE,IAAI,KAAK,MAAM;QACxB,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG;YACtB,OAAO,CAAC,IAAI,KAAK,gCAAgC,CAAC,QAAQ,CAAC;YAC3D,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG;gBACrB,OAAO,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;KACxC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,0BAA0B,CAAC;YACzB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,uDAAuD,KAAK,CAAC,OAAO,GAAG;YACjF,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { MULTIPART_BLOB_STAGE_ERROR_CODES } from \"@tearleads/validators/response\";\nimport type { BlobAttachmentApi } from \"../../../data/blobs/attachments/types\";\n\ntype RequestFailureInput = Parameters<\n NonNullable<BlobAttachmentApi[\"getRequestFailure\"]>\n>[0];\ntype RequestFailure = ReturnType<\n NonNullable<BlobAttachmentApi[\"getRequestFailure\"]>\n>;\n\nexport function multipartStagePath(stageId: string): string {\n return `/blobs/stages/multipart/${encodeURIComponent(stageId)}`;\n}\n\nexport function multipartApiFailureMessage(input: {\n readonly apiClient: BlobAttachmentApi;\n readonly fallback: string;\n readonly request: RequestFailureInput;\n}): string {\n const failure = input.apiClient.getRequestFailure?.(input.request)?.message;\n return failure\n ? `${input.fallback} Last request failure: ${failure}`\n : input.fallback;\n}\n\nfunction provesMultipartStageReplacement(\n failure: RequestFailure \| undefined,\n): boolean {\n return (\n failure?.kind === \"http\" &&\n ((failure.status === 404 &&\n failure.code === MULTIPART_BLOB_STAGE_ERROR_CODES.notFound) \|\|\n (failure.status === 409 &&\n failure.code === MULTIPART_BLOB_STAGE_ERROR_CODES.expired))\n );\n}\n\nexport async function assertMultipartStageReplaceable(input: {\n readonly apiClient: BlobAttachmentApi;\n readonly onStageUnavailable?:\n \| ((stageId: string) => Promise<void>)\n \| undefined;\n readonly stageId: string;\n}): Promise<void> {\n const request = {\n method: \"GET\" as const,\n path: multipartStagePath(input.stageId),\n };\n const failure = input.apiClient.getRequestFailure?.(request);\n if (!provesMultipartStageReplacement(failure)) {\n throw new Error(\n multipartApiFailureMessage({\n apiClient: input.apiClient,\n fallback: `Multipart blob resume stage lookup failed for stage ${input.stageId}.`,\n request,\n }),\n );\n }\n if (input.onStageUnavailable) {\n await input.onStageUnavailable(input.stageId);\n throw new Error(\n \"Multipart stage is unavailable; upload attempt stopped for recovery.\",\n );\n }\n}\n"]}