@wix/himalaya-cli 0.1381.0 → 0.1383.0

package/templates/retail-store-owner/tier5-src/_shared/aria-attachments.ts

@@ -18,6 +18,8 @@
  *  never silently dropped — the native Aria app drops unsupported files without a
  *  word, and an owner who picked something and sees nothing happen assumes the
  *  button is broken. */
+import type { FileHandle } from "@himalaya/sdk-types";
+
 export const ARIA_IMAGE_TYPES: readonly string[] = [
   "image/png",
   "image/jpeg",
@@ -25,6 +27,7 @@ export const ARIA_IMAGE_TYPES: readonly string[] = [
   "image/webp",
   "image/gif",
   "image/heic",
+  "image/heif",
 ];
 
 /** Document MIME types supported by the native Aria reference. */
@@ -33,24 +36,22 @@ export const ARIA_DOCUMENT_TYPES: readonly string[] = [
   "application/vnd.ms-excel", "application/vnd.ms-powerpoint",
   "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
   "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
 ];
 
+/** Android's actual DocumentsProvider reports CSV using this equivalent MIME.
+ * Include it in picker filters, then normalize it back to the wire's text/csv. */
+export const ARIA_DOCUMENT_PICKER_TYPES: readonly string[] = [...ARIA_DOCUMENT_TYPES, "text/comma-separated-values"];
+
 /** At most this many attachments ride one message. The native Aria app caps at
  *  10; nothing on the wire says otherwise. */
 export const ARIA_MAX_ATTACHMENTS = 10;
 
-/** The largest image the composer will try to send, in bytes.
- *
- *  Not a product choice: it is the ceiling of the transfer this slice uses. A
- *  picked photo crosses the worker bridge as a base64 string and is sent inline,
- *  and the inline upload refuses anything over 8 MiB (the `MAX_INLINE_BASE64_BYTES`
- *  bound of the pre-signed upload capability, which it enforces on every arm).
- *  Checking it HERE is what turns that refusal into a sentence the owner can act
- *  on, instead of a chip that fails for no stated reason. */
-export const ARIA_MAX_IMAGE_BYTES = 8 * 1024 * 1024;
-// Inline documents include base64 and JSON overhead under the 4 MiB frame bridge.
-// Larger documents use the file-backed attachment follow-up.
-export const ARIA_MAX_DOCUMENT_BYTES = 2 * 1024 * 1024;
+/** Prepared/staged limits from first-party Composer policy b2205e5f. Full
+ * upload bytes stay in FileHandles; the inline bridge bound is separate. */
+export const ARIA_MAX_IMAGE_BYTES = 4 * 1024 * 1024;
+export const ARIA_MAX_DOCUMENT_BYTES = 25 * 1024 * 1024;
+export const ARIA_MAX_STAGED_BYTES = 100 * 1024 * 1024;
 
 /** A chip in the composer. Every field is always present — a `$item.` path that
  *  is missing on some rows does not substitute — and each `…Hidden` flag
@@ -64,7 +65,7 @@ export interface AriaAttachmentChip {
   state: "uploading" | "ready" | "failed";
   /** The chip's thumbnail as a `data:` URI, set only when the picked image is
    *  small; "" otherwise, which collapses the preview. The full bytes an upload
-   *  and a retry send are held by the worker, never in the chip, because the chip
+   *  and a retry send stay in the host file substrate; only its handle rides the chip, which
    *  rides the service state and a large photo there would exceed the web
    *  runtime's frame limit. */
   thumbUrl: string;
@@ -80,6 +81,9 @@ export interface AriaAttachmentChip {
   /** `genie-upload://<id>` once the bytes have landed; "" until then. The send
    *  carries a chip only when this is set. */
   ref: string;
+  /** Persistent substrate handle: retry after worker restart needs no inline bytes. */
+  file: FileHandle | null;
+  sizeBytes: number;
 }
 
 /** What an upload reports back, delivered as a fresh action so it lands on the
@@ -120,6 +124,7 @@ export function normalizeMime(mime: string): string {
     case "public.jpeg": return "image/jpeg";
     case "public.png": return "image/png";
     case "public.heic": return "image/heic";
+    case "public.heif": return "image/heif";
     case "com.compuserve.gif": return "image/gif";
     case "org.webmproject.webp": return "image/webp";
     case "image/jpg": return "image/jpeg";
@@ -156,20 +161,29 @@ export function imageFileName(mimeType: string, n: number, given?: string): stri
 }
 
 /** Why a picked file cannot be attached, or "" when it can. */
-export type AttachRefusal = "" | "type" | "size" | "count";
+export type AttachRefusal = "" | "type" | "size" | "count" | "total";
 
-export function refusalFor(parsed: ParsedDataUri | null, mimeType: string, attached: number): AttachRefusal {
+/** Pinned first-party Composer policy, revision b2205e5f. The file here is
+ * already normalized: raster preparation happens in the host before staging. */
+export function refusalForFile(bytes: number, mimeType: string, attached: number, stagedBytes = 0): AttachRefusal {
   if (attached >= ARIA_MAX_ATTACHMENTS) return "count";
-  if (!parsed || ![...ARIA_IMAGE_TYPES, ...ARIA_DOCUMENT_TYPES].includes(mimeType)) return "type";
-  if (parsed.bytes > (mimeType.startsWith("image/") ? ARIA_MAX_IMAGE_BYTES : ARIA_MAX_DOCUMENT_BYTES)) return "size";
+  if (![...ARIA_IMAGE_TYPES, ...ARIA_DOCUMENT_TYPES].includes(mimeType) || !Number.isFinite(bytes) || bytes < 0) return "type";
+  const limit = mimeType.startsWith("image/") ? ARIA_MAX_IMAGE_BYTES : ARIA_MAX_DOCUMENT_BYTES;
+  if (bytes > limit) return "size";
+  if (bytes + stagedBytes > ARIA_MAX_STAGED_BYTES) return "total";
   return "";
 }
 
+export function refusalFor(parsed: ParsedDataUri | null, mimeType: string, attached: number): AttachRefusal {
+  if (!parsed) return attached >= ARIA_MAX_ATTACHMENTS ? "count" : "type";
+  return refusalForFile(parsed.bytes, mimeType, attached);
+}
+
 /** A chip in a given state. One constructor so the flags can never disagree
  *  with the state they describe — a failed chip without its retry control is
  *  the shape of bug this rules out. */
 export function chipIn(
-  base: Pick<AriaAttachmentChip, "id" | "name" | "mimeType" | "thumbUrl">,
+  base: Pick<AriaAttachmentChip, "id" | "name" | "mimeType" | "thumbUrl"> & Partial<Pick<AriaAttachmentChip, "file" | "sizeBytes">>,
   state: AriaAttachmentChip["state"],
   labels: { uploading: string; failed: string },
   ref = "",
@@ -182,9 +196,12 @@ export function chipIn(
     "application/vnd.ms-excel": "XLS", "application/vnd.ms-powerpoint": "PPT",
     "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "XLSX",
     "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "DOCX",
+    "application/vnd.openxmlformats-officedocument.presentationml.presentation": "PPTX",
   };
   return {
     ...base,
+    file: base.file ?? null,
+    sizeBytes: base.sizeBytes ?? 0,
     state,
     thumbHidden: !base.thumbUrl,
     documentHidden: base.mimeType.startsWith("image/"),

package/templates/retail-store-owner/tier5-src/_shared/aria-chat.ts

@@ -62,16 +62,19 @@ import {
   ARIA_MAX_ATTACHMENTS,
   ARIA_MAX_IMAGE_BYTES,
   ARIA_MAX_DOCUMENT_BYTES,
+  ARIA_MAX_STAGED_BYTES,
   attachmentLine,
   chipIn,
   imageFileName,
   attachmentMime,
   parseDataUri,
-  refusalFor,
+  refusalForFile,
   sendBlocker,
   type AriaAttachmentChip,
   type AriaAttachmentOutcome,
 } from "./aria-attachments.js";
+import type { FileHandle } from "@himalaya/sdk-types";
+import { createAriaUploadQueue } from "./aria-upload-queue.js";
 import { runClientToolExchange, type AriaClientTools, type ConsentMemory } from "./aria-client-tools.js";
 import { proseOfParts, scanEnvelopes, stripHidden } from "./aria-widgets.js";
 import { isWebUrl, stripMarkdown } from "./aria-widget-model.js";
@@ -480,6 +483,7 @@ export interface AriaChatLabels {
   attachTooMany?: (max: number) => string;
   attachUnsupported?: Resolvable<string>;
   attachTooLarge?: (maxMb: number) => string;
+  attachTotalTooLarge?: (maxMb: number) => string;
   /** Send refused while a photo is still uploading, or failed to. */
   attachWaitUploading?: Resolvable<string>;
   attachWaitFailed?: Resolvable<string>;
@@ -538,18 +542,26 @@ export interface AriaDictationOptions {
  *  Both ports must REJECT (or resolve not-ok) on failure. A port that swallows
  *  an error and resolves as if it had worked would put a photo on the message
  *  that the service never received. */
+export interface AriaPickedAttachment { dataUri?: string; file?: FileHandle; name?: string; mimeType?: string; previewUri?: string; refusal?: "type" | "size" | "count" | "total" }
 export interface AriaAttachmentPorts {
   /** Let the owner pick (or take) one photo. Resolves the image as a `data:`
    *  URI, or null when they cancelled. */
-  pick(source: "library" | "camera" | "document"): Promise<{ dataUri: string; name?: string; mimeType?: string } | null>;
+  pick(source: "library" | "camera" | "document", budget?: { maxItems: number; maxTotalBytes: number }): Promise<AriaPickedAttachment | AriaPickedAttachment[] | null>;
   /** PUT `base64` to a pre-signed url with `contentType`, carrying NO user
    *  credentials — the url authorizes itself. */
   put(url: string, base64: string, contentType: string): Promise<{ ok: boolean; status: number }>;
+  /** File-backed transfer never copies a document into a worker base64 string. */
+  putFile?(url: string, file: FileHandle, contentType: string): Promise<{ ok: boolean; status: number }>;
+  /** Release only imported files refused by draft policy, never live/retry handles. */
+  discard?(file: FileHandle): Promise<void>;
   /** Hand an upload's outcome back to the service as a NEW action
    *  (`attachmentSettled`). A fresh dispatch rather than a return value, because
    *  the upload outlives the action that started it — which must return at once
    *  so the chip paints while the bytes are still moving. */
   settled(outcome: AriaAttachmentOutcome): void;
+  /** Flush this draft at attachment boundaries, before background/pop persistence.
+   * The supplied state excludes transient runtime directives. */
+  persistDraft?(state: AriaChatState): void;
 }
 
 /** Server-provided prompt cards — the chat-service's sibling knowledge service
@@ -1678,12 +1690,13 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
   const attachUploadingText = () => res(o.labels?.attachUploading ?? "Uploading…");
   const attachFailedText = () => res(o.labels?.attachFailed ?? "Couldn't upload");
   const chipLabels = () => ({ uploading: attachUploadingText(), failed: attachFailedText() });
-  const refusalText = (why: "type" | "size" | "count", maxBytes = ARIA_MAX_IMAGE_BYTES): string =>
+  const refusalText = (why: "type" | "size" | "count" | "total", mimeType = "image/jpeg"): string =>
     why === "count"
       ? o.labels?.attachTooMany?.(ARIA_MAX_ATTACHMENTS) ?? `You can attach up to ${ARIA_MAX_ATTACHMENTS} files.`
+      : why === "total" ? o.labels?.attachTotalTooLarge?.(ARIA_MAX_STAGED_BYTES / (1024 * 1024)) ?? `Your attached files exceed ${ARIA_MAX_STAGED_BYTES / (1024 * 1024)} MB in total. Remove a file.`
       : why === "size"
-        ? o.labels?.attachTooLarge?.(maxBytes / (1024 * 1024))
-          ?? `That file is too large to attach (up to ${maxBytes / (1024 * 1024)} MB).`
+        ? o.labels?.attachTooLarge?.((mimeType.startsWith("image/") ? ARIA_MAX_IMAGE_BYTES : ARIA_MAX_DOCUMENT_BYTES) / (1024 * 1024))
+          ?? `That file is too large to attach (up to ${(mimeType.startsWith("image/") ? ARIA_MAX_IMAGE_BYTES : ARIA_MAX_DOCUMENT_BYTES) / (1024 * 1024)} MB).`
         : res(o.labels?.attachUnsupported ?? "That file type can't be attached.");
   const waitUploadingText = () => res(o.labels?.attachWaitUploading ?? "Wait for your file to finish uploading.");
   const waitFailedText = () => res(o.labels?.attachWaitFailed ?? "Retry or remove the file that didn't upload.");
@@ -1699,7 +1712,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  typing…", which a photo edit must never erase. */
   const withoutNotice = <T extends { statusText: string }>(s: T): T => {
     const notices = [waitUploadingText(), waitFailedText(), waitRemoveText(), needsTextText(),
-      refusalText("type"), refusalText("size"), refusalText("size", ARIA_MAX_DOCUMENT_BYTES), refusalText("count")];
+      refusalText("type"), refusalText("size"), refusalText("size", "application/pdf"), refusalText("count"), refusalText("total")];
     return s.statusText && notices.includes(s.statusText) ? { ...s, statusText: "" } : s;
   };
   const toolFailedText = () => res(o.labels?.toolFailed ?? `${assistant()} couldn't finish that. Try again.`);
@@ -2035,6 +2048,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  hands the first action a PERSISTED state whose chips this worker has never
    *  seen; the latch starts empty and would otherwise wipe them. */
   let chipsSeeded = false;
+  let lastPersistedChips: AriaAttachmentChip[] | undefined;
   /** Mints chip ids. Never derived from the file: two photos named
    *  `IMG_0001.jpg` are two chips. */
   let chipSeq = 0;
@@ -2045,6 +2059,24 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  to 8 MB each, the chips alone would exceed that, and the action would fail
    *  before anything rendered. Pruned to the live chips in `gated`. */
   const chipBytes = new Map<string, string>();
+  // Account files belong to this draft until removed/sent. Each queued/active
+  // transport leases its handle until it really exits, including cancelled work.
+  const ownedFiles = new Map<string, FileHandle>();
+  const fileUses = new Map<string, number>();
+  const releasingFiles = new Set<string>();
+  const pruneFiles = (): void => {
+    const discard = o.attachments?.discard;
+    if (!discard) return;
+    const live = new Set(chips.flatMap(chip => chip.file ? [chip.file.uri] : []));
+    for (const [uri, file] of ownedFiles) {
+      if (live.has(uri) || (fileUses.get(uri) ?? 0) > 0 || releasingFiles.has(uri)) continue;
+      releasingFiles.add(uri);
+      void discard(file).then(() => ownedFiles.delete(uri)).catch(() => {
+        // Keep ownership so a later gate can retry a failed cleanup.
+      }).finally(() => releasingFiles.delete(uri));
+    }
+  };
+  const uploadQueue = createAriaUploadQueue<AriaAttachmentOutcome>();
   /** A picked image this small doubles as its own chip thumbnail; a larger one
    *  shows the chip without a preview. Ten of these stay well under a frame. */
   const THUMB_INLINE_MAX = 200_000;
@@ -2054,22 +2086,24 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     chipsSeeded = true;
     const persisted = Array.isArray(s.attachments) ? s.attachments : [];
     // An upload does not survive the process that ran it, so a chip persisted
-    // mid-upload would say "Uploading…" forever. Restore it as failed; only a
-    // chip with retained inline bytes can offer Retry until the file-backed follow-up.
+    // mid-upload would say "Uploading…" forever. Its persisted file handle can
+    // be retried in this owner scope. Legacy chips without a retained source
+    // still offer Remove, but cannot offer a working retry.
     chips = persisted
       .filter((c) => c && typeof c.id === "string")
       .map((c) => {
         const chip = chipIn(c, c.state === "uploading" ? "failed" : c.state, chipLabels(), c.ref);
-        // Inline bytes were worker-owned. A cold-start document or large image
-        // has no source left: keep Remove available, never offer a dead Retry.
-        return chip.state === "failed" && !chip.thumbUrl ? { ...chip, retryHidden: true } : chip;
+        return chip.state === "failed" && !chip.file && !parseDataUri(chip.thumbUrl)
+          ? { ...chip, retryHidden: true } : chip;
       });
     for (const c of chips) {
       const n = Number(/^att-(\d+)$/.exec(c.id)?.[1] ?? 0);
       if (n > chipSeq) chipSeq = n;
-      // A rehydrated chip can retry only the source it kept inline.
+      // Legacy inline consumers can retry a stored thumbnail. File-backed
+      // consumers use c.file, including documents above the inline bridge limit.
       if (c.thumbUrl && !chipBytes.has(c.id)) chipBytes.set(c.id, c.thumbUrl);
     }
+    for (const chip of chips) if (chip.file) ownedFiles.set(chip.file.uri, chip.file);
   };
 
   /** Is Send refused while photos are pending, and what does the owner see?
@@ -2103,20 +2137,32 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
   const startUpload = (chip: AriaAttachmentChip): void => {
     const ports = o.attachments;
     if (!ports) return;
+    const site = siteOf();
+    const current = () => siteOf() === site && chips.some(c => c.id === chip.id && c.state === "uploading");
     const run = async (): Promise<AriaAttachmentOutcome> => {
+      if (!current()) return { id: chip.id, ok: false };
       const parsed = parseDataUri(chipBytes.get(chip.id) ?? chip.thumbUrl);
-      if (!parsed) return { id: chip.id, ok: false };
+      if (!chip.file && !parsed) return { id: chip.id, ok: false };
       const minted = await createFileUpload(chip.name, chip.mimeType);
+      if (!current()) return { id: chip.id, ok: false };
       const id = (minted?.upload?.id ?? "").trim();
       const target = uploadTargetUrl(minted?.upload?.uploadUrl ?? "", chip.name);
       if (!id || !target) return { id: chip.id, ok: false };
-      const sent = await ports.put(target, parsed.base64, chip.mimeType);
+      const sent = chip.file && ports.putFile ? await ports.putFile(target, chip.file, chip.mimeType)
+        : parsed ? await ports.put(target, parsed.base64, chip.mimeType) : null;
       return sent?.ok ? { id: chip.id, ok: true, ref: genieUploadRef(id) } : { id: chip.id, ok: false };
     };
-    run().then(
-      (outcome) => ports.settled(outcome),
-      () => ports.settled({ id: chip.id, ok: false }),
-    );
+    if (chip.file) {
+      ownedFiles.set(chip.file.uri, chip.file);
+      fileUses.set(chip.file.uri, (fileUses.get(chip.file.uri) ?? 0) + 1);
+    }
+    uploadQueue.enqueue(chip.id, run, outcome => ports.settled(outcome ?? { id: chip.id, ok: false }), () => {
+      if (chip.file) {
+        const uses = (fileUses.get(chip.file.uri) ?? 1) - 1;
+        if (uses > 0) fileUses.set(chip.file.uri, uses); else fileUses.delete(chip.file.uri);
+      }
+      pruneFiles();
+    });
   };
 
   /** One create at a time, per site.
@@ -3295,6 +3341,8 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // a cold start stamps the PERSISTED chips rather than an empty latch.
     seedChips(actioned);
     for (const id of [...chipBytes.keys()]) if (!chips.some((c) => c.id === id)) chipBytes.delete(id);
+    uploadQueue.retain(new Set(chips.filter(c => c.state === "uploading").map(c => c.id)));
+    pruneFiles();
     const attachmentsHidden = chips.length === 0;
     let out = actioned.attachments === chips && actioned.attachmentsHidden === attachmentsHidden
       ? actioned
@@ -3313,6 +3361,12 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // `_poll` from here would navigate, or re-arm the timer, a second time.
     committed = settled(out);
     commits += 1;
+    if (lastPersistedChips !== chips && o.attachments?.persistDraft) {
+      try {
+        o.attachments.persistDraft(committed);
+        lastPersistedChips = chips;
+      } catch { /* native snapshot writes are best-effort; retry at the next gate */ }
+    }
     return out;
   };
 
@@ -4194,6 +4248,8 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // Refused BEFORE the picker opens when there is no room: presenting a
       // picker whose result will be thrown away wastes the owner's time.
       if (chips.length >= ARIA_MAX_ATTACHMENTS) return { ...s, statusText: refusalText("count"), error: "" };
+      const remainingBytes = ARIA_MAX_STAGED_BYTES - chips.reduce((sum, chip) => sum + chip.sizeBytes, 0);
+      if (remainingBytes <= 0) return { ...s, statusText: refusalText("total"), error: "" };
       const raw = typeof arg === "string" ? arg : firstString(arg?.source, arg?.value);
       const source = raw.trim().toLowerCase() === "document" ? "document"
         : raw.trim().toLowerCase() === "camera" ? "camera" : "library";
@@ -4207,34 +4263,48 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       const latest = (): AriaChatState => (commits !== at && committed ? committed : s);
       let picked: Awaited<ReturnType<AriaAttachmentPorts["pick"]>>;
       try {
-        picked = await ports.pick(source);
-      } catch (error) {
-        if (/too large|size limit/i.test(String(error))) return { ...latest(), statusText: refusalText("size", source === "document" ? ARIA_MAX_DOCUMENT_BYTES : ARIA_MAX_IMAGE_BYTES), error: "" };
+        picked = await ports.pick(source, { maxItems: ARIA_MAX_ATTACHMENTS - chips.length, maxTotalBytes: remainingBytes });
+      } catch {
         // A picker that could not open is not the owner's fault and there is no
-        // file to talk about; say nothing rather than something misleading.
+        // file to talk about; clear stale attachment advice without erasing
+        // a newer live status, draft or transcript.
         return withoutNotice(latest());
       }
-      if (!picked || !picked.dataUri) return latest();   // cancelled
-      const parsed = parseDataUri(picked.dataUri);
-      const mimeType = attachmentMime(picked.mimeType || parsed?.mimeType || "", picked.name);
-      // Re-checked after the await: other picks may have landed meanwhile.
-      const refused = refusalFor(parsed, mimeType, chips.length);
-      if (refused) return { ...latest(), statusText: refusalText(refused, mimeType.startsWith("image/") ? ARIA_MAX_IMAGE_BYTES : ARIA_MAX_DOCUMENT_BYTES), error: "" };
-      chipSeq += 1;
-      const id = `att-${chipSeq}`;
-      chipBytes.set(id, picked.dataUri);
-      const chip = chipIn({
-        id,
-        name: imageFileName(mimeType, chipSeq, picked.name),
-        mimeType,
-        // Only a small image rides the state as its own thumbnail; see `chipBytes`.
-        thumbUrl: mimeType.startsWith("image/") && picked.dataUri.length <= THUMB_INLINE_MAX ? picked.dataUri : "",
-      }, "uploading", chipLabels());
-      chips = [...chips, chip];
-      startUpload(chip);
-      // Clear a refusal left over from an earlier pick: this one worked. The
-      // typing line is not touched, so picking mid-turn does not hide it.
-      return { ...withoutNotice(latest()), error: "" };
+      if (!picked) return latest();
+      const batch = Array.isArray(picked) ? picked : [picked];
+      // A cancelled picker returns an empty batch: nothing was attached or refused, so the
+      // advice already on screen (a size refusal, a failed upload) stays where it is.
+      if (!batch.length) return latest();
+      let notice = "";
+      for (const file of batch) {
+        const parsed = file.dataUri ? parseDataUri(file.dataUri) : null;
+        const name = file.name ?? file.file?.name;
+        const mimeType = attachmentMime(file.mimeType || file.file?.mimeType || parsed?.mimeType || "", name);
+        const sizeBytes = file.file?.sizeBytes ?? parsed?.bytes;
+        const refused = file.refusal || (sizeBytes === undefined ? "type"
+          : refusalForFile(sizeBytes, mimeType, chips.length, chips.reduce((sum, c) => sum + c.sizeBytes, 0)));
+        if (refused) {
+          notice = refusalText(refused, mimeType);
+          if (file.file && ports.discard) {
+            try { await ports.discard(file.file); } catch { /* preserve the refusal if cleanup is unavailable */ }
+          }
+          continue;
+        }
+        chipSeq += 1;
+        const id = `att-${chipSeq}`;
+        if (file.dataUri) chipBytes.set(id, file.dataUri);
+        const preview = file.previewUri || (mimeType.startsWith("image/") && file.dataUri && file.dataUri.length <= THUMB_INLINE_MAX ? file.dataUri : "");
+        const chip = chipIn({
+          id, name: imageFileName(mimeType, chipSeq, name), mimeType,
+          thumbUrl: mimeType.startsWith("image/") && preview.length <= THUMB_INLINE_MAX ? preview : "",
+          file: file.file ?? null, sizeBytes,
+        }, "uploading", chipLabels());
+        chips = [...chips, chip];
+        startUpload(chip);
+      }
+      // Stage valid files in a partially accepted batch and explain every
+      // refusal; never silently discard an over-limit selection.
+      return { ...withoutNotice(latest()), statusText: notice || withoutNotice(latest()).statusText, error: "" };
     },
 
     suggestionsSettled: (s, arg) => {
@@ -4287,7 +4357,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     retryAttachment: (s, arg) => {
       const id = chipIdOf(arg);
       const current = chips.find((c) => c.id === id);
-      if (!current || current.state !== "failed" || (!chipBytes.get(id) && !current.thumbUrl)) return s;
+      if (!current || current.state !== "failed" || (!current.file && !parseDataUri(chipBytes.get(id) ?? current.thumbUrl))) return s;
       // A NEW id for the new attempt, in the same place in the strip. Keeping the
       // old one would let the first attempt's outcome, if it is still in the air,
       // settle this one.

package/templates/retail-store-owner/tier5-src/_shared/aria-upload-queue.ts

@@ -0,0 +1,47 @@
+/** Three upload workers, matching first-party Aria b2205e5f. A removed
+ * in-flight task retains its slot until its transport actually exits: ignoring
+ * an outcome is not cancellation of native buffers/network activity. */
+export function createAriaUploadQueue<T>(concurrency = 3) {
+  if (!Number.isInteger(concurrency) || concurrency < 1) throw new Error("invalid upload concurrency");
+  interface Task { id: string; cancelled: boolean; started: boolean; released: boolean; release?: () => void; run: () => Promise<T>; settle: (result: T | undefined, error?: unknown) => void }
+  const pending: Task[] = [];
+  const tasks = new Map<string, Task>();
+  let active = 0;
+  const release = (task: Task): void => {
+    if (task.released) return;
+    task.released = true;
+    try { task.release?.(); } catch { /* cleanup must not strand the queue */ }
+  };
+  const pump = (): void => {
+    while (active < concurrency && pending.length) {
+      const task = pending.shift()!;
+      if (task.cancelled) { release(task); continue; }
+      task.started = true;
+      active += 1;
+      void Promise.resolve().then(task.run).then(
+        result => { if (!task.cancelled) task.settle(result); },
+        error => { if (!task.cancelled) task.settle(undefined, error); },
+      ).catch(() => { /* delivery must not strand a transport slot */ }).finally(() => {
+        active -= 1;
+        release(task);
+        if (tasks.get(task.id) === task) tasks.delete(task.id);
+        pump();
+      });
+    }
+  };
+  return {
+    enqueue(id: string, run: () => Promise<T>, settle: Task["settle"], release?: () => void): void {
+      if (tasks.has(id)) return;
+      const task = { id, cancelled: false, started: false, released: false, release, run, settle };
+      tasks.set(id, task); pending.push(task); pump();
+    },
+    retain(ids: ReadonlySet<string>): void {
+      for (const [id, task] of tasks) {
+        if (ids.has(id)) continue;
+        task.cancelled = true;
+        if (!task.started) release(task);
+        tasks.delete(id);
+      }
+    },
+  };
+}

package/templates/retail-store-owner/tier5-src/himi-owner-lite-aria/index.ts

@@ -26,11 +26,17 @@
 
 import { readAsyncJobState } from "../_shared/aria-async-jobs.js";
 import { defineService } from "@himalaya/state";
+import { serializeForAgent } from "@himalaya/agent";
 import { open } from "@himalaya/open-url";
 import { writeText } from "@himalaya/clipboard";
 import { availability, recognizeOnce, stop as stopSpeech } from "@himalaya/speech";
-import { capturePhoto, pickDocument } from "@himalaya/camera";
-import { put } from "@himalaya/presigned-upload";
+import { capturePhoto, prepareImage } from "@himalaya/camera";
+import { pickDetailed as pickPhotos } from "@himalaya/photos";
+import { pickDetailed as pickFiles } from "@himalaya/file-picker";
+import { write as writeFile, remove as removeFile } from "@himalaya/files";
+import { put, putFile } from "@himalaya/presigned-upload";
+import { ARIA_MAX_ATTACHMENTS, ARIA_MAX_DOCUMENT_BYTES, ARIA_MAX_STAGED_BYTES, ARIA_IMAGE_TYPES, ARIA_DOCUMENT_PICKER_TYPES, attachmentMime, parseDataUri } from "../_shared/aria-attachments.js";
+import type { FileHandle } from "@himalaya/sdk-types";
 import { alert } from "@himalaya/ui";
 import { auth } from "@himalaya/wix-platform";
 import {
@@ -42,6 +48,7 @@ import {
   type AriaChatState,
   type AriaDictationResult,
   type AriaPromptChip,
+  type AriaPickedAttachment,
 } from "../_shared/aria-chat.js";
 import { WIDGET_SUBTREE_SLOT } from "../_shared/aria-generic-widget.js";
 import { copyParam, copyTemplate, stashCopy } from "../_shared/himi-copy.js";
@@ -265,6 +272,7 @@ const core = createAriaChat({
     attachFailed: () => copyParam("ownerAria.attach.failed", "Couldn't upload"),
     attachTooMany: (max) => copyTemplate("ownerAria.attach.tooMany", "You can attach up to {max} files.", { max }),
     attachUnsupported: () => copyParam("ownerAria.attach.unsupported", "That file type can't be attached."),
+    attachTotalTooLarge: (mb) => copyTemplate("ownerAria.attach.totalTooLarge", "Your attached files exceed {mb} MB in total. Remove a file.", { mb }),
     attachTooLarge: (mb) => copyTemplate("ownerAria.attach.tooLarge", "That file is too large to attach (up to {mb} MB).", { mb }),
     attachWaitUploading: () => copyParam("ownerAria.attach.waitUploading", "Wait for your file to finish uploading."),
     attachWaitFailed: () => copyParam("ownerAria.attach.waitFailed", "Retry or remove the file that didn't upload."),
@@ -311,25 +319,68 @@ const core = createAriaChat({
     deliver: (r) => { void svc.dictated(r); },
     available: async () => (await availability()).recognition !== "unavailable",
   },
-  // Photo attachments. The two device capabilities live HERE rather than
-  // in the shared core so that only a screen which declares them imports them:
-  // `camera` for the picker (it returns the image already re-encoded as JPEG and
-  // scaled to 2048 px on its longest side, which is also what keeps a phone
-  // photo inside the inline upload bound) and `presigned_upload` for the bytes,
-  // which go to a self-authorizing url with no Wix credential attached.
+  // Pick into the account file substrate, normalize raster images on the host,
+  // and upload handles without copying full file bytes into worker state.
   attachments: {
-    pick: async (source) => {
+    persistDraft: state => serializeForAgent({ [SERVICE]: state }),
+    discard: file => removeFile(file),
+    pick: async (source, budget) => {
+      let files: FileHandle[];
+      const picked: AriaPickedAttachment[] = [];
       if (source === "document") {
-        const file = await pickDocument();
-        return file ? { dataUri: file.uri, name: file.name, mimeType: file.mime } : null;
+        const result = await pickFiles({ types: [...ARIA_IMAGE_TYPES, ...ARIA_DOCUMENT_PICKER_TYPES], multiple: true,
+          maxBytes: ARIA_MAX_DOCUMENT_BYTES, maxImageBytes: 32 * 1024 * 1024,
+          maxItems: budget?.maxItems ?? ARIA_MAX_ATTACHMENTS, maxTotalBytes: budget?.maxTotalBytes ?? ARIA_MAX_STAGED_BYTES });
+        files = result.items;
+        picked.push(...result.rejected.map(file => ({ name: file.name, mimeType: file.mimeType, refusal: file.reason })));
       }
-      const asset = await capturePhoto({ source, maxEdgePixels: 2048 });
-      return asset ? { dataUri: asset.uri, mimeType: asset.mime } : null;
+      else if (source === "library") {
+        const result = await pickPhotos({ limit: budget?.maxItems ?? ARIA_MAX_ATTACHMENTS, type: "images",
+          maxBytes: 32 * 1024 * 1024, maxTotalBytes: budget?.maxTotalBytes ?? ARIA_MAX_STAGED_BYTES });
+        files = result.items;
+        picked.push(...result.rejected.map(file => ({ name: file.name, mimeType: file.mimeType, refusal: file.reason })));
+      }
+      else {
+        const asset = await capturePhoto({ source: "camera", maxEdgePixels: 2048 });
+        if (!asset) return [];
+        const parsed = parseDataUri(asset.uri);
+        if (!parsed) throw new Error("Camera returned an unsupported image");
+        const path = `captures/${Date.now()}-${Math.random().toString(36).slice(2)}-photo.jpg`;
+        files = [await writeFile(path, { base64: parsed.base64 }, { mimeType: asset.mime })];
+      }
+      // A camera capture is stored under a unique internal path; it has no name of its own to
+      // show or send, so `name: ""` asks the chat core for its `photo-N.jpg` fallback instead.
+      const shownName = source === "camera" ? { name: "" } : {};
+      for (const original of files) {
+        const mimeType = attachmentMime(original.mimeType, original.name);
+        const file = { ...original, mimeType };
+        if (ARIA_IMAGE_TYPES.includes(mimeType)) {
+          try {
+            const prepared = await prepareImage(file);
+            picked.push({ file: prepared.file, previewUri: prepared.previewUri, ...shownName });
+            // The codec may write a replacement. Keep the prepared upload/retry
+            // handle, and release only the now-unused original import.
+            if (prepared.file.uri !== file.uri) {
+              try { await removeFile(file); } catch { /* best-effort import cleanup */ }
+            }
+          } catch (error) {
+            // A rejected codec/oversize image still reaches policy as an
+            // unsupported entry, so the owner gets an actionable refusal.
+            try { await removeFile(file); } catch { /* keep the policy refusal on cleanup failure */ }
+            picked.push({ name: file.name, mimeType, refusal: /size limit|oversized/i.test(String(error)) ? "size" : "type" });
+          }
+        } else picked.push({ file, ...shownName });
+      }
+      return picked;
     },
     put: async (url, base64, contentType) => {
       const r = await put(url, { base64 }, { contentType, method: "PUT" });
       return { ok: r.ok, status: r.status };
     },
+    putFile: async (url, file, contentType) => {
+      const r = await putFile(url, file, { contentType, method: "PUT" });
+      return { ok: r.ok, status: r.status };
+    },
     // A NEW action on the service, not a return value: the upload outlives the
     // `attach` that started it. `svc` is read at call time, long after it exists.
     settled: (outcome) => { void svc.attachmentSettled(outcome); },

package/templates/yoga-studio-owner/config.ts

@@ -37,7 +37,7 @@ export default defineApp({
     actions: "http://localhost:8190/v1/actions",
     sync: "http://localhost:8190/v1/sync",
   },
-  capabilities: ["live_activity","push","share","secure_storage","open_url","local_database","clipboard","ui","speech","camera","presigned_upload","app_info","biometrics","wix_platform"],
+  capabilities: ["live_activity","push","share","secure_storage","open_url","local_database","clipboard","ui","speech","camera","photos","file_picker","files","presigned_upload","app_info","biometrics","wix_platform"],
   designTokensPath: "./tokens.json",
   navigation: {
     "navKind": "responsive",

package/templates/yoga-studio-owner/dev/index.ts

@@ -60987,6 +60987,9 @@ const SCREENS = runtimeSetting({
         "ui",
         "speech",
         "camera",
+        "photos",
+        "file_picker",
+        "files",
         "presigned_upload",
         "stream",
         "wix_platform"