oasis_test_v2 2.2.118 → 2.2.119

package/dist/index.js

@@ -756,7 +756,7 @@ function isDispatchFenced(error3) {
 function isCompanyMembersLockLost(error3) {
   return typeof error3 === "object" && error3 !== null && error3.companyMembersLockLost === true;
 }
-var SeqConflictError, BlobNotFoundError, BlobRangeNotSatisfiableError, BlobBackendError, BlobTooLargeError, BlobIntegrityError, AssistantBindConflictError, TraceSeqConflictError, DispatchUndecidableError, DispatchFencedError, CompanyMembersLockLostError;
+var SeqConflictError, BlobNotFoundError, BlobRangeNotSatisfiableError, BlobBackendError, BlobTooLargeError, BlobSweepAbortedError, BlobIntegrityError, AssistantBindConflictError, TraceSeqConflictError, DispatchUndecidableError, DispatchFencedError, CompanyMembersLockLostError;
 var init_errors = __esm({
   "../contract/src/errors.ts"() {
     "use strict";
@@ -802,6 +802,15 @@ var init_errors = __esm({
       }
       name = "BlobTooLargeError";
     };
+    BlobSweepAbortedError = class extends Error {
+      constructor(candidateRows, totalRows, maxDeleteRatio) {
+        super(`blob sweep aborted: ${candidateRows}/${totalRows} rows would be deleted, above maxDeleteRatio ${maxDeleteRatio}; nothing deleted`);
+        this.candidateRows = candidateRows;
+        this.totalRows = totalRows;
+        this.maxDeleteRatio = maxDeleteRatio;
+      }
+      name = "BlobSweepAbortedError";
+    };
     BlobIntegrityError = class extends Error {
       constructor(expectedHash, actualHash) {
         super(`blob hash mismatch: expected ${expectedHash}, got ${actualHash}`);
@@ -869,6 +878,24 @@ var init_errors = __esm({
 });
 
 // ../contract/src/storage.ts
+function planBlobSweep(entries, reachable, opts = {}, nowMs = Date.now()) {
+  const cutoff = nowMs - Math.max(0, opts.graceMs ?? 0);
+  const candidates = entries.filter((e5) => !reachable.has(e5.hash) && (opts.graceMs ? e5.putAtMs < cutoff : true));
+  const report = {
+    dryRun: opts.dryRun === true,
+    totalRows: entries.length,
+    candidateRows: candidates.length,
+    candidateBytes: candidates.reduce((n3, e5) => n3 + e5.size, 0),
+    deletedRows: 0,
+    deletedBytes: 0,
+    orphansFound: 0,
+    orphansDeleted: 0
+  };
+  if (opts.maxDeleteRatio !== void 0 && entries.length > 0 && candidates.length / entries.length > opts.maxDeleteRatio) {
+    throw new BlobSweepAbortedError(candidates.length, entries.length, opts.maxDeleteRatio);
+  }
+  return { report, toDelete: opts.dryRun ? [] : candidates };
+}
 async function putBlobStream(store, source, opts = {}) {
   if (store.putStream) return store.putStream(source, opts);
   const parts = [];
@@ -2819,6 +2846,52 @@ var init_file_limits2 = __esm({
   }
 });
 
+// ../server/src/raw-upload.ts
+function isRawUploadRequest(method, pathname) {
+  return RAW_UPLOAD_ROUTES.some((r5) => r5.method === method && r5.path.test(pathname));
+}
+function rawUploadName(req) {
+  const raw = req.headers["x-oasis-filename"];
+  const value2 = Array.isArray(raw) ? raw[0] : raw;
+  if (!value2) return void 0;
+  let name;
+  try {
+    name = decodeURIComponent(value2);
+  } catch {
+    return void 0;
+  }
+  return name.trim() || void 0;
+}
+function rawUploadContentType(req) {
+  const value2 = req.headers["content-type"]?.trim();
+  return value2 && value2 !== "application/octet-stream" ? value2 : void 0;
+}
+async function putRawUpload(store, req, opts) {
+  const code2 = opts.tooLargeCode ?? "FILE_TOO_LARGE";
+  const tooLarge = () => new ApiError(413, code2, `\u6587\u4EF6\u8D85\u8FC7 ${opts.maxBytes / 1024 / 1024} MiB \u4E0A\u9650`);
+  const declared = req.headers["content-length"];
+  if (declared !== void 0 && Number(declared) > opts.maxBytes) throw tooLarge();
+  try {
+    return await putBlobStream(store, req.iterator({ destroyOnReturn: false }), { maxBytes: opts.maxBytes });
+  } catch (err) {
+    if (err instanceof BlobTooLargeError) throw tooLarge();
+    throw err;
+  }
+}
+var RAW_UPLOAD_ROUTES;
+var init_raw_upload = __esm({
+  "../server/src/raw-upload.ts"() {
+    "use strict";
+    init_src();
+    init_router();
+    RAW_UPLOAD_ROUTES = [
+      { method: "PUT", path: /^\/api\/chat\/attachments\/raw$/ },
+      { method: "POST", path: /^\/api\/workorders\/[^/]+\/files\/raw$/ },
+      { method: "POST", path: /^\/api\/projects\/[^/]+\/files\/raw$/ }
+    ];
+  }
+});
+
 // ../server/src/chat-system-message.ts
 async function appendChatMessageOnce(store, m4) {
   const opts = { source: "system" };
@@ -153854,15 +153927,34 @@ async function reachableBlobs(refs, blobs) {
   }
   return reachable;
 }
-async function gc(refs, blobs) {
+function projectFileRefs(projects) {
+  return async () => {
+    const out = /* @__PURE__ */ new Set();
+    for (const p4 of await projects.listProjects()) {
+      for (const f6 of await projects.listProjectFiles(p4.id)) if (f6.blobId) out.add(f6.blobId);
+      for (const loc of await projects.listContentLocations(p4.id)) if (loc.blob?.blobId) out.add(loc.blob.blobId);
+    }
+    return out;
+  };
+}
+async function gc(refs, blobs, opts = {}) {
   const reachable = await reachableBlobs(refs, blobs);
-  await blobs.sweep(reachable);
-  return { reachableCount: reachable.size };
+  for (const extra of opts.extraRefs ?? []) for (const h5 of await extra()) reachable.add(h5);
+  const report = await blobs.sweep(reachable, {
+    dryRun: opts.dryRun === true,
+    graceMs: opts.graceMs ?? GC_DEFAULT_GRACE_MS,
+    maxDeleteRatio: opts.maxDeleteRatio ?? GC_DEFAULT_MAX_DELETE_RATIO,
+    ...opts.orphans ? { orphans: true } : {}
+  });
+  return { reachableCount: reachable.size, report: report ?? null };
 }
+var GC_DEFAULT_GRACE_MS, GC_DEFAULT_MAX_DELETE_RATIO;
 var init_gc = __esm({
   "../core/src/gc.ts"() {
     "use strict";
     init_manifest_store();
+    GC_DEFAULT_GRACE_MS = 24 * 60 * 60 * 1e3;
+    GC_DEFAULT_MAX_DELETE_RATIO = 0.2;
   }
 });
 
@@ -213973,11 +214065,30 @@ ${acceptanceCriteria.map((c5) => `- ${c5}`).join("\n")}`] : []
       return { message: "tool_call \u5DF2\u7559\u75D5" };
     }
     case "gc": {
+      const dryRun = args["dryRun"] === true;
+      const orphans = args["orphans"] === true;
+      const ratio = (key2, lo, hi) => {
+        const v2 = args[key2];
+        if (v2 === void 0 || v2 === null) return void 0;
+        if (typeof v2 !== "number" || !Number.isFinite(v2) || v2 < lo || v2 > hi) throw new Error(`\u53C2\u6570 ${key2} \u5FC5\u987B\u662F ${lo}\u2013${hi} \u4E4B\u95F4\u7684\u6570`);
+        return v2;
+      };
+      const graceHours = ratio("graceHours", 0, 24 * 365);
+      const maxDeleteRatio = ratio("maxDeleteRatio", 0, 1);
+      if (!ctx.projectState && !dryRun) throw new Error("gc\uFF1A\u62FF\u4E0D\u5230\u672C\u516C\u53F8\u9879\u76EE\u5E93\uFF0C\u9879\u76EE\u6587\u4EF6\u65E0\u6CD5\u8FDB\u53EF\u8FBE\u96C6\uFF1B\u53EA\u5141\u8BB8 --dry-run");
       const result = await gc(async () => {
         if (!engineStore) return [];
         return engineStore.transaction((tx) => tx.listAllArtifactRefs());
-      }, blobs);
-      return { message: `GC \u5B8C\u6210\uFF1A\u4E8B\u5B9E\u67DC\u53EF\u8FBE blob ${result.reachableCount} \u4E2A\uFF0C\u5176\u4F59\u5DF2\u6E05\u626B`, data: result };
+      }, blobs, {
+        ...ctx.projectState ? { extraRefs: [projectFileRefs(ctx.projectState)] } : {},
+        dryRun,
+        orphans,
+        ...graceHours !== void 0 ? { graceMs: graceHours * 36e5 } : {},
+        ...maxDeleteRatio !== void 0 ? { maxDeleteRatio } : {}
+      });
+      const r5 = result.report;
+      const summary = !r5 ? "\uFF08\u5B58\u50A8\u672A\u56DE\u62A5\u6E05\u626B\u6570\uFF09" : dryRun ? `dry-run\uFF1A\u5171 ${r5.totalRows} \u884C\uFF0C\u4F1A\u5220 ${r5.candidateRows} \u884C / ${r5.candidateBytes} \u5B57\u8282${orphans ? `\uFF0C\u5B64\u513F\u5BF9\u8C61 ${r5.orphansFound} \u4E2A` : ""}\uFF1B\u672A\u5220\u9664\u4EFB\u4F55\u5185\u5BB9` : `\u5171 ${r5.totalRows} \u884C\uFF0C\u5220\u9664 ${r5.deletedRows} \u884C / ${r5.deletedBytes} \u5B57\u8282${orphans ? `\uFF0C\u5B64\u513F\u5BF9\u8C61 ${r5.orphansDeleted} \u4E2A` : ""}`;
+      return { message: `GC \u5B8C\u6210\uFF1A\u4E8B\u5B9E\u67DC\u53EF\u8FBE blob ${result.reachableCount} \u4E2A\uFF1B${summary}`, data: result };
     }
     default:
       throw new Error(`\u672A\u77E5\u547D\u4EE4: ${command6}`);
@@ -215099,13 +215210,15 @@ async function startOasisServer(opts) {
     void (async () => {
       try {
         res.setHeader("access-control-allow-origin", "*");
-        res.setHeader("access-control-allow-methods", "GET,POST,PATCH,DELETE,OPTIONS");
-        res.setHeader("access-control-allow-headers", "authorization,content-type");
+        res.setHeader("access-control-allow-methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+        res.setHeader("access-control-allow-headers", "authorization,content-type,x-oasis-company,x-oasis-filename");
         if (req.method === "OPTIONS") {
           res.writeHead(204).end();
           return;
         }
         const url = new URL(req.url ?? "/", "http://localhost");
+        const rawUpload = isRawUploadRequest(req.method, url.pathname);
+        if (rawUpload) res.setHeader("connection", "close");
         if (url.pathname === "/healthz" && url.searchParams.get("deep") === "1") {
           const db = opts.deepHealth ? await opts.deepHealth() : { ok: true, db: "none" };
           res.writeHead(db.ok ? 200 : 503, { "content-type": "application/json" }).end(JSON.stringify({ ok: db.ok, ...getBuildInfo(), db }));
@@ -215283,13 +215396,13 @@ async function startOasisServer(opts) {
         const requestMaxBytes = fileUploadRequestMaxBytes(fileLimits);
         const chunks = [];
         let requestBytes = 0;
-        const declared = Number(req.headers["content-length"] ?? 0);
+        const declared = rawUpload ? 0 : Number(req.headers["content-length"] ?? 0);
         if (declared > requestMaxBytes) {
           req.resume();
           res.writeHead(413, { "content-type": "application/json" }).end(JSON.stringify({ error: { code: "UPLOAD_TOO_LARGE", message: "\u4E0A\u4F20\u8BF7\u6C42\u8D85\u8FC7\u901A\u9053\u5BB9\u91CF" } }));
           return;
         }
-        for await (const chunk of req) {
+        if (!rawUpload) for await (const chunk of req) {
           requestBytes += chunk.length;
           if (requestBytes > requestMaxBytes) {
             res.writeHead(413, { "content-type": "application/json" }).end(JSON.stringify({ error: { code: "UPLOAD_TOO_LARGE", message: "\u4E0A\u4F20\u8BF7\u6C42\u8D85\u8FC7\u901A\u9053\u5BB9\u91CF" } }));
@@ -215536,7 +215649,7 @@ async function startOasisServer(opts) {
               }
               const chatAnchorMessageId = await anchorMessageIdFor(chatOrigin, chatStoreNowOrNull);
               const spawnArgs = body2.args;
-              const needsProject = body2.command === "spawn" && (spawnArgs?.["createdVia"] === "seed" || spawnArgs?.["project_id"] !== void 0 || spawnArgs?.["projectId"] !== void 0);
+              const needsProject = body2.command === "gc" || body2.command === "spawn" && (spawnArgs?.["createdVia"] === "seed" || spawnArgs?.["project_id"] !== void 0 || spawnArgs?.["projectId"] !== void 0);
               const assertCmdPlanMembers = (plan) => assertPlanMembers(plan).catch((err) => {
                 if (err instanceof NotCompanyMemberError) throw new ApiError(err.status, err.code, err.message);
                 throw err;
@@ -216784,6 +216897,21 @@ async function startOasisServer(opts) {
             }
             return;
           }
+          if (url.pathname === "/api/chat/attachments/raw" && req.method === "PUT" && opts.assets) {
+            const uploadKind = url.searchParams.get("purpose");
+            const maxBytes = uploadKind === "knowledge" ? fileLimits.knowledgeBytes : uploadKind === "cli" ? fileLimits.cliBytes : fileLimits.attachmentBytes;
+            try {
+              const out = await putRawUpload(opts.assets, req, { maxBytes, tooLargeCode: "ATTACHMENT_TOO_LARGE" });
+              res.writeHead(201, { "content-type": "application/json" }).end(JSON.stringify({ blobRef: out.hash }));
+            } catch (err) {
+              const e5 = err instanceof ApiError ? err : null;
+              if (!e5) console.error(`[chat/attachments/raw] ${err instanceof Error ? err.message : String(err)}`);
+              res.writeHead(e5?.status ?? 500, { "content-type": "application/json" }).end(JSON.stringify({
+                error: e5 ? { code: e5.code, message: e5.status === 413 ? `\u9644\u4EF6\u8D85\u8FC7 ${maxBytes / 1024 / 1024}MB \u4E0A\u9650` : e5.message } : { code: "ATTACHMENT_UPLOAD_FAILED", message: "\u9644\u4EF6\u4FDD\u5B58\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5" }
+              }));
+            }
+            return;
+          }
           if (url.pathname === "/api/chat/attachments" && req.method === "POST" && opts.uploadChatAttachment) {
             try {
               const body2 = JSON.parse(rawBody);
@@ -219402,6 +219530,7 @@ var init_server3 = __esm({
     "use strict";
     init_src();
     init_file_limits2();
+    init_raw_upload();
     http = __toESM(require("node:http"), 1);
     import_node_crypto44 = require("node:crypto");
     import_node_stream3 = require("node:stream");
@@ -223172,7 +223301,7 @@ var init_blob_object_backend = __esm({
         for await (const file of walk(base)) {
           const st = await fs25.promises.stat(file).catch(() => null);
           if (!st) continue;
-          yield { key: path24.relative(this.root, file).split(path24.sep).join("/"), size: st.size, mtimeMs: st.mtimeMs };
+          yield { key: path24.relative(this.root, file).split(path24.sep).join("/"), size: st.size, mtimeMs: Math.max(st.mtimeMs, st.ctimeMs) };
         }
       }
     };
@@ -225338,15 +225467,29 @@ var init_service4 = __esm({
       }
       /** 上传一个项目普通文件：内容入 blob 库，记一条元信息旁存（非 oplog 事实）。 */
       async addProjectFile(input) {
-        if (!this.blobs) throw new Error("\u9879\u76EE\u6587\u4EF6\u4E0A\u4F20\u9700\u8981 blob \u5E93\uFF08domain \u672A\u6CE8\u5165 blobs\uFF09");
+        const blobs = this.projectFileBlobs();
         assertFileBytes(input.bytes);
-        const blobId = await this.blobs.put(input.bytes);
+        const blobId = await blobs.put(input.bytes);
+        const { bytes: bytes2, ...meta } = input;
+        return this.recordProjectFile({ ...meta, blobId, size: bytes2.byteLength });
+      }
+      /**
+       * 项目文件的字节柜。原始字节上传（`POST /api/projects/:id/files/raw`，ADR 0638 S4）由路由把请求体
+       * 流式写进这里，再调 {@link recordProjectFile} 记行。
+       */
+      projectFileBlobs() {
+        if (!this.blobs) throw new Error("\u9879\u76EE\u6587\u4EF6\u4E0A\u4F20\u9700\u8981 blob \u5E93\uFF08domain \u672A\u6CE8\u5165 blobs\uFF09");
+        return this.blobs;
+      }
+      /** 字节已进柜之后的那一半：记一条项目文件元信息。 */
+      async recordProjectFile(input) {
+        const { blobId, size } = input;
         const file = {
           projectId: input.projectId,
           fileId: `pf_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`,
           name: input.name,
           ...input.path !== void 0 ? { path: input.path } : {},
-          size: input.bytes.byteLength,
+          size,
           blobId,
           ...input.contentType !== void 0 ? { contentType: input.contentType } : {},
           ...input.uploadedBy !== void 0 ? { uploadedBy: input.uploadedBy } : {},
@@ -226919,13 +227062,25 @@ var init_dev_store = __esm({
       async put(bytes2) {
         const hash3 = (0, import_node_crypto51.createHash)("sha256").update(bytes2).digest("hex");
         const existing = fs26.statSync(this.fileOf(hash3), { throwIfNoEntry: false });
-        if (existing?.isFile() && existing.size === bytes2.byteLength) return hash3;
+        if (existing?.isFile() && existing.size === bytes2.byteLength) {
+          this.touch(hash3);
+          return hash3;
+        }
         return (await this.putStream(singleChunk(bytes2))).hash;
       }
+      /** 重复 put 也刷新 mtime：GC 宽限期按它算（同 PG 的 `last_put_at`）。 */
+      touch(hash3) {
+        const now = /* @__PURE__ */ new Date();
+        try {
+          fs26.utimesSync(this.fileOf(hash3), now, now);
+        } catch {
+        }
+      }
       /** 流式写（ADR 0638 §3.2）：边收边算 hash，超 `maxBytes` / hash 不符删残件抛错。 */
       async putStream(source, opts) {
         const staged = await stageBlob(this.tmpDir, source, opts);
         await commitStagedFile(staged, this.fileOf(staged.hash), 420);
+        this.touch(staged.hash);
         const contentType = sniffContentType(staged.head);
         return { hash: staged.hash, size: staged.size, ...contentType ? { contentType } : {} };
       }
@@ -226981,10 +227136,20 @@ var init_dev_store = __esm({
       async has(hash3) {
         return BLOB_NAME.test(hash3) && fs26.statSync(this.fileOf(hash3), { throwIfNoEntry: false })?.isFile() === true;
       }
-      async sweep(reachable) {
+      async sweep(reachable, opts = {}) {
+        const entries = [];
         for (const name of fs26.readdirSync(this.dir)) {
-          if (BLOB_NAME.test(name) && !reachable.has(name)) fs26.unlinkSync(this.fileOf(name));
+          if (!BLOB_NAME.test(name)) continue;
+          const st = fs26.statSync(this.fileOf(name), { throwIfNoEntry: false });
+          if (st?.isFile()) entries.push({ hash: name, size: st.size, putAtMs: st.mtimeMs });
+        }
+        const { report, toDelete } = planBlobSweep(entries, reachable, opts);
+        for (const e5 of toDelete) {
+          fs26.rmSync(this.fileOf(e5.hash), { force: true });
+          report.deletedRows++;
+          report.deletedBytes += e5.size;
         }
+        return report;
       }
     };
     MUTATORS = [
@@ -229104,6 +229269,18 @@ async function copySessionOutputs(deps) {
       result.skipped.push({ path: file.path, code: "BUDGET" });
       continue;
     }
+    const release2 = file.size > OUTPUT_COPY_SERIAL_BYTES && deps.acquireLargeFileSlot ? await deps.acquireLargeFileSlot() : void 0;
+    try {
+      await copyOne(file);
+    } finally {
+      release2?.();
+    }
+  }
+  async function copyOne(file) {
+    if (Date.now() >= deadline) {
+      result.skipped.push({ path: file.path, code: "BUDGET" });
+      return;
+    }
     let read3;
     try {
       read3 = await deps.bridge.read(
@@ -229113,20 +229290,20 @@ async function copySessionOutputs(deps) {
       );
     } catch {
       result.skipped.push({ path: file.path, code: "READ_FAILED" });
-      continue;
+      return;
     }
     if (!read3.ok) {
       result.skipped.push({ path: file.path, code: read3.code === "TOO_LARGE" ? "TOO_LARGE" : "READ_FAILED" });
-      continue;
+      return;
     }
     const bytes2 = Buffer.from(read3.contentBase64, "base64");
     if (bytes2.length > limits.maxFileBytes) {
       result.skipped.push({ path: file.path, code: "TOO_LARGE" });
-      continue;
+      return;
     }
     if (bytes2.length !== file.size || read3.mtime && read3.mtime !== file.mtime) {
       result.skipped.push({ path: file.path, code: "FILE_CHANGED" });
-      continue;
+      return;
     }
     const saved = existing?.[file.path];
     if (saved && savedContentHash(saved) === (0, import_node_crypto53.createHash)("sha256").update(bytes2).digest("hex")) {
@@ -229134,14 +229311,14 @@ async function copySessionOutputs(deps) {
       delete aligned.editedAt;
       realigned.push(aligned);
       result.unchanged.push(file.path);
-      continue;
+      return;
     }
     let blobRef;
     try {
-      blobRef = await deps.putBlob(new Uint8Array(bytes2));
+      blobRef = await deps.putBlob(bytes2);
     } catch {
       result.skipped.push({ path: file.path, code: "STORE_FAILED" });
-      continue;
+      return;
     }
     result.copied.push({
       path: file.path,
@@ -229167,6 +229344,8 @@ async function copySessionOutputs(deps) {
 }
 function createOutputCopyScheduler(deps) {
   const inFlight = /* @__PURE__ */ new Map();
+  const largeFiles = createKeyedMutex();
+  const acquireLargeFileSlot = () => largeFiles.acquire("large-output-copy");
   return {
     schedule(args) {
       const { store, chatSessionId, companyId } = args;
@@ -229190,6 +229369,7 @@ function createOutputCopyScheduler(deps) {
             readCopies,
             mergeCopies,
             putBlob: deps.putBlob,
+            acquireLargeFileSlot,
             ...deps.limits ? { limits: deps.limits } : {}
           });
           const maxFileMiB = Math.round((deps.limits ?? OUTPUT_COPY_LIMITS).maxFileBytes / 1024 / 1024);
@@ -229226,17 +229406,19 @@ function createOutputCopyScheduler(deps) {
     }
   };
 }
-var import_node_crypto53, OUTPUT_COPY_LIMITS;
+var import_node_crypto53, OUTPUT_COPY_LIMITS, OUTPUT_COPY_SERIAL_BYTES;
 var init_outputs_copy = __esm({
   "../server/src/domains/chat-sessions/outputs-copy.ts"() {
     "use strict";
     import_node_crypto53 = require("node:crypto");
     init_src();
+    init_keyed_mutex();
     OUTPUT_COPY_LIMITS = {
       maxFileBytes: FILE_CONTENT_MAX_BYTES,
       maxFiles: 50,
       maxTotalBytes: 2 * FILE_CONTENT_MAX_BYTES
     };
+    OUTPUT_COPY_SERIAL_BYTES = 20 * 1024 * 1024;
   }
 });
 
@@ -239360,6 +239542,24 @@ function projectsDomain(opts) {
       });
       return { status: 201, body: file };
     });
+    router.post("/api/projects/:id/files/raw", async (req) => {
+      const name = rawUploadName(req.raw);
+      if (!name) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 X-Oasis-Filename");
+      const path50 = req.query.get("path") ?? void 0;
+      const contentType = rawUploadContentType(req.raw);
+      const service = await svc(req);
+      const put3 = await putRawUpload(service.projectFileBlobs(), req.raw, { maxBytes: currentFileLimits().attachmentBytes });
+      const file = await service.recordProjectFile({
+        projectId: req.params.id,
+        name,
+        ...path50 !== void 0 ? { path: path50 } : {},
+        blobId: put3.hash,
+        size: put3.size,
+        ...contentType !== void 0 ? { contentType } : {},
+        uploadedBy: req.auth.actor
+      });
+      return { status: 201, body: file };
+    });
     router.put("/api/projects/:id/files/:fileId", async (req) => {
       const b6 = req.body ?? {};
       const base642 = b6.content_base64 ?? b6.contentBase64;
@@ -240122,6 +240322,8 @@ var init_routes5 = __esm({
   "../server/src/domains/projects/routes.ts"() {
     "use strict";
     init_router();
+    init_file_limits2();
+    init_raw_upload();
     init_src();
     init_chat_files2();
     init_chat_sessions();
@@ -246047,33 +246249,26 @@ function collabDomain(opts) {
       }));
       return { status: 200, body: { total: items.length, items } };
     });
-    router.post("/api/workorders/:id/files", async (req) => {
+    const resolveUploadTarget = async (req) => {
       const { kernel, registry: registry2, artifacts } = await resolveCtx(req.auth.companyId);
       const ws = req.params.id;
       const exists = [...kernel.model.artifacts.values()].some((a5) => a5.workspace === ws);
       if (!exists) {
-        return { status: 404, body: { error: { code: "not_found", message: `\u5DE5\u5355\u4E0D\u5B58\u5728: ${ws}` } } };
+        return { denied: { status: 404, body: { error: { code: "not_found", message: `\u5DE5\u5355\u4E0D\u5B58\u5728: ${ws}` } } } };
       }
       if (!opts.assets || !artifacts?.addWorkOrderFile) {
         return {
-          status: 501,
-          body: { error: { code: "unavailable", message: "\u672C\u90E8\u7F72\u672A\u63A5\u5165\u4EFB\u52A1\u6587\u4EF6\u4E0A\u4F20\uFF08\u7F3A\u8D44\u4EA7\u67DC\u6216 addWorkOrderFile\uFF09" } }
+          denied: {
+            status: 501,
+            body: { error: { code: "unavailable", message: "\u672C\u90E8\u7F72\u672A\u63A5\u5165\u4EFB\u52A1\u6587\u4EF6\u4E0A\u4F20\uFF08\u7F3A\u8D44\u4EA7\u67DC\u6216 addWorkOrderFile\uFF09" } }
+          }
         };
       }
-      const body2 = req.body ?? {};
-      if (typeof body2.contentBase64 !== "string" || !body2.contentBase64) {
-        return { status: 400, body: { error: { code: "bad_request", message: "\u7F3A\u5C11 contentBase64" } } };
-      }
-      const name = typeof body2.name === "string" && body2.name.trim() ? body2.name.trim() : "untitled";
-      const contentType = typeof body2.contentType === "string" && body2.contentType.trim() ? body2.contentType.trim() : void 0;
-      let bytes2;
-      try {
-        bytes2 = new Uint8Array(Buffer.from(body2.contentBase64, "base64"));
-      } catch (err) {
-        return { status: 400, body: { error: { code: "bad_request", message: `contentBase64 \u89E3\u7801\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}` } } };
-      }
-      assertFileBytes(bytes2);
-      const blobId = await opts.assets.put(bytes2);
+      return { target: { ws, registry: registry2, assets: opts.assets, addWorkOrderFile: artifacts.addWorkOrderFile.bind(artifacts) } };
+    };
+    const linkUploadedFile = async (req, target, input) => {
+      const { ws, registry: registry2, addWorkOrderFile } = target;
+      const { blobId, name, size, contentType } = input;
       const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
       const fileId = workOrderFileId(ws, blobId, name);
       const file = {
@@ -246081,14 +246276,14 @@ function collabDomain(opts) {
         fileId,
         name,
         blobId,
-        size: bytes2.byteLength,
+        size,
         ...contentType ? { contentType } : {},
         linkedAt,
         // 上传者：项目页「创建人」列与预览副标据此署名（建单带入的那条路记的是建单发起人）。
         uploadedBy: req.auth.actor
       };
       try {
-        await artifacts.addWorkOrderFile(file);
+        await addWorkOrderFile(file);
       } catch (err) {
         return {
           status: 500,
@@ -246101,7 +246296,7 @@ function collabDomain(opts) {
         name,
         kind: "file",
         content_type: contentType ?? null,
-        size: bytes2.byteLength,
+        size,
         updated_at: linkedAt,
         blob_ref: blobId,
         source_session_id: null,
@@ -246111,6 +246306,35 @@ function collabDomain(opts) {
         edit_target: workOrderFileEditTarget(ws, file)
       };
       return { status: 201, body: { item } };
+    };
+    router.post("/api/workorders/:id/files", async (req) => {
+      const resolved = await resolveUploadTarget(req);
+      if ("denied" in resolved) return resolved.denied;
+      const { target } = resolved;
+      const body2 = req.body ?? {};
+      if (typeof body2.contentBase64 !== "string" || !body2.contentBase64) {
+        return { status: 400, body: { error: { code: "bad_request", message: "\u7F3A\u5C11 contentBase64" } } };
+      }
+      const name = typeof body2.name === "string" && body2.name.trim() ? body2.name.trim() : "untitled";
+      const contentType = typeof body2.contentType === "string" && body2.contentType.trim() ? body2.contentType.trim() : void 0;
+      let bytes2;
+      try {
+        bytes2 = new Uint8Array(Buffer.from(body2.contentBase64, "base64"));
+      } catch (err) {
+        return { status: 400, body: { error: { code: "bad_request", message: `contentBase64 \u89E3\u7801\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}` } } };
+      }
+      assertFileBytes(bytes2);
+      const blobId = await target.assets.put(bytes2);
+      return linkUploadedFile(req, target, { blobId, name, size: bytes2.byteLength, ...contentType ? { contentType } : {} });
+    });
+    router.post("/api/workorders/:id/files/raw", async (req) => {
+      const resolved = await resolveUploadTarget(req);
+      if ("denied" in resolved) return resolved.denied;
+      const { target } = resolved;
+      const name = rawUploadName(req.raw) ?? "untitled";
+      const contentType = rawUploadContentType(req.raw);
+      const put3 = await putRawUpload(target.assets, req.raw, { maxBytes: currentFileLimits().attachmentBytes });
+      return linkUploadedFile(req, target, { blobId: put3.hash, name, size: put3.size, ...contentType ? { contentType } : {} });
     });
     router.put("/api/workorders/:id/files/:fileId", async (req) => {
       const { kernel, registry: registry2, artifacts } = await resolveCtx(req.auth.companyId);
@@ -246690,6 +246914,7 @@ var init_collab = __esm({
   "../server/src/domains/collab/index.ts"() {
     "use strict";
     init_file_limits2();
+    init_raw_upload();
     init_src8();
     init_src();
     init_chat_workorder_files();
@@ -263871,6 +264096,44 @@ function readBytesSegments(pool, table, hash3, r5) {
     cancelled = true;
   } };
 }
+async function sweepBlobRows(pool, table, reachable, opts = {}) {
+  const keep = [...reachable];
+  const graceMs = Math.max(0, Math.floor(opts.graceMs ?? 0));
+  const head = await pool.query(
+    `SELECT now() - ($1::bigint * interval '1 millisecond') AS cutoff, (SELECT count(*)::int FROM ${table}) AS total`,
+    [graceMs]
+  );
+  const cutoff = head.rows[0].cutoff;
+  const totalRows = Number(head.rows[0].total);
+  const cand = await pool.query(
+    `SELECT count(*)::int AS n, sum(size)::text AS bytes FROM ${table}
+      WHERE NOT (hash = ANY($1::text[])) AND last_put_at < $2`,
+    [keep, cutoff]
+  );
+  const candidateRows = Number(cand.rows[0]?.n ?? 0);
+  const report = {
+    dryRun: opts.dryRun === true,
+    totalRows,
+    candidateRows,
+    candidateBytes: Number(cand.rows[0]?.bytes ?? 0),
+    deletedRows: 0,
+    deletedBytes: 0,
+    orphansFound: 0,
+    orphansDeleted: 0
+  };
+  if (opts.maxDeleteRatio !== void 0 && totalRows > 0 && candidateRows / totalRows > opts.maxDeleteRatio) {
+    throw new BlobSweepAbortedError(candidateRows, totalRows, opts.maxDeleteRatio);
+  }
+  if (opts.dryRun || candidateRows === 0) return { report, deleted: [], cutoff };
+  const res = await pool.query(
+    `DELETE FROM ${table} WHERE NOT (hash = ANY($1::text[])) AND last_put_at < $2 RETURNING hash, location, size`,
+    [keep, cutoff]
+  );
+  const deleted = res.rows.map((r5) => ({ hash: r5.hash, location: r5.location, size: Number(r5.size) }));
+  report.deletedRows = deleted.length;
+  report.deletedBytes = deleted.reduce((n3, r5) => n3 + r5.size, 0);
+  return { report, deleted, cutoff };
+}
 var import_node_crypto80, ident5, isUniqueViolation, PostgresOplogStore, PG_READ_CHUNK, PostgresBlobStore;
 var init_postgres = __esm({
   "../storage/src/postgres.ts"() {
@@ -264093,10 +264356,9 @@ var init_postgres = __esm({
         const res = await this.pool.query(`SELECT 1 FROM ${this.t} WHERE hash = $1`, [hash3]);
         return res.rowCount === 1;
       }
-      async sweep(reachable) {
-        await this.pool.query(`DELETE FROM ${this.t} WHERE NOT (hash = ANY($1::text[]))`, [
-          [...reachable]
-        ]);
+      /** 字节都在 bytea，删行即删字节；没有对象后端，`orphans` 不适用。 */
+      async sweep(reachable, opts = {}) {
+        return (await sweepBlobRows(this.pool, this.t, reachable, opts)).report;
       }
     };
   }
@@ -278963,7 +279225,7 @@ var init_cutover_aware_dispatches = __esm({
 });
 
 // ../storage/src/cutover-aware-blobs.ts
-var CutoverAwareBlobStore;
+var CutoverAwareBlobStore, SharedBlobSweepRefusedError;
 var init_cutover_aware_blobs = __esm({
   "../storage/src/cutover-aware-blobs.ts"() {
     "use strict";
@@ -279026,11 +279288,20 @@ var init_cutover_aware_blobs = __esm({
        * ★ 清扫也走**写闸**，而且冻结期必须真的拒——不是"跳过一次"。
        *
        * 冻结窗口正是 operator 在做最后一次逐行复制的时候：此刻放行 sweep，
-       * 会按一份**还没补完**的可达集去删字节，删掉的是正在搬的那批。
+       * 会按一份**还没补完**的可达集去删字节，删掉的是正在搬的那批。dry-run 也走写闸：冻结期报出来的数没有意义。
        */
-      async sweep(reachable) {
-        return (await this.pickWritable()).sweep(reachable);
+      async sweep(reachable, opts) {
+        const target = await this.pickWritable();
+        if (target === this.o.legacy && !opts?.dryRun) throw new SharedBlobSweepRefusedError(this.o.companyId);
+        return target.sweep(reachable, opts);
+      }
+    };
+    SharedBlobSweepRefusedError = class extends Error {
+      constructor(companyId) {
+        super(`\u516C\u53F8 ${companyId} \u7684 blob \u8FD8\u5728\u5171\u4EAB\u4E8B\u5B9E\u67DC\uFF08\u672A\u5207\u5230\u516C\u53F8 schema\uFF09\uFF0C\u6309\u5355\u516C\u53F8\u53EF\u8FBE\u96C6\u6E05\u626B\u4F1A\u5220\u5230\u522B\u5BB6\u5B57\u8282\uFF1A\u53EA\u5141\u8BB8 dry-run`);
+        this.companyId = companyId;
       }
+      name = "SharedBlobSweepRefusedError";
     };
   }
 });
@@ -279637,6 +279908,319 @@ var init_cutover_aware_trace = __esm({
   }
 });
 
+// ../storage/src/externalized-blobs.ts
+function factObjectKey(namespace, hash3) {
+  return `${factObjectPrefix(namespace)}${hash3.slice(0, 2)}/${hash3}`;
+}
+function factObjectPrefix(namespace) {
+  return `facts/${namespace}/`;
+}
+async function drainToBuffer(body2) {
+  const parts = [];
+  for await (const chunk of body2) parts.push(chunk);
+  return new Uint8Array(Buffer.concat(parts));
+}
+var import_node_crypto87, fs36, BLOB_NAME2, ExternalizedBlobStore, ObjectBlobStore;
+var init_externalized_blobs = __esm({
+  "../storage/src/externalized-blobs.ts"() {
+    "use strict";
+    import_node_crypto87 = require("node:crypto");
+    fs36 = __toESM(require("node:fs"), 1);
+    init_src();
+    init_blob_object_backend();
+    init_postgres();
+    BLOB_NAME2 = /^[0-9a-f]{64}$/;
+    ExternalizedBlobStore = class _ExternalizedBlobStore {
+      constructor(pool, t, namespace, backend, opts) {
+        this.pool = pool;
+        this.t = t;
+        this.namespace = namespace;
+        this.backend = backend;
+        this.opts = opts;
+      }
+      /** 命名空间 = schema 名（ADR 0638 D3）。 */
+      static async open(pool, schema, backend, opts = {}) {
+        const t = await ensureBlobsTable(pool, schema);
+        return new _ExternalizedBlobStore(pool, t, schema, backend, opts);
+      }
+      key(hash3) {
+        return factObjectKey(this.namespace, hash3);
+      }
+      async put(bytes2) {
+        return (await this.putStream(singleChunk(bytes2))).hash;
+      }
+      async putStream(source, opts = {}) {
+        const staged = await stageBlob(this.backend.stagingDir, source, opts);
+        const contentType = sniffContentType(staged.head);
+        const result = { hash: staged.hash, size: staged.size, ...contentType ? { contentType } : {} };
+        try {
+          await this.place(staged, contentType);
+        } catch (err) {
+          await discardStaged(staged);
+          throw err;
+        }
+        return result;
+      }
+      async place(staged, contentType) {
+        const { hash: hash3, size } = staged;
+        const touched = await this.pool.query(
+          `UPDATE ${this.t} SET last_put_at = now() WHERE hash = $1 RETURNING location`,
+          [hash3]
+        );
+        const row = touched.rows[0];
+        if (row?.location === "pg") {
+          await discardStaged(staged);
+          return;
+        }
+        if (row) {
+          if (await this.backend.head(this.key(hash3)) === null) {
+            await this.backend.commit(staged, this.key(hash3), contentType ? { contentType } : {});
+          } else {
+            await discardStaged(staged);
+          }
+          return;
+        }
+        const bytea = this.opts.dualWrite ? await fs36.promises.readFile(staged.file) : null;
+        await this.backend.commit(staged, this.key(hash3), contentType ? { contentType } : {});
+        await this.pool.query(
+          `INSERT INTO ${this.t} AS b (hash, bytes, size, content_type, location) VALUES ($1, $2, $3, $4, 'ext')
+       ON CONFLICT (hash) DO UPDATE SET last_put_at = now()`,
+          [hash3, bytea, size, contentType ?? null]
+        );
+      }
+      /** §3.2 第 1 条：只读元数据行，不访问对象后端。 */
+      async meta(hash3) {
+        const res = await this.pool.query(`SELECT size, content_type FROM ${this.t} WHERE hash = $1`, [hash3]);
+        const row = res.rows[0];
+        if (!row) return null;
+        return { size: Number(row.size), ...row.content_type ? { contentType: row.content_type } : {} };
+      }
+      async has(hash3) {
+        const res = await this.pool.query(`SELECT 1 FROM ${this.t} WHERE hash = $1`, [hash3]);
+        return res.rowCount === 1;
+      }
+      async get(hash3) {
+        const res = await this.pool.query(
+          `SELECT location, size, CASE WHEN location = 'pg' THEN bytes END AS bytes FROM ${this.t} WHERE hash = $1`,
+          [hash3]
+        );
+        const row = res.rows[0];
+        if (!row) throw new BlobNotFoundError(hash3);
+        if (row.location === "pg") {
+          if (row.bytes === null) throw new BlobBackendError(hash3, `${this.t}.bytes`);
+          return new Uint8Array(row.bytes);
+        }
+        const size = Number(row.size);
+        const handle = await this.openExt(hash3, { start: 0, end: size - 1 });
+        return drainToBuffer(handle.body);
+      }
+      async openRead(hash3, range2) {
+        const res = await this.pool.query(
+          `SELECT location, size, content_type, (location = 'pg' AND bytes IS NULL) AS purged FROM ${this.t} WHERE hash = $1`,
+          [hash3]
+        );
+        const row = res.rows[0];
+        if (!row) throw new BlobNotFoundError(hash3);
+        if (row.purged) throw new BlobBackendError(hash3, `${this.t}.bytes`);
+        const meta = { size: Number(row.size), ...row.content_type ? { contentType: row.content_type } : {} };
+        const r5 = resolveBlobRange(hash3, meta.size, range2);
+        const stream = row.location === "pg" ? readBytesSegments(this.pool, this.t, hash3, r5) : await this.openExt(hash3, r5);
+        return { meta, range: r5, ...stream };
+      }
+      /** §3.2 第 2 条：行在、对象不在 → BlobBackendError；后端其它故障同样包成它（都是 5xx，不是 404）。 */
+      async openExt(hash3, r5) {
+        const key2 = this.key(hash3);
+        try {
+          return await this.backend.openRead(key2, r5);
+        } catch (err) {
+          if (err instanceof ObjectMissingError) throw new BlobBackendError(hash3, key2);
+          throw new BlobBackendError(hash3, key2, err);
+        }
+      }
+      /**
+       * GC 执行（ADR 0638 §3.5）：按行清扫（宽限期、删除比例上限、dry-run 见 {@link sweepBlobRows}），
+       * **先删行、再删对象**——崩在中间只留无行对象，读者恒见「没有」，由孤儿扫描清理。
+       * 只动本 schema 的行与本命名空间前缀 `facts/<schema>/` 下的对象：别家同一份字节在别的前缀里，
+       * s3 模式同桶的资产柜在 `assets/` 前缀，都删不到（D3）。
+       */
+      async sweep(reachable, opts = {}) {
+        const { report, deleted } = await sweepBlobRows(this.pool, this.t, reachable, opts);
+        const ext = deleted.filter((r5) => r5.location === "ext" && BLOB_NAME2.test(r5.hash)).map((r5) => r5.hash);
+        const back = ext.length > 0 ? await this.existingRows(ext) : /* @__PURE__ */ new Set();
+        for (const hash3 of ext) if (!back.has(hash3)) await this.backend.delete(this.key(hash3));
+        if (opts.orphans) {
+          const o3 = await this.sweepOrphans(Math.max(0, opts.graceMs ?? 0), opts.dryRun === true);
+          report.orphansFound = o3.found;
+          report.orphansDeleted = o3.deleted;
+        }
+        return report;
+      }
+      async existingRows(hashes) {
+        const res = await this.pool.query(`SELECT hash FROM ${this.t} WHERE hash = ANY($1::text[])`, [hashes]);
+        return new Set(res.rows.map((r5) => r5.hash));
+      }
+      /**
+       * 孤儿对象扫描（§3.5 第 3 条，`gc --orphans`）：列出 `facts/<schema>/` 下全部对象（fs 递归、s3 ListObjectsV2 分页），
+       * 删除**无对应行且早于宽限期**的。宽限期挡住「对象已放、行还没写」的在途写入与租户迁移复制（先放对象、再写行）。
+       * 只认 `facts/<schema>/<hh>/<hash>` 这一种形状，别的文件名一律不碰。
+       */
+      async sweepOrphans(graceMs, dryRun) {
+        const prefix = factObjectPrefix(this.namespace);
+        const cutoffMs = Date.now() - graceMs;
+        let found2 = 0;
+        let deleted = 0;
+        let page = [];
+        const flush2 = async () => {
+          if (page.length === 0) return;
+          const rows = await this.existingRows(page.map((o3) => o3.hash));
+          for (const o3 of page) {
+            if (rows.has(o3.hash)) continue;
+            found2++;
+            if (!dryRun) {
+              await this.backend.delete(o3.key);
+              deleted++;
+            }
+          }
+          page = [];
+        };
+        for await (const o3 of this.backend.list(prefix)) {
+          const rest = o3.key.slice(prefix.length).split("/");
+          const hash3 = rest[1] ?? "";
+          if (rest.length !== 2 || !BLOB_NAME2.test(hash3) || rest[0] !== hash3.slice(0, 2)) continue;
+          if (o3.mtimeMs >= cutoffMs) continue;
+          page.push({ key: o3.key, hash: hash3 });
+          if (page.length >= 500) await flush2();
+        }
+        await flush2();
+        return { found: found2, deleted };
+      }
+      /** §3.4：仅 s3 + `OASIS_BLOB_S3_DIRECT=redirect` 时给 URL；`pg` 行、不存在的 hash、其它后端一律 null。 */
+      async presignGet(hash3, opts) {
+        if (!this.backend.presignGet) return null;
+        const res = await this.pool.query(`SELECT location, content_type FROM ${this.t} WHERE hash = $1`, [hash3]);
+        const row = res.rows[0];
+        if (!row || row.location !== "ext") return null;
+        const contentType = opts.contentType ?? row.content_type ?? void 0;
+        return this.backend.presignGet(this.key(hash3), { ...opts, ...contentType ? { contentType } : {} });
+      }
+      /* ── 迁移命令（`oasis blobs externalize / internalize`，ADR 0638 §6.2 / §6.3）的单行原语 ── */
+      /**
+       * 把一行 `location='pg'` 搬到对象后端：读 bytea → 原子写 → 读回校验 sha256 → `UPDATE … SET location='ext'`。
+       * **保留 bytea**（清空由 `purgePgBytes` 在观察期后做）。可重复执行：已是 `ext` 的行跳过。
+       * 返回本行字节数；跳过返回 0。
+       */
+      async externalizeOne(hash3) {
+        const res = await this.pool.query(`SELECT location, bytes, content_type FROM ${this.t} WHERE hash = $1`, [hash3]);
+        const row = res.rows[0];
+        if (!row || row.location !== "pg") return 0;
+        if (row.bytes === null) throw new BlobBackendError(hash3, `${this.t}.bytes`);
+        const bytes2 = new Uint8Array(row.bytes);
+        const staged = await stageBlob(this.backend.stagingDir, singleChunk(bytes2), { expectedHash: hash3 });
+        const contentType = row.content_type ?? sniffContentType(staged.head);
+        await this.backend.commit(staged, this.key(hash3), contentType ? { contentType } : {});
+        const back = await drainToBuffer((await this.backend.openRead(this.key(hash3), { start: 0, end: bytes2.byteLength - 1 })).body);
+        if (!Buffer.from(back).equals(Buffer.from(bytes2))) throw new BlobBackendError(hash3, this.key(hash3), new Error("read-back mismatch"));
+        await this.pool.query(`UPDATE ${this.t} SET location = 'ext' WHERE hash = $1 AND location = 'pg'`, [hash3]);
+        return bytes2.byteLength;
+      }
+      /** 回滚原语：对象写回 bytea、`location='pg'`（§6.3）。已是 `pg` 且 bytea 在的行跳过。 */
+      async internalizeOne(hash3) {
+        const res = await this.pool.query(`SELECT location, size, bytes IS NULL AS empty FROM ${this.t} WHERE hash = $1`, [hash3]);
+        const row = res.rows[0];
+        if (!row || row.location === "pg" && !row.empty) return 0;
+        const size = Number(row.size);
+        const bytes2 = await drainToBuffer((await this.openExt(hash3, { start: 0, end: size - 1 })).body);
+        const actual = (0, import_node_crypto87.createHash)("sha256").update(bytes2).digest("hex");
+        if (actual !== hash3) throw new BlobBackendError(hash3, this.key(hash3), new Error(`sha256 mismatch: ${actual}`));
+        await this.pool.query(`UPDATE ${this.t} SET bytes = $2, location = 'pg' WHERE hash = $1`, [hash3, Buffer.from(bytes2)]);
+        return bytes2.byteLength;
+      }
+      /** 列出待处理的 hash（分批、按 hash 升序，便于中断续跑）。 */
+      async listHashes(where, after, limit) {
+        const cond = where === "pg" ? `location = 'pg'` : where === "ext" ? `location = 'ext'` : `location = 'ext' AND bytes IS NOT NULL`;
+        const res = await this.pool.query(
+          `SELECT hash FROM ${this.t} WHERE ${cond} AND hash > $1 ORDER BY hash LIMIT $2`,
+          [after, limit]
+        );
+        return res.rows.map((r5) => r5.hash);
+      }
+      /** 观察期后清空已外部化行的 bytea（§6.2 第 6 步），一批一条语句。返回本批清掉的行数。 */
+      async purgePgBytes(limit) {
+        const res = await this.pool.query(
+          `UPDATE ${this.t} SET bytes = NULL WHERE hash IN (
+         SELECT hash FROM ${this.t} WHERE location = 'ext' AND bytes IS NOT NULL ORDER BY hash LIMIT $1)`,
+          [limit]
+        );
+        return res.rowCount ?? 0;
+      }
+      /** 各 location 的行数（迁移进度 / 观察期核对 `count(*) WHERE location='pg'` 为 0）。 */
+      async locationCounts() {
+        const res = await this.pool.query(`SELECT
+        count(*) FILTER (WHERE location = 'pg')::int AS pg,
+        count(*) FILTER (WHERE location = 'ext')::int AS ext,
+        count(*) FILTER (WHERE location = 'ext' AND bytes IS NOT NULL)::int AS ext_with_bytes
+      FROM ${this.t}`);
+        const r5 = res.rows[0] ?? {};
+        return { pg: Number(r5.pg ?? 0), ext: Number(r5.ext ?? 0), extWithBytes: Number(r5.ext_with_bytes ?? 0) };
+      }
+    };
+    ObjectBlobStore = class {
+      constructor(backend, prefix) {
+        this.backend = backend;
+        this.prefix = prefix;
+      }
+      key(hash3) {
+        return `${this.prefix.replace(/\/+$/, "")}/${hash3.slice(0, 2)}/${hash3}`;
+      }
+      async put(bytes2) {
+        return (await this.putStream(singleChunk(bytes2))).hash;
+      }
+      async putStream(source, opts = {}) {
+        const staged = await stageBlob(this.backend.stagingDir, source, opts);
+        const contentType = sniffContentType(staged.head);
+        await this.backend.commit(staged, this.key(staged.hash), contentType ? { contentType } : {});
+        return { hash: staged.hash, size: staged.size, ...contentType ? { contentType } : {} };
+      }
+      async meta(hash3) {
+        if (!BLOB_NAME2.test(hash3)) return null;
+        const head = await this.backend.head(this.key(hash3));
+        if (!head) return null;
+        const contentType = head.contentType && head.contentType !== "application/octet-stream" ? head.contentType : void 0;
+        return { size: head.size, ...contentType ? { contentType } : {} };
+      }
+      async has(hash3) {
+        return await this.meta(hash3) !== null;
+      }
+      async get(hash3) {
+        const meta = await this.meta(hash3);
+        if (!meta) throw new BlobNotFoundError(hash3);
+        return drainToBuffer((await this.backend.openRead(this.key(hash3), { start: 0, end: meta.size - 1 })).body);
+      }
+      async openRead(hash3, range2) {
+        const meta = await this.meta(hash3);
+        if (!meta) throw new BlobNotFoundError(hash3);
+        const r5 = resolveBlobRange(hash3, meta.size, range2);
+        try {
+          return { meta, range: r5, ...await this.backend.openRead(this.key(hash3), r5) };
+        } catch (err) {
+          if (err instanceof ObjectMissingError) throw new BlobNotFoundError(hash3);
+          throw err;
+        }
+      }
+      async sweep(reachable) {
+        for await (const o3 of this.backend.list(`${this.prefix.replace(/\/+$/, "")}/`)) {
+          const hash3 = o3.key.slice(o3.key.lastIndexOf("/") + 1);
+          if (BLOB_NAME2.test(hash3) && !reachable.has(hash3)) await this.backend.delete(o3.key);
+        }
+      }
+      async presignGet(hash3, opts) {
+        if (!this.backend.presignGet || !await this.has(hash3)) return null;
+        return this.backend.presignGet(this.key(hash3), opts);
+      }
+    };
+  }
+});
+
 // ../storage/src/tenancy-attribution.ts
 function realCompanyId(v2) {
   return typeof v2 === "string" && v2.trim().length > 0 ? v2 : null;
@@ -280820,7 +281404,7 @@ function sourceSetConservation(input) {
   return input.sourceFinal === input.copied + input.approvedRuntimeConversion + input.approvedArchive + input.approvedDiscard;
 }
 function payloadChecksum(value2) {
-  return (0, import_node_crypto87.createHash)("sha256").update(JSON.stringify(value2)).digest("hex");
+  return (0, import_node_crypto88.createHash)("sha256").update(JSON.stringify(value2)).digest("hex");
 }
 async function copyWorkorderDraftsIdempotent(pool, companyId, companySchema, manifestId, opts) {
   const cs = quoteIdent2(companySchema);
@@ -281002,6 +281586,23 @@ async function copyBlobsIdempotent(pool, companyId, companySchema, manifestId, o
     const at2 = body2.lastIndexOf("@");
     mine.add(at2 >= 0 ? body2.slice(0, at2) : body2);
   }
+  if (opts.takeLegacyRows && mine.size > 0) {
+    const legacyNs = opts.legacySchema ?? "public";
+    const hasLocation = (await pool.query(
+      `SELECT 1 FROM information_schema.columns WHERE table_schema=$1 AND table_name='blobs' AND column_name='location'`,
+      [legacyNs]
+    )).rowCount === 1;
+    const ext = hasLocation ? (await pool.query(
+      `SELECT hash FROM ${ls}.blobs WHERE hash = ANY($1::text[]) AND location = 'ext' ORDER BY hash`,
+      [[...mine]]
+    )).rows.map((r5) => r5.hash) : [];
+    if (ext.length > 0 && !opts.objectBackend) {
+      throw new Error(`blob \u590D\u5236\uFF1A${legacyNs}.blobs \u6709 ${ext.length} \u884C\u5B57\u8282\u5728\u5BF9\u8C61\u540E\u7AEF\uFF08location='ext'\uFF09\uFF0C\u9700\u8981\u4F20\u5165 objectBackend \u5148\u590D\u5236\u5BF9\u8C61`);
+    }
+    for (const hash3 of ext) {
+      await opts.objectBackend.copy(factObjectKey(legacyNs, hash3), factObjectKey(companySchema, hash3));
+    }
+  }
   let copied = 0;
   const client = await pool.connect();
   try {
@@ -281212,13 +281813,14 @@ async function copyTraceFamilyIdempotent(pool, companyId, companySchema, manifes
     sequences
   };
 }
-var import_node_crypto87, MissingInstallerActorsError, TypeCatalogNotCoveredError, ORG_REGISTRY_TABLES, TRACE_FAMILY;
+var import_node_crypto88, MissingInstallerActorsError, TypeCatalogNotCoveredError, ORG_REGISTRY_TABLES, TRACE_FAMILY;
 var init_tenant_migration_operator = __esm({
   "../storage/src/tenant-migration-operator.ts"() {
     "use strict";
-    import_node_crypto87 = require("node:crypto");
+    import_node_crypto88 = require("node:crypto");
     init_esm();
     init_pg_ident();
+    init_externalized_blobs();
     init_tenancy_attribution();
     init_tenant_cutover();
     MissingInstallerActorsError = class extends Error {
@@ -281452,8 +282054,8 @@ var init_tenant_new_company_provision = __esm({
 // ../storage/src/knowledge-snapshot-crypto.ts
 function sealSnapshot(snapshot, key2) {
   if (snapshot.content.startsWith(PREFIX4)) return structuredClone(snapshot);
-  const iv = (0, import_node_crypto88.randomBytes)(12);
-  const cipher = (0, import_node_crypto88.createCipheriv)("aes-256-gcm", bytes(key2), iv);
+  const iv = (0, import_node_crypto89.randomBytes)(12);
+  const cipher = (0, import_node_crypto89.createCipheriv)("aes-256-gcm", bytes(key2), iv);
   cipher.setAAD(aad2(snapshot));
   const encrypted = Buffer.concat([cipher.update(snapshot.content, "utf8"), cipher.final()]);
   return { ...structuredClone(snapshot), content: `${PREFIX4}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}` };
@@ -281463,7 +282065,7 @@ function openSnapshot(snapshot, key2) {
   const packed = snapshot.content.slice(PREFIX4.length).split(".");
   if (packed.length !== 3 || packed.some((part) => !part)) throw new Error(`knowledge snapshot ${snapshot.ref} ciphertext is malformed`);
   const [iv, tag, data] = packed;
-  const decipher = (0, import_node_crypto88.createDecipheriv)("aes-256-gcm", bytes(key2), Buffer.from(iv, "base64url"));
+  const decipher = (0, import_node_crypto89.createDecipheriv)("aes-256-gcm", bytes(key2), Buffer.from(iv, "base64url"));
   decipher.setAAD(aad2(snapshot));
   decipher.setAuthTag(Buffer.from(tag, "base64url"));
   return {
@@ -281471,11 +282073,11 @@ function openSnapshot(snapshot, key2) {
     content: Buffer.concat([decipher.update(Buffer.from(data, "base64url")), decipher.final()]).toString("utf8")
   };
 }
-var import_node_crypto88, PREFIX4, bytes, aad2;
+var import_node_crypto89, PREFIX4, bytes, aad2;
 var init_knowledge_snapshot_crypto = __esm({
   "../storage/src/knowledge-snapshot-crypto.ts"() {
     "use strict";
-    import_node_crypto88 = require("node:crypto");
+    import_node_crypto89 = require("node:crypto");
     PREFIX4 = "oasis-knowledge:v1:";
     bytes = (key2) => {
       const value2 = Buffer.from(key2);
@@ -282373,7 +282975,7 @@ function reportedCost(v2) {
 }
 function newUsageBackfillManifestId(now = /* @__PURE__ */ new Date()) {
   const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-  return `ulb-${stamp}-${(0, import_node_crypto89.randomBytes)(3).toString("hex")}`;
+  return `ulb-${stamp}-${(0, import_node_crypto90.randomBytes)(3).toString("hex")}`;
 }
 async function backfillUsageLedger(ledger, opts) {
   if (!opts.dryRun && !opts.manifestId) throw new Error("execute \u9700\u8981 manifestId");
@@ -282922,11 +283524,11 @@ async function audit(c5, s3, manifestId, runId, field, before, after, createdAt)
     [manifestId, runId, field, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), createdAt]
   );
 }
-var import_node_crypto89, BUCKETS, ENDED_SQL, START_EVIDENCE_SQL, CHAT_RUN_SQL, ALLOWED_MODEL_EVIDENCE_TIERS, emptyStep, MODEL_BACKFILL_SOURCE, fourOf, sameUsage, ChatRunLookup;
+var import_node_crypto90, BUCKETS, ENDED_SQL, START_EVIDENCE_SQL, CHAT_RUN_SQL, ALLOWED_MODEL_EVIDENCE_TIERS, emptyStep, MODEL_BACKFILL_SOURCE, fourOf, sameUsage, ChatRunLookup;
 var init_usage_ledger_backfill = __esm({
   "../storage/src/usage-ledger-backfill.ts"() {
     "use strict";
-    import_node_crypto89 = require("node:crypto");
+    import_node_crypto90 = require("node:crypto");
     init_src();
     init_pg_ident();
     init_postgres_trace();
@@ -283023,278 +283625,6 @@ var init_usage_ledger_backfill = __esm({
   }
 });
 
-// ../storage/src/externalized-blobs.ts
-function factObjectKey(namespace, hash3) {
-  return `${factObjectPrefix(namespace)}${hash3.slice(0, 2)}/${hash3}`;
-}
-function factObjectPrefix(namespace) {
-  return `facts/${namespace}/`;
-}
-async function drainToBuffer(body2) {
-  const parts = [];
-  for await (const chunk of body2) parts.push(chunk);
-  return new Uint8Array(Buffer.concat(parts));
-}
-var import_node_crypto90, fs36, BLOB_NAME2, ExternalizedBlobStore, ObjectBlobStore;
-var init_externalized_blobs = __esm({
-  "../storage/src/externalized-blobs.ts"() {
-    "use strict";
-    import_node_crypto90 = require("node:crypto");
-    fs36 = __toESM(require("node:fs"), 1);
-    init_src();
-    init_blob_object_backend();
-    init_postgres();
-    BLOB_NAME2 = /^[0-9a-f]{64}$/;
-    ExternalizedBlobStore = class _ExternalizedBlobStore {
-      constructor(pool, t, namespace, backend, opts) {
-        this.pool = pool;
-        this.t = t;
-        this.namespace = namespace;
-        this.backend = backend;
-        this.opts = opts;
-      }
-      /** 命名空间 = schema 名（ADR 0638 D3）。 */
-      static async open(pool, schema, backend, opts = {}) {
-        const t = await ensureBlobsTable(pool, schema);
-        return new _ExternalizedBlobStore(pool, t, schema, backend, opts);
-      }
-      key(hash3) {
-        return factObjectKey(this.namespace, hash3);
-      }
-      async put(bytes2) {
-        return (await this.putStream(singleChunk(bytes2))).hash;
-      }
-      async putStream(source, opts = {}) {
-        const staged = await stageBlob(this.backend.stagingDir, source, opts);
-        const contentType = sniffContentType(staged.head);
-        const result = { hash: staged.hash, size: staged.size, ...contentType ? { contentType } : {} };
-        try {
-          await this.place(staged, contentType);
-        } catch (err) {
-          await discardStaged(staged);
-          throw err;
-        }
-        return result;
-      }
-      async place(staged, contentType) {
-        const { hash: hash3, size } = staged;
-        const existing = await this.pool.query(`SELECT location FROM ${this.t} WHERE hash = $1`, [hash3]);
-        const row = existing.rows[0];
-        if (row?.location === "pg") {
-          await discardStaged(staged);
-          await this.touch(hash3);
-          return;
-        }
-        if (row) {
-          if (await this.backend.head(this.key(hash3)) === null) {
-            await this.backend.commit(staged, this.key(hash3), contentType ? { contentType } : {});
-          } else {
-            await discardStaged(staged);
-          }
-          await this.touch(hash3);
-          return;
-        }
-        const bytea = this.opts.dualWrite ? await fs36.promises.readFile(staged.file) : null;
-        await this.backend.commit(staged, this.key(hash3), contentType ? { contentType } : {});
-        await this.pool.query(
-          `INSERT INTO ${this.t} AS b (hash, bytes, size, content_type, location) VALUES ($1, $2, $3, $4, 'ext')
-       ON CONFLICT (hash) DO UPDATE SET last_put_at = now()`,
-          [hash3, bytea, size, contentType ?? null]
-        );
-      }
-      async touch(hash3) {
-        await this.pool.query(`UPDATE ${this.t} SET last_put_at = now() WHERE hash = $1`, [hash3]);
-      }
-      /** §3.2 第 1 条：只读元数据行，不访问对象后端。 */
-      async meta(hash3) {
-        const res = await this.pool.query(`SELECT size, content_type FROM ${this.t} WHERE hash = $1`, [hash3]);
-        const row = res.rows[0];
-        if (!row) return null;
-        return { size: Number(row.size), ...row.content_type ? { contentType: row.content_type } : {} };
-      }
-      async has(hash3) {
-        const res = await this.pool.query(`SELECT 1 FROM ${this.t} WHERE hash = $1`, [hash3]);
-        return res.rowCount === 1;
-      }
-      async get(hash3) {
-        const res = await this.pool.query(
-          `SELECT location, size, CASE WHEN location = 'pg' THEN bytes END AS bytes FROM ${this.t} WHERE hash = $1`,
-          [hash3]
-        );
-        const row = res.rows[0];
-        if (!row) throw new BlobNotFoundError(hash3);
-        if (row.location === "pg") {
-          if (row.bytes === null) throw new BlobBackendError(hash3, `${this.t}.bytes`);
-          return new Uint8Array(row.bytes);
-        }
-        const size = Number(row.size);
-        const handle = await this.openExt(hash3, { start: 0, end: size - 1 });
-        return drainToBuffer(handle.body);
-      }
-      async openRead(hash3, range2) {
-        const res = await this.pool.query(
-          `SELECT location, size, content_type, (location = 'pg' AND bytes IS NULL) AS purged FROM ${this.t} WHERE hash = $1`,
-          [hash3]
-        );
-        const row = res.rows[0];
-        if (!row) throw new BlobNotFoundError(hash3);
-        if (row.purged) throw new BlobBackendError(hash3, `${this.t}.bytes`);
-        const meta = { size: Number(row.size), ...row.content_type ? { contentType: row.content_type } : {} };
-        const r5 = resolveBlobRange(hash3, meta.size, range2);
-        const stream = row.location === "pg" ? readBytesSegments(this.pool, this.t, hash3, r5) : await this.openExt(hash3, r5);
-        return { meta, range: r5, ...stream };
-      }
-      /** §3.2 第 2 条：行在、对象不在 → BlobBackendError；后端其它故障同样包成它（都是 5xx，不是 404）。 */
-      async openExt(hash3, r5) {
-        const key2 = this.key(hash3);
-        try {
-          return await this.backend.openRead(key2, r5);
-        } catch (err) {
-          if (err instanceof ObjectMissingError) throw new BlobBackendError(hash3, key2);
-          throw new BlobBackendError(hash3, key2, err);
-        }
-      }
-      /**
-       * GC 执行：删除可达集之外的行，**先删行、再删对象**（崩在中间只留无行对象，读者恒见「没有」）。
-       * 只动本 schema 的行与本命名空间前缀下的对象——别家同一份字节在别的前缀里，删不到（ADR 0638 D3）。
-       * 宽限期、dry-run、删除比例上限、孤儿扫描归 S5（§3.5）。
-       */
-      async sweep(reachable) {
-        const res = await this.pool.query(
-          `DELETE FROM ${this.t} WHERE NOT (hash = ANY($1::text[])) RETURNING hash, location`,
-          [[...reachable]]
-        );
-        for (const row of res.rows) {
-          if (row.location === "ext" && BLOB_NAME2.test(row.hash)) await this.backend.delete(this.key(row.hash));
-        }
-      }
-      /** §3.4：仅 s3 + `OASIS_BLOB_S3_DIRECT=redirect` 时给 URL；`pg` 行、不存在的 hash、其它后端一律 null。 */
-      async presignGet(hash3, opts) {
-        if (!this.backend.presignGet) return null;
-        const res = await this.pool.query(`SELECT location, content_type FROM ${this.t} WHERE hash = $1`, [hash3]);
-        const row = res.rows[0];
-        if (!row || row.location !== "ext") return null;
-        const contentType = opts.contentType ?? row.content_type ?? void 0;
-        return this.backend.presignGet(this.key(hash3), { ...opts, ...contentType ? { contentType } : {} });
-      }
-      /* ── 迁移命令（`oasis blobs externalize / internalize`，ADR 0638 §6.2 / §6.3）的单行原语 ── */
-      /**
-       * 把一行 `location='pg'` 搬到对象后端：读 bytea → 原子写 → 读回校验 sha256 → `UPDATE … SET location='ext'`。
-       * **保留 bytea**（清空由 `purgePgBytes` 在观察期后做）。可重复执行：已是 `ext` 的行跳过。
-       * 返回本行字节数；跳过返回 0。
-       */
-      async externalizeOne(hash3) {
-        const res = await this.pool.query(`SELECT location, bytes, content_type FROM ${this.t} WHERE hash = $1`, [hash3]);
-        const row = res.rows[0];
-        if (!row || row.location !== "pg") return 0;
-        if (row.bytes === null) throw new BlobBackendError(hash3, `${this.t}.bytes`);
-        const bytes2 = new Uint8Array(row.bytes);
-        const staged = await stageBlob(this.backend.stagingDir, singleChunk(bytes2), { expectedHash: hash3 });
-        const contentType = row.content_type ?? sniffContentType(staged.head);
-        await this.backend.commit(staged, this.key(hash3), contentType ? { contentType } : {});
-        const back = await drainToBuffer((await this.backend.openRead(this.key(hash3), { start: 0, end: bytes2.byteLength - 1 })).body);
-        if (!Buffer.from(back).equals(Buffer.from(bytes2))) throw new BlobBackendError(hash3, this.key(hash3), new Error("read-back mismatch"));
-        await this.pool.query(`UPDATE ${this.t} SET location = 'ext' WHERE hash = $1 AND location = 'pg'`, [hash3]);
-        return bytes2.byteLength;
-      }
-      /** 回滚原语：对象写回 bytea、`location='pg'`（§6.3）。已是 `pg` 且 bytea 在的行跳过。 */
-      async internalizeOne(hash3) {
-        const res = await this.pool.query(`SELECT location, size, bytes IS NULL AS empty FROM ${this.t} WHERE hash = $1`, [hash3]);
-        const row = res.rows[0];
-        if (!row || row.location === "pg" && !row.empty) return 0;
-        const size = Number(row.size);
-        const bytes2 = await drainToBuffer((await this.openExt(hash3, { start: 0, end: size - 1 })).body);
-        const actual = (0, import_node_crypto90.createHash)("sha256").update(bytes2).digest("hex");
-        if (actual !== hash3) throw new BlobBackendError(hash3, this.key(hash3), new Error(`sha256 mismatch: ${actual}`));
-        await this.pool.query(`UPDATE ${this.t} SET bytes = $2, location = 'pg' WHERE hash = $1`, [hash3, Buffer.from(bytes2)]);
-        return bytes2.byteLength;
-      }
-      /** 列出待处理的 hash（分批、按 hash 升序，便于中断续跑）。 */
-      async listHashes(where, after, limit) {
-        const cond = where === "pg" ? `location = 'pg'` : where === "ext" ? `location = 'ext'` : `location = 'ext' AND bytes IS NOT NULL`;
-        const res = await this.pool.query(
-          `SELECT hash FROM ${this.t} WHERE ${cond} AND hash > $1 ORDER BY hash LIMIT $2`,
-          [after, limit]
-        );
-        return res.rows.map((r5) => r5.hash);
-      }
-      /** 观察期后清空已外部化行的 bytea（§6.2 第 6 步），一批一条语句。返回本批清掉的行数。 */
-      async purgePgBytes(limit) {
-        const res = await this.pool.query(
-          `UPDATE ${this.t} SET bytes = NULL WHERE hash IN (
-         SELECT hash FROM ${this.t} WHERE location = 'ext' AND bytes IS NOT NULL ORDER BY hash LIMIT $1)`,
-          [limit]
-        );
-        return res.rowCount ?? 0;
-      }
-      /** 各 location 的行数（迁移进度 / 观察期核对 `count(*) WHERE location='pg'` 为 0）。 */
-      async locationCounts() {
-        const res = await this.pool.query(`SELECT
-        count(*) FILTER (WHERE location = 'pg')::int AS pg,
-        count(*) FILTER (WHERE location = 'ext')::int AS ext,
-        count(*) FILTER (WHERE location = 'ext' AND bytes IS NOT NULL)::int AS ext_with_bytes
-      FROM ${this.t}`);
-        const r5 = res.rows[0] ?? {};
-        return { pg: Number(r5.pg ?? 0), ext: Number(r5.ext ?? 0), extWithBytes: Number(r5.ext_with_bytes ?? 0) };
-      }
-    };
-    ObjectBlobStore = class {
-      constructor(backend, prefix) {
-        this.backend = backend;
-        this.prefix = prefix;
-      }
-      key(hash3) {
-        return `${this.prefix.replace(/\/+$/, "")}/${hash3.slice(0, 2)}/${hash3}`;
-      }
-      async put(bytes2) {
-        return (await this.putStream(singleChunk(bytes2))).hash;
-      }
-      async putStream(source, opts = {}) {
-        const staged = await stageBlob(this.backend.stagingDir, source, opts);
-        const contentType = sniffContentType(staged.head);
-        await this.backend.commit(staged, this.key(staged.hash), contentType ? { contentType } : {});
-        return { hash: staged.hash, size: staged.size, ...contentType ? { contentType } : {} };
-      }
-      async meta(hash3) {
-        if (!BLOB_NAME2.test(hash3)) return null;
-        const head = await this.backend.head(this.key(hash3));
-        if (!head) return null;
-        const contentType = head.contentType && head.contentType !== "application/octet-stream" ? head.contentType : void 0;
-        return { size: head.size, ...contentType ? { contentType } : {} };
-      }
-      async has(hash3) {
-        return await this.meta(hash3) !== null;
-      }
-      async get(hash3) {
-        const meta = await this.meta(hash3);
-        if (!meta) throw new BlobNotFoundError(hash3);
-        return drainToBuffer((await this.backend.openRead(this.key(hash3), { start: 0, end: meta.size - 1 })).body);
-      }
-      async openRead(hash3, range2) {
-        const meta = await this.meta(hash3);
-        if (!meta) throw new BlobNotFoundError(hash3);
-        const r5 = resolveBlobRange(hash3, meta.size, range2);
-        try {
-          return { meta, range: r5, ...await this.backend.openRead(this.key(hash3), r5) };
-        } catch (err) {
-          if (err instanceof ObjectMissingError) throw new BlobNotFoundError(hash3);
-          throw err;
-        }
-      }
-      async sweep(reachable) {
-        for await (const o3 of this.backend.list(`${this.prefix.replace(/\/+$/, "")}/`)) {
-          const hash3 = o3.key.slice(o3.key.lastIndexOf("/") + 1);
-          if (BLOB_NAME2.test(hash3) && !reachable.has(hash3)) await this.backend.delete(o3.key);
-        }
-      }
-      async presignGet(hash3, opts) {
-        if (!this.backend.presignGet || !await this.has(hash3)) return null;
-        return this.backend.presignGet(this.key(hash3), opts);
-      }
-    };
-  }
-});
-
 // ../../node_modules/.pnpm/@aws-sdk+checksums@3.1001.1/node_modules/@aws-sdk/checksums/dist-es/submodules/flexible-checksums/constants.js
 var RequestChecksumCalculation, DEFAULT_REQUEST_CHECKSUM_CALCULATION, ResponseChecksumValidation, DEFAULT_RESPONSE_CHECKSUM_VALIDATION, ChecksumAlgorithm, ChecksumLocation, DEFAULT_CHECKSUM_ALGORITHM;
 var init_constants = __esm({
@@ -320211,6 +320541,7 @@ __export(src_exports, {
   S3_DEFAULT_TIMEOUTS: () => S3_DEFAULT_TIMEOUTS,
   STALE_STAGING_MS: () => STALE_STAGING_MS,
   SchemaMappingConflictError: () => SchemaMappingConflictError,
+  SharedBlobSweepRefusedError: () => SharedBlobSweepRefusedError,
   SkillCatalogRetiredError: () => SkillCatalogRetiredError,
   TENANCY_MOVE_PLANS: () => TENANCY_MOVE_PLANS,
   TENANCY_TABLES: () => TENANCY_TABLES,
@@ -320311,6 +320642,7 @@ __export(src_exports, {
   singleChunk: () => singleChunk,
   sourceSetConservation: () => sourceSetConservation,
   stageBlob: () => stageBlob,
+  sweepBlobRows: () => sweepBlobRows,
   synthesizedItemId: () => synthesizedItemId,
   undoUsageLedgerBackfill: () => undoUsageLedgerBackfill,
   usageBucket: () => usageBucket,
@@ -337630,9 +337962,15 @@ var COMMAND_DECLS = {
   // —— 运维 ——
   gc: {
     group: "\u8FD0\u7EF4",
-    usage: "oasis gc",
-    description: "\u5B64\u513F blob \u56DE\u6536\uFF08mark-and-sweep\uFF1B\u64CD\u4F5C\u8005\u547D\u4EE4\uFF0CF1\uFF09\u3002",
-    examples: ["oasis gc"]
+    usage: "oasis gc [--dry-run] [--grace-hours 24] [--max-delete-ratio 0.2] [--orphans]",
+    description: "\u4E8B\u5B9E\u67DC\u5B64\u513F blob \u56DE\u6536\uFF08mark-and-sweep\uFF1B\u64CD\u4F5C\u8005\u547D\u4EE4\uFF0C\u624B\u52A8\u89E6\u53D1\uFF0CADR 0638 \xA73.5\uFF09\u3002\u53EF\u8FBE\u96C6 = \u4EA4\u4ED8\u7269 + \u9879\u76EE\u6587\u4EF6\uFF1B\u6700\u540E\u4E00\u6B21\u5199\u5165\u5728\u5BBD\u9650\u671F\u5185\u7684\u4E0D\u5220\uFF1B\u5F85\u5220\u8D85\u8FC7\u6BD4\u4F8B\u4E0A\u9650\u5219\u4E2D\u6B62\u3001\u4E00\u6761\u4E0D\u5220\u3002\u5148\u8DD1 --dry-run \u770B\u62A5\u544A\u518D\u771F\u5220\u3002",
+    flags: [
+      { name: "dry-run", desc: "\u53EA\u62A5\u4F1A\u5220\u591A\u5C11\u884C / \u5B57\u8282 / \u5B64\u513F\u5BF9\u8C61\uFF0C\u4E00\u6761\u4E0D\u5220", boolean: true },
+      { name: "grace-hours", desc: "\u5BBD\u9650\u671F\uFF08\u5C0F\u65F6\uFF0C\u7F3A\u7701 24\uFF09\uFF1A\u8FD9\u6BB5\u65F6\u95F4\u5185\u5199\u5165\u8FC7\u7684 blob \u4E0D\u5220" },
+      { name: "max-delete-ratio", desc: "\u5F85\u5220\u884C\u6570 / \u603B\u884C\u6570\u4E0A\u9650\uFF080\u20131\uFF0C\u7F3A\u7701 0.2\uFF09\uFF1B\u8D85\u8FC7\u5373\u4E2D\u6B62" },
+      { name: "orphans", desc: "\u540C\u65F6\u6E05\u626B\u5BF9\u8C61\u5B58\u50A8\u91CC\u65E0\u5143\u6570\u636E\u884C\u7684\u5B64\u513F\u5BF9\u8C61\uFF08fs / s3 \u540E\u7AEF\uFF09", boolean: true }
+    ],
+    examples: ["oasis gc --dry-run", "oasis gc --dry-run --orphans", "oasis gc --orphans"]
   },
   broadcasts: {
     group: "\u8FD0\u7EF4",
@@ -339277,7 +339615,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback2) {
     }
   }
 }
-var CLI_VERSION = "2.2.118" ? "2.2.118" : "dev";
+var CLI_VERSION = "2.2.119" ? "2.2.119" : "dev";
 function apiHeaders(token2, company) {
   const headers = {
     authorization: `Bearer ${token2}`,
@@ -342301,7 +342639,14 @@ ${res.warning}`);
       break;
     }
     case "gc": {
-      const { message } = await api.cmd("gc", {});
+      const graceHours = flags.get("grace-hours");
+      const maxDeleteRatio = flags.get("max-delete-ratio");
+      const { message } = await api.cmd("gc", {
+        ...flags.get("dry-run") === "true" ? { dryRun: true } : {},
+        ...flags.get("orphans") === "true" ? { orphans: true } : {},
+        ...graceHours !== void 0 ? { graceHours: Number(graceHours) } : {},
+        ...maxDeleteRatio !== void 0 ? { maxDeleteRatio: Number(maxDeleteRatio) } : {}
+      });
       println(message);
       break;
     }
@@ -343448,7 +343793,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.118" : "dev";
+var PKG_VERSION = true ? "2.2.119" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;