stream-chat 9.51.0 → 9.52.0

package/dist/types/channel.d.ts

@@ -80,7 +80,7 @@ export declare class Channel {
      *
      * @return {Promise<SendMessageAPIResponse>} The Server Response
      */
-    _sendMessage(message: Message, options?: SendMessageOptions): Promise<SendMessageAPIResponse>;
+    _sendMessage(rawMessage: Message, options?: SendMessageOptions): Promise<SendMessageAPIResponse>;
     sendMessage(message: Message, options?: SendMessageOptions): Promise<SendMessageAPIResponse>;
     /**
      * Upload a file to this channel’s file endpoint (multipart). Forwards to the client’s `sendFile` implementation.

package/dist/types/client.d.ts

@@ -990,6 +990,11 @@ export declare class StreamChat {
     }): Promise<FlagUserResponse>;
     /**
      * unflagMessage - unflag a message
+     *
+     * @deprecated The `/moderation/unflag` endpoint is deprecated and is a no-op on
+     * the backend - calling this resolves successfully but does not remove the flag.
+     * Use `client.moderation.submitAction()` against the review queue item instead.
+     *
      * @param {string} targetMessageID
      * @param {string} [options.user_id] currentUserID, only used with serverside auth
      * @returns {Promise<APIResponse>}
@@ -999,6 +1004,11 @@ export declare class StreamChat {
     }): Promise<FlagMessageResponse>;
     /**
      * unflagUser - unflag a user
+     *
+     * @deprecated The `/moderation/unflag` endpoint is deprecated and is a no-op on
+     * the backend - calling this resolves successfully but does not remove the flag.
+     * Use `client.moderation.submitAction()` against the review queue item instead.
+     *
      * @param {string} targetID
      * @param {string} [options.user_id] currentUserID, only used with serverside auth
      * @returns {Promise<APIResponse>}

package/dist/types/index.d.ts

@@ -35,3 +35,10 @@ export * from './LiveLocationManager';
 export type { CustomAttachmentData, CustomChannelData, CustomCommandData, CustomEventData, CustomEventTypes, CustomMemberData, CustomMessageComposerData, CustomMessageData, CustomPollOptionData, CustomPollData, CustomReactionData, CustomUserData, CustomThreadData, } from './custom_types';
 export { isOwnUser, chatCodes, logChatPromiseExecution, localMessageToNewMessagePayload, formatMessage, promoteChannel, } from './utils';
 export { FixedSizeQueueCache } from './utils/FixedSizeQueueCache';
+/**
+ * Tag-keyed async runners. Exported so the UI SDKs (and integrators) serialize their own
+ * actions with the same primitive the SDK uses internally instead of hand-rolling promise
+ * chains. Tags share one process-wide map, so namespace yours (`my-app/thing/${id}`) to avoid
+ * colliding with another caller's.
+ */
+export { hasPending, settled, withCancellation, withoutConcurrency, } from './utils/concurrency';

package/dist/types/messageComposer/attachmentIdentity.d.ts

@@ -3,6 +3,10 @@ import type { AudioAttachment, FileAttachment, GiphyAttachment, ImageAttachment,
 export declare const isScrapedContent: (attachment: Attachment) => boolean;
 export declare const isLocalAttachment: (attachment: unknown) => attachment is LocalAttachment;
 export declare const isLocalUploadAttachment: (attachment: unknown) => attachment is LocalUploadAttachment;
+/** Whether an upload for this attachment is still expected to resolve. */
+export declare const isPendingUpload: (attachment: unknown) => attachment is LocalUploadAttachment;
+/** Whether this attachment's upload already resolved to a URL. */
+export declare const isFinishedUpload: (attachment: unknown) => attachment is LocalUploadAttachment;
 export declare const isFileAttachment: (attachment: Attachment | LocalAttachment, supportedVideoFormat?: string[]) => attachment is FileAttachment;
 export declare const isLocalFileAttachment: (attachment: Attachment | LocalAttachment) => attachment is LocalFileAttachment;
 export declare const isImageAttachment: (attachment: Attachment) => attachment is ImageAttachment;

package/dist/types/messageComposer/attachmentManager.d.ts

@@ -57,6 +57,14 @@ export declare class AttachmentManager {
     private prepareAttachmentUpdate;
     updateAttachment: (attachmentToUpdate: LocalAttachment) => void;
     upsertAttachments: (attachmentsToUpsert: LocalAttachment[]) => void;
+    /**
+     * Releases a local preview URL the SDK minted, if it minted one.
+     *
+     * Only `blob:` URLs are ours to revoke: `toLocalUploadAttachment` puts a
+     * `URL.createObjectURL` result in `previewUri` for a `File`, but for a React Native
+     * `FileReference` it stores the caller's own native file URI, which must be left alone.
+     */
+    private revokePreviewUri;
     removeAttachments: (localAttachmentIds: string[]) => void;
     getUploadConfigCheck: (fileLike: FileReference | FileLike) => Promise<UploadPermissionCheckResult>;
     static toLocalUploadAttachment: (fileLike: FileReference | FileLike) => LocalUploadAttachment;

package/dist/types/messageComposer/messageComposer.d.ts

@@ -107,6 +107,19 @@ export declare class MessageComposer extends WithSubscriptions {
     isCommandDisabled: (command: CommandResponse) => boolean;
     validateCommandSendability: (command: CommandResponse, text?: string) => CommandSendability;
     get isCommandSendable(): boolean;
+    /**
+     * Whether the installed composition middleware composes messages whose uploads are still in
+     * flight — see `MessageCompositionMiddleware.allowsPendingUploads`.
+     *
+     * Derived from the chain rather than from config, so there is exactly one switch: the UI SDK
+     * that implements the rest of the flow installs the middleware, and everything that has to
+     * follow from that (starting with {@link hasSendableData}) follows on its own.
+     *
+     * **Temporary API.** In v10 sending with pending uploads becomes part of the composer
+     * configuration (`MessageComposerConfig`, set through `updateConfig`), and this getter,
+     * together with the middleware declaration it reads, is replaced by that config field.
+     */
+    get allowsPendingUploads(): boolean;
     get hasSendableData(): boolean;
     get compositionIsEmpty(): boolean;
     get contentIsEmpty(): boolean;

package/dist/types/messageComposer/middleware/attachmentManager/postUpload/attachmentEnrichment.d.ts

@@ -1,2 +1,21 @@
 import type { AttachmentPostUploadMiddleware } from '../types';
-export declare const createPostUploadAttachmentEnrichmentMiddleware: () => AttachmentPostUploadMiddleware;
+import type { MessageComposer } from '../../../messageComposer';
+/**
+ * Writes the uploaded URL onto the attachment and releases its local preview.
+ *
+ * The preview is a blob URL the composer created for the file. Releasing it once the CDN URL is
+ * in is what keeps the browser from holding the file in memory.
+ *
+ * Pass `composer` and the preview is released only while the attachment is still one of the
+ * composer's own — still listed in `attachmentManager.attachments`, i.e. still shown above the
+ * input, waiting to be sent.
+ *
+ * This runs when an upload finishes, which can be after the composer was cleared: `uploadFile`
+ * executes this chain before the (by then no-op) `updateAttachment`. If the attachment is gone
+ * from the composer, a message is rendering from the preview instead, and releasing it would
+ * blank that message out. A message can be sent with uploads still running — see
+ * `createSendWithPendingUploadsAttachmentsMiddleware`.
+ *
+ * Omit `composer` and the preview is always released.
+ */
+export declare const createPostUploadAttachmentEnrichmentMiddleware: (composer?: MessageComposer) => AttachmentPostUploadMiddleware;

package/dist/types/messageComposer/middleware/messageComposer/MessageComposerMiddlewareExecutor.d.ts

@@ -1,7 +1,12 @@
 import { MiddlewareExecutor } from '../../../middleware';
-import type { MessageComposerMiddlewareExecutorOptions, MessageComposerMiddlewareState, MessageDraftComposerMiddlewareExecutorOptions, MessageDraftComposerMiddlewareValueState } from './types';
+import type { MessageComposerMiddlewareExecutorOptions, MessageComposerMiddlewareState, MessageCompositionMiddleware, MessageDraftComposerMiddlewareExecutorOptions, MessageDraftComposerMiddlewareValueState } from './types';
 export declare class MessageComposerMiddlewareExecutor extends MiddlewareExecutor<MessageComposerMiddlewareState, 'compose'> {
     constructor({ composer }: MessageComposerMiddlewareExecutorOptions);
+    /**
+     * Narrows the base accessor to the composition middleware type, so callers can read the
+     * declarations it carries (`allowsPendingUploads`) without casting.
+     */
+    get installedMiddleware(): ReadonlyArray<MessageCompositionMiddleware>;
 }
 export declare class MessageDraftComposerMiddlewareExecutor extends MiddlewareExecutor<MessageDraftComposerMiddlewareValueState, 'compose'> {
     constructor({ composer }: MessageDraftComposerMiddlewareExecutorOptions);

package/dist/types/messageComposer/middleware/messageComposer/attachments.d.ts

@@ -1,4 +1,28 @@
 import type { MessageComposer } from '../../messageComposer';
 import type { MessageCompositionMiddleware, MessageDraftCompositionMiddleware } from './types';
+/**
+ * Drop-in replacement for {@link createAttachmentsCompositionMiddleware} that lets a message be
+ * composed while its attachments are still uploading.
+ *
+ * Reuses the same middleware id, so installing it with
+ * `compositionMiddlewareExecutor.replace([...])` keeps its position in the chain. The default
+ * refuses instead: it warns "Wait until all attachments have uploaded" and discards the
+ * composition.
+ *
+ * **Installing this is only half of the flow.** The composition it produces is not ready for the
+ * wire — `message.attachments` omits everything that has no URL yet. Whoever performs the send
+ * has to await those uploads (`UploadManager.upload` is idempotent by `localMetadata.id`, so
+ * calling it again returns the in-flight promise), write the resolved URLs in, and send after
+ * that.
+ *
+ * Sendability follows on its own: the `allowsPendingUploads` declaration below is what
+ * {@link MessageComposer.hasSendableData} reads to stop treating an upload in flight as a
+ * blocker, so installing this middleware is the only switch there is.
+ *
+ * This is why there is no config option turning it on: the switch belongs to the UI SDK that
+ * implements the other half. stream-chat-react exposes it as a `Chat` prop;
+ * stream-chat-react-native as `allowSendBeforeAttachmentsUpload` on the message input.
+ */
+export declare const createSendWithPendingUploadsAttachmentsMiddleware: (composer: MessageComposer) => MessageCompositionMiddleware;
 export declare const createAttachmentsCompositionMiddleware: (composer: MessageComposer) => MessageCompositionMiddleware;
 export declare const createDraftAttachmentsCompositionMiddleware: (composer: MessageComposer) => MessageDraftCompositionMiddleware;

package/dist/types/messageComposer/middleware/messageComposer/types.d.ts

@@ -16,5 +16,26 @@ export type MessageDraftComposerMiddlewareValueState = {
 export type MessageDraftComposerMiddlewareExecutorOptions = {
     composer: MessageComposer;
 };
-export type MessageCompositionMiddleware = Middleware<MessageComposerMiddlewareState, 'compose'>;
+export type MessageCompositionMiddleware = Middleware<MessageComposerMiddlewareState, 'compose'> & {
+    /**
+     * Declares that this middleware composes messages whose attachment uploads are still in
+     * flight, instead of refusing to compose until they finish.
+     *
+     * {@link MessageComposer.hasSendableData} reads this: an upload in flight must not block the
+     * send while such a middleware is installed, or the send could never be triggered. Any
+     * middleware implementing that contract may set it - the composer keys off the declaration,
+     * not off a middleware id, so a custom implementation is treated the same as the one shipped
+     * here.
+     *
+     * Composing this way is only half of the flow: whoever performs the send has to await those
+     * uploads and write the resolved URLs into the payload. See
+     * {@link createSendWithPendingUploadsAttachmentsMiddleware}.
+     *
+     * **Temporary API.** In v10 sending with pending uploads becomes part of the composer
+     * configuration (`MessageComposerConfig`, set through `updateConfig`), and this declaration,
+     * together with {@link MessageComposer.allowsPendingUploads}, is replaced by that config
+     * field.
+     */
+    allowsPendingUploads?: boolean;
+};
 export type MessageDraftCompositionMiddleware = Middleware<MessageDraftComposerMiddlewareValueState, 'compose'>;

package/dist/types/messageComposer/types.d.ts

@@ -68,6 +68,11 @@ export type LocalAttachmentUploadMetadata = {
      */
     previewUri?: string;
     uploadState: AttachmentLoadingState;
+    /**
+     * Mirrors {@link UploadRecord.uploadConfirmationPending}: every byte has been sent, but the server has
+     * not confirmed yet - not returned response to the upload request. Render an indeterminate indicator rather than a full bar.
+     */
+    uploadConfirmationPending?: boolean;
     uploadPermissionCheck?: UploadPermissionCheckResult;
     /** 0–100 while uploading when progress tracking is enabled; undefined otherwise or when indeterminate */
     uploadProgress?: number;

package/dist/types/middleware.d.ts

@@ -34,6 +34,14 @@ export declare class MiddlewareExecutor<TValue, THandlers extends string> {
     readonly id: string;
     private middleware;
     constructor();
+    /**
+     * The middleware currently installed, in execution order.
+     *
+     * Read-only: use `use` / `insert` / `replace` / `setOrder` / `remove` to change the chain. It
+     * exists so components can ask what the chain is capable of - a middleware may declare
+     * behaviour its host has to account for, and the host has no other way to find out.
+     */
+    get installedMiddleware(): ReadonlyArray<Middleware<TValue, THandlers>>;
     use(middleware: Middleware<TValue, THandlers> | Middleware<TValue, THandlers>[]): this;
     replace(middleware: Middleware<TValue, THandlers>[]): this;
     insert({ middleware, position, unique, }: {

package/dist/types/uploadManager.d.ts

@@ -1,8 +1,38 @@
 import type { StreamChat } from './client';
 import { StateStore } from './store';
 import type { AttachmentManager } from '.';
+/**
+ * Whether an upload ended because it was aborted rather than because it failed.
+ *
+ * {@link UploadManager.deleteUploadRecord} and {@link UploadManager.cancelAllUploads} abort the
+ * request through its `AbortController`, which is what happens when an attachment is removed
+ * from the composer mid-upload or the client disconnects. Axios reports that as a
+ * `CanceledError` (`axios.isCancel`); a custom `doUploadRequest` on another transport
+ * conventionally throws a `DOMException` named `AbortError`.
+ *
+ * Callers use this to keep a deliberate cancellation from being reported as an error.
+ */
+export declare const isUploadCancellation: (error: unknown) => boolean;
 export type UploadRecord = {
     id: string;
+    /**
+     * `true` once every byte has been handed to the transport but the server has not responded
+     * yet.
+     *
+     * Upload progress measures bytes *written to the connection*, not bytes the server
+     * acknowledged, so it reaches 100% the moment the request body is flushed — then the
+     * connection sits idle while the CDN ingests the file and the response travels back. On a
+     * large file over a slow link that window is long, and a UI that renders 100% as "done"
+     * claims the upload is confirmed while it is not.
+     *
+     * Nothing measurable happens during that window, so it is the point at which a determinate
+     * progress bar should hand over to an indeterminate one. Confirmation is the record being
+     * removed, not progress reaching 100.
+     *
+     * Requires `AttachmentManagerConfig.trackUploadProgress`; without progress reporting there is
+     * no way to tell when the flush happened, and this stays `false`.
+     */
+    uploadConfirmationPending?: boolean;
     uploadProgress?: number;
 };
 export type UploadManagerState = {

package/dist/types/utils.d.ts

@@ -1,5 +1,5 @@
 import FormData from 'form-data';
-import type { AscDesc, ChannelFilters, ChannelQueryOptions, ChannelSort, ChannelSortBase, LocalMessage, LocalMessageBase, Logger, Message, MessagePaginationOptions, MessageResponse, MessageResponseBase, MessageSet, OwnUserResponse, PromoteChannelParams, ReactionGroupResponse, UpdatedMessage, UserResponse } from './types';
+import type { AscDesc, Attachment, ChannelFilters, ChannelQueryOptions, ChannelSort, ChannelSortBase, LocalMessage, LocalMessageBase, Logger, Message, MessagePaginationOptions, MessageResponse, MessageResponseBase, MessageSet, OwnUserResponse, PromoteChannelParams, ReactionGroupResponse, UpdatedMessage, UserResponse } from './types';
 import type { StreamChat } from './client';
 import type { Channel } from './channel';
 import type { AxiosRequestConfig } from 'axios';
@@ -74,6 +74,25 @@ export declare function formatMessage(message: MessageResponse | MessageResponse
  * @param {MessageResponse} message `MessageResponse` object
  */
 export declare function unformatMessage(message: LocalMessage): MessageResponse;
+/**
+ * Strips composer-internal state from a message's attachments, and drops any whose upload never
+ * resolved.
+ *
+ * `localMetadata` is how `AttachmentManager` tracks an upload (its id, the `File`, the local
+ * preview); it must never reach the API. An attachment that still carries it and has no remote
+ * URL was never settled — which is what happens when
+ * `createSendWithPendingUploadsAttachmentsMiddleware` is installed by a UI SDK that does not
+ * implement the rest of the flow (awaiting those uploads before sending). Sending it would store
+ * an attachment pointing at nothing, so it is dropped and logged instead.
+ *
+ * Returns the same message object when there was nothing to change.
+ */
+export declare const sanitizeOutgoingAttachments: <T extends {
+    attachments?: Attachment[];
+}>({ client, message, }: {
+    client: StreamChat;
+    message: T;
+}) => T;
 export declare const localMessageToNewMessagePayload: (localMessage: LocalMessage) => Message;
 export declare const toUpdatedMessagePayload: (message: LocalMessage | Partial<MessageResponse>) => UpdatedMessage;
 export declare const toDeletedMessage: ({ message, deletedAt, hardDelete, }: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stream-chat",
-  "version": "9.51.0",
+  "version": "9.52.0",
   "description": "JS SDK for the Stream Chat API",
   "homepage": "https://getstream.io/chat/",
   "author": {

package/src/channel.ts

@@ -9,6 +9,7 @@ import {
   logChatPromiseExecution,
   messageSetPagination,
   normalizeQuerySort,
+  sanitizeOutgoingAttachments,
 } from './utils';
 import type { StreamChat } from './client';
 import { DEFAULT_QUERY_CHANNEL_MESSAGE_LIST_PAGE_SIZE } from './constants';
@@ -212,14 +213,17 @@ export class Channel {
    *
    * @return {Promise<SendMessageAPIResponse>} The Server Response
    */
-  async _sendMessage(message: Message, options?: SendMessageOptions) {
-    return await this.getClient().post<SendMessageAPIResponse>(
-      this._channelURL() + '/message',
-      {
-        message,
-        ...options,
-      },
-    );
+  async _sendMessage(rawMessage: Message, options?: SendMessageOptions) {
+    const client = this.getClient();
+    const message = sanitizeOutgoingAttachments({
+      client,
+      message: rawMessage,
+    });
+
+    return await client.post<SendMessageAPIResponse>(this._channelURL() + '/message', {
+      message,
+      ...options,
+    });
   }
 
   async sendMessage(message: Message, options?: SendMessageOptions) {
@@ -2007,6 +2011,10 @@ export class Channel {
       // delivery-report network sync below is skipped for it.
       case 'message.read_locally':
       case 'message.read':
+        // Thread read events are handled indiscriminately within the reactive `thread` object, we can
+        // skip them here in order to ensure the channel does not get read incidentally when it should
+        // not.
+        if (event.thread) break;
         if (event.user?.id && event.created_at) {
           const previousReadState = channelState.read[event.user.id];
           channelState.read[event.user.id] = {

package/src/client.ts

@@ -36,6 +36,7 @@ import {
   normalizeQuerySort,
   randomId,
   retryInterval,
+  sanitizeOutgoingAttachments,
   sleep,
   toUpdatedMessagePayload,
 } from './utils';
@@ -3051,6 +3052,11 @@ export class StreamChat {
 
   /**
    * unflagMessage - unflag a message
+   *
+   * @deprecated The `/moderation/unflag` endpoint is deprecated and is a no-op on
+   * the backend - calling this resolves successfully but does not remove the flag.
+   * Use `client.moderation.submitAction()` against the review queue item instead.
+   *
    * @param {string} targetMessageID
    * @param {string} [options.user_id] currentUserID, only used with serverside auth
    * @returns {Promise<APIResponse>}
@@ -3064,6 +3070,11 @@ export class StreamChat {
 
   /**
    * unflagUser - unflag a user
+   *
+   * @deprecated The `/moderation/unflag` endpoint is deprecated and is a no-op on
+   * the backend - calling this resolves successfully but does not remove the flag.
+   * Use `client.moderation.submitAction()` against the review queue item instead.
+   *
    * @param {string} targetID
    * @param {string} [options.user_id] currentUserID, only used with serverside auth
    * @returns {Promise<APIResponse>}
@@ -3420,7 +3431,12 @@ export class StreamChat {
     }
 
     // should not include user object
-    const payload = toUpdatedMessagePayload(message);
+    // Sanitized at the point of sending, which is the only place every path converges: the
+    // offline replay of a queued `update-message` task calls this method directly.
+    const payload = sanitizeOutgoingAttachments({
+      client: this,
+      message: toUpdatedMessagePayload(message),
+    });
 
     // add user_id (if exists)
     if (typeof partialUserOrUserId === 'string') {

package/src/index.ts

@@ -62,3 +62,15 @@ export {
   promoteChannel,
 } from './utils';
 export { FixedSizeQueueCache } from './utils/FixedSizeQueueCache';
+/**
+ * Tag-keyed async runners. Exported so the UI SDKs (and integrators) serialize their own
+ * actions with the same primitive the SDK uses internally instead of hand-rolling promise
+ * chains. Tags share one process-wide map, so namespace yours (`my-app/thing/${id}`) to avoid
+ * colliding with another caller's.
+ */
+export {
+  hasPending,
+  settled,
+  withCancellation,
+  withoutConcurrency,
+} from './utils/concurrency';

package/src/messageComposer/attachmentIdentity.ts

@@ -1,5 +1,6 @@
 import type { Attachment, SharedLocationResponse } from '../types';
 import type {
+  AttachmentLoadingState,
   AudioAttachment,
   FileAttachment,
   GiphyAttachment,
@@ -27,6 +28,32 @@ export const isLocalUploadAttachment = (
 ): attachment is LocalUploadAttachment =>
   !!(attachment as LocalAttachment)?.localMetadata?.uploadState;
 
+/**
+ * Upload states meaning "the bytes are not on the CDN yet, but they are on their way".
+ * `blocked` and `failed` are excluded - those never resolve on their own.
+ *
+ * Typed against {@link AttachmentLoadingState} rather than `string`, so renaming a state fails
+ * the build instead of silently making this list match nothing - it decides what gets sent.
+ */
+const PENDING_UPLOAD_STATES: ReadonlyArray<AttachmentLoadingState> = [
+  'pending',
+  'uploading',
+];
+
+/** Whether an upload for this attachment is still expected to resolve. */
+export const isPendingUpload = (
+  attachment: unknown,
+): attachment is LocalUploadAttachment =>
+  isLocalUploadAttachment(attachment) &&
+  PENDING_UPLOAD_STATES.includes(attachment.localMetadata.uploadState);
+
+/** Whether this attachment's upload already resolved to a URL. */
+export const isFinishedUpload = (
+  attachment: unknown,
+): attachment is LocalUploadAttachment =>
+  isLocalUploadAttachment(attachment) &&
+  attachment.localMetadata.uploadState === 'finished';
+
 export const isFileAttachment = (
   attachment: Attachment | LocalAttachment,
   supportedVideoFormat: string[] = [],

package/src/messageComposer/attachmentManager.ts

@@ -27,6 +27,7 @@ import type {
   FileLike,
   FileReference,
   LocalAttachment,
+  LocalAttachmentUploadMetadata,
   LocalNotImageAttachment,
   LocalUploadAttachment,
   UploadPermissionCheckResult,
@@ -34,6 +35,7 @@ import type {
 import type { ChannelResponse, DraftMessage, LocalMessage } from '../types';
 import type { MessageComposer } from './messageComposer';
 import { mergeWithDiff } from '../utils/mergeWith';
+import { isUploadCancellation } from '../uploadManager';
 
 export type FileUploadFilter = (file: Partial<LocalUploadAttachment>) => boolean;
 
@@ -233,6 +235,7 @@ export class AttachmentManager {
       ...attachment,
       localMetadata: {
         ...attachment.localMetadata,
+        uploadConfirmationPending: false,
         uploadProgress: undefined,
         uploadState: 'failed',
       },
@@ -332,9 +335,28 @@ export class AttachmentManager {
     }
   };
 
+  /**
+   * Releases a local preview URL the SDK minted, if it minted one.
+   *
+   * Only `blob:` URLs are ours to revoke: `toLocalUploadAttachment` puts a
+   * `URL.createObjectURL` result in `previewUri` for a `File`, but for a React Native
+   * `FileReference` it stores the caller's own native file URI, which must be left alone.
+   */
+  private revokePreviewUri = (attachment: LocalAttachment) => {
+    const previewUri = (
+      attachment.localMetadata as Partial<LocalAttachmentUploadMetadata>
+    )?.previewUri;
+
+    if (previewUri?.startsWith('blob:')) URL.revokeObjectURL?.(previewUri);
+  };
+
   removeAttachments = (localAttachmentIds: string[]) => {
     if (!localAttachmentIds.length) return;
 
+    const removedAttachments = this.attachments.filter((attachment) =>
+      localAttachmentIds.includes(attachment.localMetadata?.id),
+    );
+
     this.state.partialNext({
       attachments: this.attachments.filter(
         (attachment) => !localAttachmentIds.includes(attachment.localMetadata?.id),
@@ -344,6 +366,18 @@ export class AttachmentManager {
     for (const id of localAttachmentIds) {
       this.client.uploadManager.deleteUploadRecord(id);
     }
+
+    // Removal is the end of the line for these attachments, so the preview blob goes with
+    // them - otherwise every removed (or cancelled mid-upload) attachment leaks one blob URL
+    // until the page unloads. Revoked after the record is deleted, so nothing is still
+    // rendering from it.
+    //
+    // Deliberately not done in `initState`/`restoreSnapshot`: those drop the composer's *view*
+    // of the attachments without ending their life. A finished upload has already had its
+    // `previewUri` revoked and removed by the post-upload middleware, and an unfinished one may
+    // still be rendered by whoever took it over (an optimistic message sent with the upload
+    // still in flight, for instance).
+    removedAttachments.forEach(this.revokePreviewUri);
   };
 
   getUploadConfigCheck = async (
@@ -619,21 +653,30 @@ export class AttachmentManager {
           ...attachment.localMetadata,
           uploadState: 'failed',
           uploadProgress: undefined,
+          // `false`, not `undefined`: these updates go through `updateAttachment`, which merges
+          // via `mergeWith` — and that skips `undefined` source values, so `undefined` would
+          // leave a stale `true` in place.
+          uploadConfirmationPending: false,
         },
       };
 
-      this.client.notifications.addError({
-        message: 'Error uploading attachment',
-        origin: {
-          emitter: 'AttachmentManager',
-          context: { attachment, failedAttachment },
-        },
-        options: {
-          type: 'api:attachment:upload:failed',
-          metadata: { reason },
-          originalError: error instanceof Error ? error : undefined,
-        },
-      });
+      // A cancellation is the user getting what they asked for, so it gets no error
+      // notification. This path predates the post-upload middleware chain and notifies
+      // directly, so it needs the same guard `createUploadErrorHandlerMiddleware` applies.
+      if (!isUploadCancellation(error)) {
+        this.client.notifications.addError({
+          message: 'Error uploading attachment',
+          origin: {
+            emitter: 'AttachmentManager',
+            context: { attachment, failedAttachment },
+          },
+          options: {
+            type: 'api:attachment:upload:failed',
+            metadata: { reason },
+            originalError: error instanceof Error ? error : undefined,
+          },
+        });
+      }
 
       this.updateAttachment(failedAttachment);
       return failedAttachment;
@@ -654,6 +697,8 @@ export class AttachmentManager {
         ...attachment.localMetadata,
         uploadState: 'finished',
         uploadProgress: undefined,
+        // See the note in the failure branch: `undefined` cannot clear through `mergeWith`.
+        uploadConfirmationPending: false,
       },
     };
 
@@ -715,6 +760,8 @@ export class AttachmentManager {
             ...attachment.localMetadata,
             uploadState: error ? 'failed' : 'finished',
             uploadProgress: undefined,
+            // See the note in `uploadAttachment`: `undefined` cannot clear through `mergeWith`.
+            uploadConfirmationPending: false,
           },
         },
         error,
@@ -759,6 +806,7 @@ export class AttachmentManager {
           ...attachment.localMetadata,
           uploadState: 'uploading',
           uploadProgress: this.config.trackUploadProgress ? 0 : undefined,
+          uploadConfirmationPending: false,
         },
       },
     ]);
@@ -773,6 +821,7 @@ export class AttachmentManager {
             ...attachment.localMetadata,
             uploadState: 'uploading',
             uploadProgress: nextUpload.uploadProgress,
+            uploadConfirmationPending: nextUpload.uploadConfirmationPending,
           },
         });
       },