@bli-cockpit/cli 0.2.262 → 0.2.263

package/dist/evidence-upload-legacy.js

@@ -0,0 +1,160 @@
+import { RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES, RawEvidenceLegacyUploadResponseSchema, } from "@bli-cockpit/telemetry-core";
+import { isLocalDashboardUrl } from "./dev-build.js";
+import { failedOutcome } from "./evidence-upload-object.js";
+import { StagedFileError, readWholeStagedFile } from "./evidence-upload-staged.js";
+import { duplicateOutcome, pointerWithUploadedMetadata, summarizeOutcomes } from "./evidence-upload-terminal.js";
+import { requestJson } from "./evidence-upload-transport.js";
+/**
+ * The legacy single-shot fallback: one request per file for a dashboard that
+ * predates the chunk routes. Split out of `evidence-upload-terminal.ts`.
+ */
+/**
+ * The most raw bytes the legacy single-shot route is offered on a hosted dashboard (BLI-3936).
+ *
+ * The route carries the file as base64 inside one JSON body, and Vercel refuses a body over about
+ * 4.5 MB before our code runs (a 93-byte `text/plain` 413). 3 MiB of raw bytes is 4 MiB of base64
+ * plus a few KB of pointer: the exact size the chunk route already sends in every chunk body, so
+ * it is proven to pass. Above it the request cannot succeed, only cost a full upload of the object
+ * to be told so (14 MB, every backoff window, on the reference Mac).
+ */
+export const LEGACY_SINGLE_SHOT_MAX_BYTES = RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES;
+/** A 413 from the legacy route: the host's body limit refused bytes we expected to fit. Terminal for those bytes. */
+export const EVIDENCE_TOO_LARGE_HTTP_413_REASON = "evidence_too_large_http_413";
+/** The reason an object too big for the legacy route carries while the chunk route is down. Retryable: `begin` recovering delivers it. */
+export const LEGACY_SINGLE_SHOT_TOO_LARGE_REASON = "legacy_single_shot_too_large_chunk_route_unavailable";
+/**
+ * Older dashboards predate the chunk endpoints. Fall back to one legacy
+ * request per file so an oversized or already-existing object fails (or
+ * reuses) individually instead of dragging the whole batch down. On a hosted
+ * dashboard an object over `LEGACY_SINGLE_SHOT_MAX_BYTES` is not sent at all
+ * (BLI-3936): the host's body limit refuses it for certain. A non-serverless
+ * dashboard (the default localhost deployment) is still attempted at any size,
+ * like the old CLI, and a platform refusal comes back as a labeled per-file
+ * failure; a 413 there is `evidence_too_large_http_413`, terminal (`terminalDeliveryReason`).
+ */
+export async function uploadWithLegacyFallback(options, loaded, outcomes) {
+    for (const entry of loaded) {
+        let outcome;
+        if (legacyRouteCannotCarry(options, entry.byteSize)) {
+            // Said out loud, with the numbers: this object was NOT sent, because the route would refuse it.
+            console.error("[evidence-upload] legacy single-shot upload not attempted; the object is too large for it and the chunk route is unavailable", JSON.stringify({
+                reason: LEGACY_SINGLE_SHOT_TOO_LARGE_REASON,
+                kind: entry.file.kind ?? "unknown",
+                byte_size: entry.byteSize,
+                limit_bytes: LEGACY_SINGLE_SHOT_MAX_BYTES,
+                content_hash_prefix: (entry.file.pointer.content_hash_sha256 ?? "none").slice(0, 12),
+                next: "retried through the chunk route once `begin` answers again",
+            }));
+            outcome = failedOutcome(entry.file, LEGACY_SINGLE_SHOT_TOO_LARGE_REASON);
+            outcomes.push(outcome);
+            for (const duplicate of entry.duplicates)
+                outcomes.push(duplicateOutcome(outcome, duplicate));
+            continue;
+        }
+        let wholeBytes;
+        try {
+            // Legacy single-shot needs the whole body; read it now, drop it after the send.
+            wholeBytes = await readWholeStagedFile(entry.file.local_path, entry.byteSize);
+        }
+        catch (error) {
+            const reason = error instanceof StagedFileError ? error.reason : "file_read_failed";
+            console.error("[evidence-upload] legacy single-shot upload not attempted; staged file unreadable", JSON.stringify({ reason, byte_size: entry.byteSize, kind: entry.file.kind ?? "unknown" }));
+            outcome = failedOutcome(entry.file, reason);
+            outcomes.push(outcome);
+            for (const duplicate of entry.duplicates)
+                outcomes.push(duplicateOutcome(outcome, duplicate));
+            continue;
+        }
+        const response = await requestJson(options, "/api/ambient/evidence/upload", {
+            schema_version: "ambient-raw-evidence-upload.v1",
+            generated_at: options.generatedAt,
+            provenance: options.provenance,
+            files: [
+                {
+                    pointer: entry.file.pointer,
+                    content_base64: wholeBytes.toString("base64"),
+                },
+            ],
+        });
+        outcome = legacyUploadOutcome(entry.file, response);
+        outcomes.push(outcome);
+        for (const duplicate of entry.duplicates) {
+            outcomes.push(duplicateOutcome(outcome, duplicate));
+        }
+    }
+    return summarizeOutcomes(outcomes, true);
+}
+/** True when sending this many raw bytes to the legacy route is certain to be refused by the host's body limit. */
+function legacyRouteCannotCarry(options, byteSize) {
+    return byteSize > LEGACY_SINGLE_SHOT_MAX_BYTES && !isLocalDashboardUrl(options.dashboardUrl);
+}
+function legacyUploadOutcome(file, response) {
+    let outcome;
+    if (response.ok) {
+        const parsedLegacy = RawEvidenceLegacyUploadResponseSchema.safeParse(response.body);
+        if (!parsedLegacy.success) {
+            outcome = failedOutcome(file, "legacy_upload_invalid_response");
+        }
+        else {
+            const receipt = parsedLegacy.data.uploaded.find((candidate) => candidate.raw_evidence_pointer_id ===
+                file.pointer.raw_evidence_pointer_id);
+            if (!receipt ||
+                parsedLegacy.data.bucket !== file.pointer.storage_bucket ||
+                !legacyUploadReceiptMatchesPointer(file.pointer, receipt)) {
+                outcome = failedOutcome(file, "legacy_upload_receipt_mismatch");
+            }
+            else {
+                const pointer = pointerWithLegacyUploadResponse(file.pointer, parsedLegacy.data);
+                outcome = {
+                    pointer,
+                    object_key: file.pointer.object_key ?? "",
+                    codex_session_id: file.codex_session_id ?? null,
+                    kind: file.kind ?? "unknown",
+                    artifact_metadata: file.artifact_metadata,
+                    upload_state: "uploaded",
+                    reason: "legacy_single_shot_upload",
+                    uploaded_chunk_count: 1,
+                };
+            }
+        }
+    }
+    else if (response.status === 409) {
+        // The pre-ledger route cannot prove that a conflicting object contains
+        // these exact bytes. Fail closed instead of seeding the cursor with an
+        // unverified pointer.
+        outcome = failedOutcome(file, "legacy_upload_conflict_http_409");
+    }
+    else if (response.status === 413) {
+        // BLI-3936: the host refused this body for its size. The same bytes meet the same limit on
+        // every retry, so this is terminal (`terminalDeliveryReason`) and says what it is.
+        outcome = failedOutcome(file, EVIDENCE_TOO_LARGE_HTTP_413_REASON);
+    }
+    else {
+        outcome = failedOutcome(file, `legacy_upload_failed_http_${response.status}`);
+    }
+    return outcome;
+}
+function pointerWithLegacyUploadResponse(pointer, body) {
+    const entry = body.uploaded.find((candidate) => candidate.raw_evidence_pointer_id === pointer.raw_evidence_pointer_id);
+    if (!entry)
+        return pointer;
+    return pointerWithUploadedMetadata(pointer, {
+        content_hash_sha256: entry.content_hash_sha256,
+        byte_size: entry.byte_size,
+        redaction: entry.redaction,
+    });
+}
+function legacyUploadReceiptMatchesPointer(pointer, receipt) {
+    if (receipt.object_key !== pointer.object_key)
+        return false;
+    if (receipt.redaction) {
+        return (receipt.redaction.original_content_hash_sha256 ===
+            pointer.content_hash_sha256 &&
+            receipt.redaction.original_byte_size === pointer.byte_size &&
+            receipt.redaction.sanitized_content_hash_sha256 ===
+                receipt.content_hash_sha256 &&
+            receipt.redaction.sanitized_byte_size === receipt.byte_size);
+    }
+    return (receipt.content_hash_sha256 === pointer.content_hash_sha256 &&
+        receipt.byte_size === pointer.byte_size);
+}

package/dist/evidence-upload-object.js

@@ -1,13 +1,9 @@
 import { putSignedChunk } from "./evidence-upload-direct.js";
 import { gzipSync } from "node:zlib";
 import { COMMIT_CRASHED_PLATFORM, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
+import { StagedFileError, readVerifiedChunk } from "./evidence-upload-staged.js";
 import { beginOneObject } from "./evidence-upload-terminal.js";
-import { isNonJsonResponseBody, requestJson, safeFailureDetail, sha256, } from "./evidence-upload-transport.js";
-/**
- * The `chunk` and `commit` stages for one already-`begin`-accepted object:
- * send every chunk the server does not already have, then commit and turn
- * the receipt into a `ChunkedUploadFileOutcome`.
- */
+import { isNonJsonResponseBody, requestJson, safeFailureDetail, } from "./evidence-upload-transport.js";
 export async function uploadOneObject(options, entry, disposition, chunkSizeBytes, restageAttempted = false) {
     const objectKey = entry.file.pointer.object_key ?? "";
     if (disposition.disposition === "already_committed") {
@@ -48,7 +44,20 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
     for (let index = 0; index < entry.chunkCount; index += 1) {
         if (received.has(index))
             continue;
-        const chunk = entry.bytes.subarray(index * chunkSizeBytes, Math.min((index + 1) * chunkSizeBytes, entry.bytes.byteLength));
+        let chunk;
+        try {
+            // Re-read from disk by offset and check against the plan-time hash; the
+            // buffer lives only for this iteration (BLI-23317).
+            chunk = await readVerifiedChunk(entry.file.local_path, index * chunkSizeBytes, Math.min(chunkSizeBytes, entry.byteSize - index * chunkSizeBytes), entry.chunkHashes[index]);
+        }
+        catch (error) {
+            const reason = error instanceof StagedFileError ? error.reason : "file_read_failed";
+            console.error("[evidence-upload] staged chunk could not be re-read; left for the next tick", JSON.stringify({
+                reason, upload_id: disposition.upload_id, chunk_index: index,
+                detail: error instanceof StagedFileError ? error.detail : "read_error",
+            }));
+            return { ok: false, outcome: failedOutcome(entry.file, reason, uploadedChunks) };
+        }
         const offer = disposition.signed_uploads?.find(upload => upload.chunk_index === index);
         const direct = offer
             ? await putSignedChunk(options, offer.signed_url, chunk, disposition.upload_id, index)
@@ -62,7 +71,7 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
         }
         if (direct === "uploaded") {
             directChunks.push({ chunk_index: index, byte_size: chunk.length,
-                chunk_hash_sha256: sha256(chunk) });
+                chunk_hash_sha256: entry.chunkHashes[index] });
             uploadedChunks += 1;
             continue;
         }
@@ -92,7 +101,7 @@ async function uploadChunkThroughEndpoint(options, entry, disposition, objectKey
         object_key: objectKey,
         chunk_index: index,
         chunk_count: entry.chunkCount,
-        chunk_hash_sha256: sha256(chunk),
+        chunk_hash_sha256: entry.chunkHashes[index],
         content_base64: encodedChunk.toString("base64"),
     });
     if (!chunkResponse.ok)
@@ -186,7 +195,7 @@ function rejectCommit(commit, entry, disposition, uploadedChunks) {
         console.error("[evidence-commit] the server died before it could answer; the object is still pending", JSON.stringify({
             upload_id: disposition.upload_id,
             http_status: commit.status,
-            byte_size: entry.bytes.byteLength,
+            byte_size: entry.byteSize,
             chunk_count: entry.chunkCount,
             uploaded_chunk_count: uploadedChunks,
             reason: COMMIT_CRASHED_PLATFORM,

package/dist/evidence-upload-plan.js

@@ -4,12 +4,13 @@ import { requestJson, safeFailureDetail } from "./evidence-upload-transport.js";
 import { failedOutcome, uploadOneObject } from "./evidence-upload-object.js";
 import { duplicateOutcome, rekeyConflictedEntry, reportAbandonedUpload, } from "./evidence-upload-terminal.js";
 import { describeError } from "./health-detail.js";
+import { StagedFileError, fingerprintStagedFile } from "./evidence-upload-staged.js";
 export async function loadPlannedEntries(options, chunkSizeBytes, outcomes) {
     const loaded = [];
     const loadedByObjectKey = new Map();
     for (const file of options.files) {
-        const bytes = await readStagedUploadBytes(file, outcomes);
-        if (!bytes)
+        const measured = await measureStagedUpload(file, chunkSizeBytes, outcomes);
+        if (!measured)
             continue;
         // Content-addressed keys collide for byte-identical files (e.g. a resumed
         // session copied twice); upload once and share the outcome instead of
@@ -23,8 +24,10 @@ export async function loadPlannedEntries(options, chunkSizeBytes, outcomes) {
         }
         const entry = {
             file,
-            bytes,
-            chunkCount: Math.ceil(bytes.byteLength / chunkSizeBytes),
+            byteSize: measured.byteSize,
+            objectSha256: measured.objectSha256,
+            chunkHashes: measured.chunkHashes,
+            chunkCount: measured.chunkHashes.length,
             duplicates: [],
         };
         loaded.push(entry);
@@ -34,7 +37,7 @@ export async function loadPlannedEntries(options, chunkSizeBytes, outcomes) {
     }
     return loaded;
 }
-async function readStagedUploadBytes(file, outcomes) {
+async function measureStagedUpload(file, chunkSizeBytes, outcomes) {
     let stat;
     try {
         stat = await fs.stat(file.local_path);
@@ -60,11 +63,21 @@ async function readStagedUploadBytes(file, outcomes) {
         outcomes.push(failedOutcome(file, "file_too_large"));
         return null;
     }
-    let bytes;
     try {
-        bytes = await fs.readFile(file.local_path);
+        const fingerprint = await fingerprintStagedFile(file.local_path, stat.size, chunkSizeBytes);
+        console.error("[evidence-upload] staged object measured", JSON.stringify({
+            byte_size: fingerprint.byteSize,
+            chunk_count: fingerprint.chunkHashes.length,
+            kind: file.kind ?? "unknown",
+        }));
+        return fingerprint;
     }
     catch (error) {
+        if (error instanceof StagedFileError) {
+            console.error("[evidence-upload] staged object changed or vanished while planning; left for the next tick", JSON.stringify({ reason: error.reason, stage: "plan", byte_size: stat.size, detail: error.detail }));
+            outcomes.push(failedOutcome(file, error.reason));
+            return null;
+        }
         // Stat succeeded and the read did not — narrower than the stat failure
         // above and worth telling apart, so it carries its own stage label.
         console.error("[evidence-upload] staged object could not be read after a successful stat", JSON.stringify({
@@ -76,15 +89,6 @@ async function readStagedUploadBytes(file, outcomes) {
         outcomes.push(failedOutcome(file, "file_read_failed"));
         return null;
     }
-    if (bytes.byteLength === 0) {
-        outcomes.push(failedOutcome(file, "empty_file"));
-        return null;
-    }
-    if (bytes.byteLength > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
-        outcomes.push(failedOutcome(file, "file_too_large"));
-        return null;
-    }
-    return bytes;
 }
 export function batches(items, size) {
     const out = [];

package/dist/evidence-upload-staged.js

@@ -0,0 +1,115 @@
+import crypto from "node:crypto";
+import { createReadStream } from "node:fs";
+import fs from "node:fs/promises";
+/** A staged file that no longer matches its plan-time fingerprint. */
+export class StagedFileError extends Error {
+    reason;
+    detail;
+    constructor(reason, detail) {
+        super(`${reason}: ${detail}`);
+        this.reason = reason;
+        this.detail = detail;
+    }
+}
+/** Read exactly `length` bytes at `position`, looping over short reads. */
+export async function readExactly(handle, length, position) {
+    const buffer = Buffer.allocUnsafe(length);
+    let filled = 0;
+    while (filled < length) {
+        const { bytesRead } = await handle.read(buffer, filled, length - filled, position + filled);
+        if (bytesRead === 0)
+            break;
+        filled += bytesRead;
+    }
+    return filled === length ? buffer : buffer.subarray(0, filled);
+}
+/**
+ * Stream the file once, hashing each chunk and the whole object. Memory is
+ * one chunk. Throws StagedFileError when the file vanishes or its length
+ * moves while it is being read.
+ */
+export async function fingerprintStagedFile(localPath, expectedSize, chunkSizeBytes, openFile = fs.open) {
+    const handle = await openStaged(localPath, openFile);
+    try {
+        const whole = crypto.createHash("sha256");
+        const chunkHashes = [];
+        for (let offset = 0; offset < expectedSize; offset += chunkSizeBytes) {
+            const want = Math.min(chunkSizeBytes, expectedSize - offset);
+            const chunk = await readExactly(handle, want, offset);
+            if (chunk.length !== want) {
+                throw new StagedFileError("staged_file_changed", "file shrank while planning");
+            }
+            whole.update(chunk);
+            chunkHashes.push(crypto.createHash("sha256").update(chunk).digest("hex"));
+        }
+        const probe = await readExactly(handle, 1, expectedSize);
+        if (probe.length !== 0) {
+            throw new StagedFileError("staged_file_changed", "file grew while planning");
+        }
+        return { byteSize: expectedSize, objectSha256: whole.digest("hex"), chunkHashes };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Read one chunk at send time and check it against the plan-time hash. */
+export async function readVerifiedChunk(localPath, offset, length, expectedSha256, openFile = fs.open) {
+    const handle = await openStaged(localPath, openFile);
+    try {
+        const chunk = await readExactly(handle, length, offset);
+        if (chunk.length !== length) {
+            throw new StagedFileError("staged_file_changed", "file shorter than planned");
+        }
+        const actual = crypto.createHash("sha256").update(chunk).digest("hex");
+        if (actual !== expectedSha256) {
+            throw new StagedFileError("staged_file_changed", "chunk hash differs from plan");
+        }
+        return chunk;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Whole staged file, for the legacy single-shot route only (small objects on hosted dashboards). */
+export async function readWholeStagedFile(localPath, byteSize) {
+    const handle = await openStaged(localPath, fs.open);
+    try {
+        const bytes = await readExactly(handle, byteSize, 0);
+        if (bytes.length !== byteSize) {
+            throw new StagedFileError("staged_file_changed", "file shorter than planned");
+        }
+        return bytes;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * sha256 and byte count of a file, streamed so memory is one read buffer.
+ * Null when the file cannot be read (callers treat that as "unknown").
+ */
+export async function hashFileStreaming(localPath) {
+    const hash = crypto.createHash("sha256");
+    let byteSize = 0;
+    try {
+        for await (const piece of createReadStream(localPath)) {
+            hash.update(piece);
+            byteSize += piece.byteLength;
+        }
+    }
+    catch {
+        return null;
+    }
+    return { digest: hash.digest("hex"), byteSize };
+}
+async function openStaged(localPath, openFile) {
+    try {
+        return await openFile(localPath, "r");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new StagedFileError("staged_file_missing", "ENOENT");
+        }
+        throw error;
+    }
+}

package/dist/evidence-upload-terminal.js

@@ -1,7 +1,5 @@
-import { RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, isRekeyableUploadConflict, } from "@bli-cockpit/telemetry-core";
-import { isLocalDashboardUrl } from "./dev-build.js";
+import { RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, isRekeyableUploadConflict, } from "@bli-cockpit/telemetry-core";
 import { readBeginDispositions } from "./evidence-upload-plan.js";
-import { failedOutcome } from "./evidence-upload-object.js";
 import { rekeyedEvidencePointer } from "./evidence-upload-rekey.js";
 import { requestJson, safeFailureDetail } from "./evidence-upload-transport.js";
 /**
@@ -30,7 +28,7 @@ export async function rekeyConflictedEntry(options, entry, disposition, chunkSiz
             reason: disposition.reason,
             kind: entry.file.kind ?? "unknown",
             content_hash_prefix: contentHashPrefix,
-            byte_size: entry.bytes.byteLength,
+            byte_size: entry.byteSize,
         }));
         return { entry, disposition };
     }
@@ -50,7 +48,7 @@ export async function rekeyConflictedEntry(options, entry, disposition, chunkSiz
         reason: disposition.reason,
         kind: entry.file.kind ?? "unknown",
         content_hash_prefix: contentHashPrefix,
-        byte_size: entry.bytes.byteLength,
+        byte_size: entry.byteSize,
         chunk_count: entry.chunkCount,
         rekeyed_disposition: rekeyedDisposition.disposition,
         rekeyed_reason: rekeyedDisposition.reason ?? "none",
@@ -185,153 +183,6 @@ function conformReasonLabel(reason) {
     const conformed = reason.replace(/[^a-z0-9_:.-]/gi, "_").slice(0, 120);
     return conformed.length > 0 ? conformed : "upload_failed_unlabelled";
 }
-/**
- * The most raw bytes the legacy single-shot route is offered on a hosted dashboard (BLI-3936).
- *
- * The route carries the file as base64 inside one JSON body, and Vercel refuses a body over about
- * 4.5 MB before our code runs (a 93-byte `text/plain` 413). 3 MiB of raw bytes is 4 MiB of base64
- * plus a few KB of pointer: the exact size the chunk route already sends in every chunk body, so
- * it is proven to pass. Above it the request cannot succeed, only cost a full upload of the object
- * to be told so (14 MB, every backoff window, on the reference Mac).
- */
-export const LEGACY_SINGLE_SHOT_MAX_BYTES = RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES;
-/** A 413 from the legacy route: the host's body limit refused bytes we expected to fit. Terminal for those bytes. */
-export const EVIDENCE_TOO_LARGE_HTTP_413_REASON = "evidence_too_large_http_413";
-/** The reason an object too big for the legacy route carries while the chunk route is down. Retryable: `begin` recovering delivers it. */
-export const LEGACY_SINGLE_SHOT_TOO_LARGE_REASON = "legacy_single_shot_too_large_chunk_route_unavailable";
-/**
- * Older dashboards predate the chunk endpoints. Fall back to one legacy
- * request per file so an oversized or already-existing object fails (or
- * reuses) individually instead of dragging the whole batch down. On a hosted
- * dashboard an object over `LEGACY_SINGLE_SHOT_MAX_BYTES` is not sent at all
- * (BLI-3936): the host's body limit refuses it for certain. A non-serverless
- * dashboard (the default localhost deployment) is still attempted at any size,
- * like the old CLI, and a platform refusal comes back as a labeled per-file
- * failure; a 413 there is `evidence_too_large_http_413`, terminal (`terminalDeliveryReason`).
- */
-export async function uploadWithLegacyFallback(options, loaded, outcomes) {
-    for (const entry of loaded) {
-        let outcome;
-        if (legacyRouteCannotCarry(options, entry.bytes.byteLength)) {
-            // Said out loud, with the numbers: this object was NOT sent, because the route would refuse it.
-            console.error("[evidence-upload] legacy single-shot upload not attempted; the object is too large for it and the chunk route is unavailable", JSON.stringify({
-                reason: LEGACY_SINGLE_SHOT_TOO_LARGE_REASON,
-                kind: entry.file.kind ?? "unknown",
-                byte_size: entry.bytes.byteLength,
-                limit_bytes: LEGACY_SINGLE_SHOT_MAX_BYTES,
-                content_hash_prefix: (entry.file.pointer.content_hash_sha256 ?? "none").slice(0, 12),
-                next: "retried through the chunk route once `begin` answers again",
-            }));
-            outcome = failedOutcome(entry.file, LEGACY_SINGLE_SHOT_TOO_LARGE_REASON);
-            outcomes.push(outcome);
-            for (const duplicate of entry.duplicates)
-                outcomes.push(duplicateOutcome(outcome, duplicate));
-            continue;
-        }
-        const response = await requestJson(options, "/api/ambient/evidence/upload", {
-            schema_version: "ambient-raw-evidence-upload.v1",
-            generated_at: options.generatedAt,
-            provenance: options.provenance,
-            files: [
-                {
-                    pointer: entry.file.pointer,
-                    content_base64: entry.bytes.toString("base64"),
-                },
-            ],
-        });
-        outcome = legacyUploadOutcome(entry.file, response);
-        outcomes.push(outcome);
-        for (const duplicate of entry.duplicates) {
-            outcomes.push(duplicateOutcome(outcome, duplicate));
-        }
-    }
-    return summarizeOutcomes(outcomes, true);
-}
-/** True when sending this many raw bytes to the legacy route is certain to be refused by the host's body limit. */
-function legacyRouteCannotCarry(options, byteSize) {
-    return byteSize > LEGACY_SINGLE_SHOT_MAX_BYTES && !isLocalDashboardUrl(options.dashboardUrl);
-}
-function legacyUploadOutcome(file, response) {
-    let outcome;
-    if (response.ok) {
-        const parsedLegacy = RawEvidenceLegacyUploadResponseSchema.safeParse(response.body);
-        if (!parsedLegacy.success) {
-            outcome = failedOutcome(file, "legacy_upload_invalid_response");
-        }
-        else {
-            const receipt = parsedLegacy.data.uploaded.find((candidate) => candidate.raw_evidence_pointer_id ===
-                file.pointer.raw_evidence_pointer_id);
-            if (!receipt ||
-                parsedLegacy.data.bucket !== file.pointer.storage_bucket ||
-                !legacyUploadReceiptMatchesPointer(file.pointer, receipt)) {
-                outcome = failedOutcome(file, "legacy_upload_receipt_mismatch");
-            }
-            else {
-                const pointer = pointerWithLegacyUploadResponse(file.pointer, parsedLegacy.data);
-                outcome = {
-                    pointer,
-                    object_key: file.pointer.object_key ?? "",
-                    codex_session_id: file.codex_session_id ?? null,
-                    kind: file.kind ?? "unknown",
-                    artifact_metadata: file.artifact_metadata,
-                    upload_state: "uploaded",
-                    reason: "legacy_single_shot_upload",
-                    uploaded_chunk_count: 1,
-                };
-            }
-        }
-    }
-    else if (response.status === 409) {
-        // The pre-ledger route cannot prove that a conflicting object contains
-        // these exact bytes. Fail closed instead of seeding the cursor with an
-        // unverified pointer.
-        outcome = failedOutcome(file, "legacy_upload_conflict_http_409");
-    }
-    else if (response.status === 413) {
-        // BLI-3936: the host refused this body for its size. The same bytes meet the same limit on
-        // every retry, so this is terminal (`terminalDeliveryReason`) and says what it is.
-        outcome = failedOutcome(file, EVIDENCE_TOO_LARGE_HTTP_413_REASON);
-    }
-    else {
-        outcome = failedOutcome(file, `legacy_upload_failed_http_${response.status}`);
-    }
-    return outcome;
-}
-function pointerWithLegacyUploadResponse(pointer, body) {
-    const entry = body.uploaded.find((candidate) => candidate.raw_evidence_pointer_id === pointer.raw_evidence_pointer_id);
-    if (!entry)
-        return pointer;
-    return pointerWithUploadedMetadata(pointer, {
-        content_hash_sha256: entry.content_hash_sha256,
-        byte_size: entry.byte_size,
-        redaction: entry.redaction,
-    });
-}
-function legacyUploadReceiptMatchesPointer(pointer, receipt) {
-    if (receipt.object_key !== pointer.object_key)
-        return false;
-    if (receipt.redaction) {
-        return (receipt.redaction.original_content_hash_sha256 ===
-            pointer.content_hash_sha256 &&
-            receipt.redaction.original_byte_size === pointer.byte_size &&
-            receipt.redaction.sanitized_content_hash_sha256 ===
-                receipt.content_hash_sha256 &&
-            receipt.redaction.sanitized_byte_size === receipt.byte_size);
-    }
-    return (receipt.content_hash_sha256 === pointer.content_hash_sha256 &&
-        receipt.byte_size === pointer.byte_size);
-}
-function pointerWithUploadedMetadata(pointer, metadata) {
-    const redaction = RawEvidenceRedactionMetadataSchema.safeParse(metadata.redaction);
-    return {
-        ...pointer,
-        content_hash_sha256: typeof metadata.content_hash_sha256 === "string"
-            ? metadata.content_hash_sha256
-            : pointer.content_hash_sha256,
-        byte_size: typeof metadata.byte_size === "number" ? metadata.byte_size : pointer.byte_size,
-        redaction: redaction.success ? redaction.data : pointer.redaction,
-    };
-}
 export function summarizeOutcomes(outcomes, usedLegacyFallback) {
     const uploaded = outcomes.filter((outcome) => outcome.upload_state === "uploaded");
     return {
@@ -343,4 +194,15 @@ export function summarizeOutcomes(outcomes, usedLegacyFallback) {
         failed_count: outcomes.filter((outcome) => outcome.upload_state === "upload_failed").length,
         used_legacy_fallback: usedLegacyFallback,
     };
+}
+export function pointerWithUploadedMetadata(pointer, metadata) {
+    const redaction = RawEvidenceRedactionMetadataSchema.safeParse(metadata.redaction);
+    return {
+        ...pointer,
+        content_hash_sha256: typeof metadata.content_hash_sha256 === "string"
+            ? metadata.content_hash_sha256
+            : pointer.content_hash_sha256,
+        byte_size: typeof metadata.byte_size === "number" ? metadata.byte_size : pointer.byte_size,
+        redaction: redaction.success ? redaction.data : pointer.redaction,
+    };
 }