@bli-cockpit/cli 0.2.53 → 0.2.55

package/dist/evidence-upload-client.js

@@ -1,781 +1,32 @@
-import { COMMIT_CRASHED_PLATFORM, RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, isRekeyableUploadConflict, } from "@bli-cockpit/telemetry-core";
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import { rekeyedEvidencePointer } from "./evidence-upload-rekey.js";
-import { describeError } from "./health-detail.js";
-const DEFAULT_MAX_ATTEMPTS = 3;
-const RETRY_DELAY_MS = 250;
+import { RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, } from "@bli-cockpit/telemetry-core";
+import { batches, loadPlannedEntries, resolveBeginBatch } from "./evidence-upload-plan.js";
+import { summarizeOutcomes, uploadWithLegacyFallback } from "./evidence-upload-terminal.js";
+import { NON_JSON_RESPONSE_BODY_KEY } from "./evidence-upload-transport.js";
 export async function uploadRawEvidenceFilesChunked(options) {
     const outcomes = [];
     if (options.files.length === 0) {
         return summarizeOutcomes(outcomes, false);
     }
+    // PLAN: read every staged file once, dedupe byte-identical siblings.
     const chunkSizeBytes = options.chunkSizeBytes ?? RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES;
-    const loaded = [];
-    const loadedByObjectKey = new Map();
-    for (const file of options.files) {
-        let stat;
-        try {
-            stat = await fs.stat(file.local_path);
-        }
-        catch (error) {
-            // `file_read_failed` is a durable ledger label and stays. Beside it: a
-            // staged object that vanished (the GC won a race) and one the process
-            // has no permission to open are the same word and opposite repairs
-            // (BLI-3238).
-            console.error("[evidence-upload] staged object could not be stat'd", JSON.stringify({
-                reason: "file_read_failed",
-                stage: "stat",
-                ...describeError(error),
-            }));
-            outcomes.push(failedOutcome(file, "file_read_failed"));
-            continue;
-        }
-        if (stat.size === 0) {
-            outcomes.push(failedOutcome(file, "empty_file"));
-            continue;
-        }
-        if (stat.size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
-            outcomes.push(failedOutcome(file, "file_too_large"));
-            continue;
-        }
-        let bytes;
-        try {
-            bytes = await fs.readFile(file.local_path);
-        }
-        catch (error) {
-            // Stat succeeded and the read did not — narrower than the stat failure
-            // above and worth telling apart, so it carries its own stage label.
-            console.error("[evidence-upload] staged object could not be read after a successful stat", JSON.stringify({
-                reason: "file_read_failed",
-                stage: "read",
-                byte_size: stat.size,
-                ...describeError(error),
-            }));
-            outcomes.push(failedOutcome(file, "file_read_failed"));
-            continue;
-        }
-        if (bytes.byteLength === 0) {
-            outcomes.push(failedOutcome(file, "empty_file"));
-            continue;
-        }
-        if (bytes.byteLength > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
-            outcomes.push(failedOutcome(file, "file_too_large"));
-            continue;
-        }
-        // Content-addressed keys collide for byte-identical files (e.g. a resumed
-        // session copied twice); upload once and share the outcome instead of
-        // racing a second upload against a committed ledger row.
-        const existing = file.pointer.object_key
-            ? loadedByObjectKey.get(file.pointer.object_key)
-            : undefined;
-        if (existing) {
-            existing.duplicates.push(file);
-            continue;
-        }
-        const entry = {
-            file,
-            bytes,
-            chunkCount: Math.ceil(bytes.byteLength / chunkSizeBytes),
-            duplicates: [],
-        };
-        loaded.push(entry);
-        if (file.pointer.object_key) {
-            loadedByObjectKey.set(file.pointer.object_key, entry);
-        }
-    }
+    const loaded = await loadPlannedEntries(options, chunkSizeBytes, outcomes);
+    // PLAN -> CHUNK -> SEND -> COMMIT -> RE-KEY, one `begin` batch at a time.
     const resolvedEntries = new Set();
     let beginUnavailable = false;
     for (const batch of batches(loaded, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN)) {
         if (beginUnavailable)
             break;
-        const begin = await requestJson(options, "/api/ambient/evidence/upload/begin", {
-            schema_version: "ambient-raw-evidence-upload-begin.v1",
-            generated_at: options.generatedAt,
-            provenance: options.provenance,
-            objects: batch.map((entry) => ({
-                pointer: entry.file.pointer,
-                chunk_size_bytes: chunkSizeBytes,
-                chunk_count: entry.chunkCount,
-            })),
-        });
-        // 404 means an old dashboard without the chunk routes; a persistent 5xx
-        // (after retries) covers a new dashboard whose ledger migration has not
-        // been applied yet. Both still serve the legacy v1 route.
-        if (begin.status === 404 || begin.status >= 500) {
-            // Until BLI-3483 this downgrade abandoned the entire chunked path
-            // without a word, and the comment above named two causes that the fleet
-            // had no way to tell apart — an old dashboard versus an unapplied ledger
-            // migration. This is the BLI-2528 shape exactly: the code knew, the
-            // operator did not. Once per run, because `break` leaves the loop.
-            console.error("[evidence-upload] chunked upload unavailable; falling back to the legacy single-shot route", JSON.stringify({
-                reason: begin.status === 404
-                    ? "begin_route_absent"
-                    : "begin_server_error_after_retries",
-                http_status: begin.status,
-                server_reason: safeFailureDetail(begin.body) ?? "none",
-                objects_in_batch: batch.length,
-                objects_unresolved: loaded.length - resolvedEntries.size,
-            }));
-            beginUnavailable = true;
+        beginUnavailable = await resolveBeginBatch(options, loaded.length, batch, chunkSizeBytes, outcomes, resolvedEntries);
+        if (beginUnavailable)
             break;
-        }
-        if (!begin.ok) {
-            // The server's own `{ reason }` sat unread in this body while the ledger
-            // recorded the transport status and nothing else (BLI-3483); the commit
-            // path has read it since BLI-2528 and this one now does the same.
-            const beginDetail = safeFailureDetail(begin.body);
-            const beginReason = `begin_failed_http_${begin.status}${beginDetail ? `_${beginDetail}` : ""}`;
-            console.error("[evidence-upload] begin refused these objects", JSON.stringify({
-                reason: "begin_rejected",
-                http_status: begin.status,
-                server_reason: beginDetail ?? "none",
-                objects_in_batch: batch.length,
-            }));
-            for (const entry of batch) {
-                outcomes.push(failedOutcome(entry.file, beginReason));
-                for (const duplicate of entry.duplicates) {
-                    outcomes.push(failedOutcome(duplicate, beginReason));
-                }
-                resolvedEntries.add(entry);
-            }
-            continue;
-        }
-        const parsedBegin = RawEvidenceUploadBeginResponseSchema.safeParse(begin.body);
-        if (!parsedBegin.success) {
-            for (const entry of batch) {
-                outcomes.push(failedOutcome(entry.file, "begin_invalid_response"));
-                for (const duplicate of entry.duplicates) {
-                    outcomes.push(failedOutcome(duplicate, "begin_invalid_response"));
-                }
-                resolvedEntries.add(entry);
-            }
-            continue;
-        }
-        const dispositions = readBeginDispositions(parsedBegin.data);
-        if (!dispositions) {
-            for (const entry of batch) {
-                outcomes.push(failedOutcome(entry.file, "begin_invalid_response"));
-                for (const duplicate of entry.duplicates) {
-                    outcomes.push(failedOutcome(duplicate, "begin_invalid_response"));
-                }
-                resolvedEntries.add(entry);
-            }
-            continue;
-        }
-        for (const entry of batch) {
-            const objectKey = entry.file.pointer.object_key ?? "";
-            const disposition = dispositions.get(objectKey);
-            if (!disposition) {
-                outcomes.push(failedOutcome(entry.file, "begin_missing_disposition"));
-                for (const duplicate of entry.duplicates) {
-                    outcomes.push(failedOutcome(duplicate, "begin_missing_disposition"));
-                }
-                resolvedEntries.add(entry);
-                continue;
-            }
-            if (disposition.raw_evidence_pointer_id !==
-                entry.file.pointer.raw_evidence_pointer_id) {
-                outcomes.push(failedOutcome(entry.file, "begin_disposition_mismatch"));
-                for (const duplicate of entry.duplicates) {
-                    outcomes.push(failedOutcome(duplicate, "begin_disposition_mismatch"));
-                }
-                resolvedEntries.add(entry);
-                continue;
-            }
-            // A conflict a different name can settle gets one, here, before the
-            // upload is attempted (BLI-3552). Anything else comes back unchanged and
-            // fails on its own reason inside `uploadOneObject`.
-            const resolved = await rekeyConflictedEntry(options, entry, disposition, chunkSizeBytes);
-            const outcome = await uploadOneObject(options, resolved.entry, resolved.disposition, chunkSizeBytes);
-            await reportAbandonedUpload(options, resolved.disposition, outcome);
-            outcomes.push(outcome);
-            // The duplicates of a re-keyed primary were re-keyed with it: a duplicate
-            // is byte-identical and shared the primary's key, so it shares the new
-            // one too. Leaving them on the old key would point their evidence refs at
-            // somebody else's durable object.
-            for (const duplicate of resolved.entry.duplicates) {
-                outcomes.push(duplicateOutcome(outcome, duplicate));
-            }
-            resolvedEntries.add(entry);
-        }
     }
+    // TERMINAL: a dashboard with no chunk routes finishes on the legacy
+    // single-shot upload for everything the batch loop never resolved.
     if (beginUnavailable) {
         return uploadWithLegacyFallback(options, loaded.filter((entry) => !resolvedEntries.has(entry)), outcomes);
     }
     return summarizeOutcomes(outcomes, false);
 }
-/**
- * A duplicate file shares its primary's fate, but a primary that physically
- * uploaded leaves the duplicate as reuse of now-durable content — counting it
- * as a second upload would inflate object counts.
- */
-function duplicateOutcome(primary, duplicate) {
-    return {
-        ...primary,
-        pointer: pointerWithUploadedMetadata(duplicate.pointer, primary.pointer),
-        codex_session_id: duplicate.codex_session_id ?? null,
-        kind: duplicate.kind ?? "unknown",
-        artifact_metadata: duplicate.artifact_metadata,
-        upload_state: primary.upload_state === "uploaded"
-            ? "reused_existing"
-            : primary.upload_state,
-        reason: primary.upload_state === "uploaded" ? "duplicate_in_batch" : primary.reason,
-        uploaded_chunk_count: 0,
-    };
-}
-/**
- * Tell the server why we gave up on a row `begin` already opened (BLI-2539).
- *
- * `begin` opens a ledger row per object and the chunks then go one object at a
- * time, so one object failing leaves its siblings untouched — the production
- * shape is a lone failure among committed rows. This function is the only thing
- * standing between that failure and a row that sits `pending` with a null
- * reason until a drain relabels it `staging_incomplete` weeks later, which
- * names the shape and not the cause. 275 rows reached that state by 2026-08-14.
- *
- * The server records the reason on the still-open row (for a reason classified
- * permanent it fails the row closed), so reporting a give-up never costs the
- * staged chunks the next sync resumes from.
- *
- * Deliberately best-effort: the upload has already failed and the caller's
- * outcome is the answer that matters. Losing the abort as well leaves exactly
- * the row we had before this existed, so a delivery failure must not throw —
- * but it is named on stderr rather than swallowed, because a reason the server
- * never received is invisible precisely where BLI-2539 needed it visible.
- */
-async function reportAbandonedUpload(options, disposition, outcome) {
-    if (outcome.upload_state !== "upload_failed")
-        return;
-    if (!outcome.reason)
-        return;
-    // Only a row this call actually opened or resumed. `conflict` never allocated
-    // one for us, and `already_committed` names durable content an abort must not
-    // touch.
-    if (disposition.disposition !== "new" && disposition.disposition !== "resume") {
-        return;
-    }
-    if (!disposition.upload_id)
-        return;
-    const reason = conformReasonLabel(outcome.reason);
-    const response = await requestJson(options, "/api/ambient/evidence/upload/abort", {
-        schema_version: "ambient-raw-evidence-upload-abort.v1",
-        generated_at: options.generatedAt,
-        provenance: options.provenance,
-        upload_id: disposition.upload_id,
-        object_key: outcome.object_key,
-        reason,
-        uploaded_chunk_count: outcome.uploaded_chunk_count,
-    });
-    if (!response.ok) {
-        // status 404 is an old dashboard without the abort route; status 0 means
-        // the request itself never completed. Metadata only — ids, status, labels.
-        console.error("[evidence-abort] delivery failed; the server did not record the reason", JSON.stringify({
-            upload_id: disposition.upload_id,
-            reason,
-            http_status: response.status,
-        }));
-    }
-}
-/**
- * Force a reason into the label shape the abort route accepts.
- *
- * Every reason this client composes already fits, and this exists so that stays
- * true without anyone having to remember it. A label the server rejects comes
- * back 400 and the reason is lost — which is the precise failure BLI-2539 is
- * about, arriving through the code meant to fix it. A mangled label that lands
- * beats a perfect one that does not.
- */
-function conformReasonLabel(reason) {
-    const conformed = reason.replace(/[^a-z0-9_:.-]/gi, "_").slice(0, 120);
-    return conformed.length > 0 ? conformed : "upload_failed_unlabelled";
-}
-/**
- * Settle a re-keyable conflict by asking for a second name (BLI-3552).
- *
- * `hash_mismatch_committed_object` means the key already holds different bytes
- * that are already durable. Re-sending is the loop; deleting the durable object
- * to make room is destroying evidence. The third answer is to offer this
- * content under a name derived from its own hash, which is what this does, once
- * per object per sync.
- *
- * Every path that cannot get there returns the ORIGINAL pair, so the object
- * fails on the conflict reason `begin` actually gave rather than on a label
- * invented here. Nothing is written off permanently either way: the upload
- * cursor only remembers successes, so the next eligible sync offers the bytes
- * again — at delivery-backoff cadence now instead of every 15 minutes.
- */
-async function rekeyConflictedEntry(options, entry, disposition, chunkSizeBytes) {
-    if (disposition.disposition !== "conflict" ||
-        !isRekeyableUploadConflict(disposition.reason)) {
-        return { entry, disposition };
-    }
-    const contentHashPrefix = (entry.file.pointer.content_hash_sha256 ?? "none").slice(0, 12);
-    const rekeyedPointer = rekeyedEvidencePointer(entry.file.pointer);
-    if (!rekeyedPointer) {
-        // The key already names this content and the server still says it holds
-        // something else. A rename cannot answer that; a person has to.
-        console.error("[evidence-rekey] the key already carries this content hash; leaving the conflict for a person", JSON.stringify({
-            reason: disposition.reason,
-            kind: entry.file.kind ?? "unknown",
-            content_hash_prefix: contentHashPrefix,
-            byte_size: entry.bytes.byteLength,
-        }));
-        return { entry, disposition };
-    }
-    const rekeyedEntry = {
-        ...entry,
-        file: { ...entry.file, pointer: rekeyedPointer },
-        duplicates: entry.duplicates.map((duplicate) => ({
-            ...duplicate,
-            pointer: rekeyedEvidencePointer(duplicate.pointer) ?? duplicate.pointer,
-        })),
-    };
-    const rekeyedDisposition = await beginOneObject(options, rekeyedEntry, chunkSizeBytes);
-    if (!rekeyedDisposition) {
-        return { entry, disposition };
-    }
-    console.error("[evidence-rekey] committed object holds other content; offering these bytes under their own hash", JSON.stringify({
-        reason: disposition.reason,
-        kind: entry.file.kind ?? "unknown",
-        content_hash_prefix: contentHashPrefix,
-        byte_size: entry.bytes.byteLength,
-        chunk_count: entry.chunkCount,
-        rekeyed_disposition: rekeyedDisposition.disposition,
-        rekeyed_reason: rekeyedDisposition.reason ?? "none",
-        duplicate_count: entry.duplicates.length,
-    }));
-    return { entry: rekeyedEntry, disposition: rekeyedDisposition };
-}
-/**
- * `begin` for a single object. Null whenever the answer cannot be trusted —
- * transport failure, an unparseable body, a duplicate or missing key, or a
- * pointer id that is not the one we sent — and the caller then keeps the
- * original conflict rather than acting on a guess.
- */
-async function beginOneObject(options, entry, chunkSizeBytes) {
-    const objectKey = entry.file.pointer.object_key ?? "";
-    const response = await requestJson(options, "/api/ambient/evidence/upload/begin", {
-        schema_version: "ambient-raw-evidence-upload-begin.v1",
-        generated_at: options.generatedAt,
-        provenance: options.provenance,
-        objects: [
-            {
-                pointer: entry.file.pointer,
-                chunk_size_bytes: chunkSizeBytes,
-                chunk_count: entry.chunkCount,
-            },
-        ],
-    });
-    if (!response.ok) {
-        console.error("[evidence-rekey] begin refused the re-keyed object; keeping the original conflict", JSON.stringify({
-            reason: "rekey_begin_rejected",
-            http_status: response.status,
-            server_reason: safeFailureDetail(response.body) ?? "none",
-            kind: entry.file.kind ?? "unknown",
-        }));
-        return null;
-    }
-    const parsed = RawEvidenceUploadBeginResponseSchema.safeParse(response.body);
-    if (!parsed.success)
-        return null;
-    const dispositions = readBeginDispositions(parsed.data);
-    const disposition = dispositions?.get(objectKey);
-    if (!disposition)
-        return null;
-    if (disposition.raw_evidence_pointer_id !==
-        entry.file.pointer.raw_evidence_pointer_id) {
-        return null;
-    }
-    return disposition;
-}
-async function uploadOneObject(options, entry, disposition, chunkSizeBytes) {
-    const objectKey = entry.file.pointer.object_key ?? "";
-    if (disposition.disposition === "already_committed") {
-        if (!disposition.upload_id) {
-            return failedOutcome(entry.file, "begin_committed_receipt_unavailable");
-        }
-    }
-    if (disposition.disposition === "conflict" || !disposition.upload_id) {
-        return failedOutcome(entry.file, disposition.reason ?? "upload_conflict");
-    }
-    const received = new Set(disposition.received_chunk_indexes);
-    let uploadedChunks = 0;
-    if (disposition.disposition !== "already_committed" &&
-        !disposition.commit_ready) {
-        for (let index = 0; index < entry.chunkCount; index += 1) {
-            if (received.has(index))
-                continue;
-            const chunk = entry.bytes.subarray(index * chunkSizeBytes, Math.min((index + 1) * chunkSizeBytes, entry.bytes.byteLength));
-            const chunkResponse = await requestJson(options, "/api/ambient/evidence/upload/chunk", {
-                schema_version: "ambient-raw-evidence-upload-chunk.v1",
-                generated_at: options.generatedAt,
-                provenance: options.provenance,
-                upload_id: disposition.upload_id,
-                object_key: objectKey,
-                chunk_index: index,
-                chunk_count: entry.chunkCount,
-                chunk_hash_sha256: sha256(chunk),
-                content_base64: chunk.toString("base64"),
-            });
-            if (!chunkResponse.ok) {
-                // Same treatment the commit path has had since BLI-2528: the server's
-                // own reason rides on the label, so `chunk_3_failed_http_413` becomes
-                // `chunk_3_failed_http_413_object_too_large` and the ledger row names
-                // the cause instead of the transport (BLI-3483).
-                const chunkDetail = safeFailureDetail(chunkResponse.body);
-                console.error("[evidence-upload] chunk rejected", JSON.stringify({
-                    reason: "chunk_rejected",
-                    upload_id: disposition.upload_id,
-                    http_status: chunkResponse.status,
-                    server_reason: chunkDetail ?? "none",
-                    chunk_index: index,
-                    chunk_count: entry.chunkCount,
-                    uploaded_chunk_count: uploadedChunks,
-                }));
-                return failedOutcome(entry.file, `chunk_${index}_failed_http_${chunkResponse.status}${chunkDetail ? `_${chunkDetail}` : ""}`, uploadedChunks);
-            }
-            uploadedChunks += 1;
-        }
-    }
-    const commit = await requestJson(options, "/api/ambient/evidence/upload/commit", {
-        schema_version: "ambient-raw-evidence-upload-commit.v1",
-        generated_at: options.generatedAt,
-        provenance: options.provenance,
-        upload_id: disposition.upload_id,
-        object_key: objectKey,
-    });
-    if (!commit.ok) {
-        // The server can tell us this object will be refused again. Take its reason
-        // verbatim so the label names the cause ("storage rejected 116 MB") instead
-        // of the transport ("commit_failed_http_500"), which is all the fleet could
-        // say for the 57 days of BLI-2528.
-        const permanent = permanentCommitRejection(commit.body);
-        if (permanent) {
-            return failedOutcome(entry.file, permanent, uploadedChunks);
-        }
-        // A 5xx whose body is not JSON did not come from the route. The commit
-        // handler always answers `{ code, message, ... }`; an HTML error page means
-        // the serverless process was killed — an out-of-memory on a large
-        // assembly, or a hard timeout — so nothing server-side ran a catch, wrote a
-        // ledger reason, or logged a line. Naming it separately is the only way an
-        // operator reading upload reasons can tell "the server refused these bytes"
-        // from "the server never survived them".
-        //
-        // The stem comes from telemetry-core so the label the collector writes and
-        // the label `classifyUploadFailure` reads are the same string by
-        // construction; the status rides on the end so a 502 gateway timeout can
-        // still be told from a 500 process kill, and core strips it back off.
-        if (commit.status >= 500 && isNonJsonResponseBody(commit.body)) {
-            console.error("[evidence-commit] the server died before it could answer; the object is still pending", JSON.stringify({
-                upload_id: disposition.upload_id,
-                http_status: commit.status,
-                byte_size: entry.bytes.byteLength,
-                chunk_count: entry.chunkCount,
-                uploaded_chunk_count: uploadedChunks,
-                reason: COMMIT_CRASHED_PLATFORM,
-            }));
-            return failedOutcome(entry.file, `${COMMIT_CRASHED_PLATFORM}_http_${commit.status}`, uploadedChunks);
-        }
-        const detail = safeFailureDetail(commit.body);
-        return failedOutcome(entry.file, `commit_failed_http_${commit.status}${detail ? `_${detail}` : ""}`, uploadedChunks);
-    }
-    // "already_committed" means a concurrent or earlier sync made these bytes
-    // durable; this sync does not own them, so they must be reported as reuse —
-    // a later ingest failure here must not clean up an object another sync's
-    // indexed refs already point at.
-    const parsedCommit = RawEvidenceUploadCommitResponseSchema.safeParse(commit.body);
-    if (!parsedCommit.success) {
-        return failedOutcome(entry.file, "commit_invalid_response", uploadedChunks);
-    }
-    if (!chunkCommitReceiptMatchesPointer(entry.file.pointer, parsedCommit.data)) {
-        return failedOutcome(entry.file, "commit_receipt_mismatch", uploadedChunks);
-    }
-    const committedPointer = entry.file.pointer;
-    if (parsedCommit.data.status === "already_committed") {
-        return {
-            pointer: committedPointer,
-            object_key: objectKey,
-            codex_session_id: entry.file.codex_session_id ?? null,
-            kind: entry.file.kind ?? "unknown",
-            artifact_metadata: entry.file.artifact_metadata,
-            upload_state: "reused_existing",
-            reason: "already_committed",
-            uploaded_chunk_count: uploadedChunks,
-        };
-    }
-    return {
-        pointer: committedPointer,
-        object_key: objectKey,
-        codex_session_id: entry.file.codex_session_id ?? null,
-        kind: entry.file.kind ?? "unknown",
-        artifact_metadata: entry.file.artifact_metadata,
-        upload_state: "uploaded",
-        reason: null,
-        uploaded_chunk_count: uploadedChunks,
-    };
-}
-/**
- * Older dashboards predate the chunk endpoints. Fall back to one legacy
- * request per file so an oversized or already-existing object fails (or
- * reuses) individually instead of dragging the whole batch down. Large files
- * are attempted rather than pre-failed: a non-serverless dashboard (the
- * default localhost deployment) accepts them like the old CLI could, and a
- * platform body-limit rejection comes back as a labeled per-file failure.
- */
-async function uploadWithLegacyFallback(options, loaded, outcomes) {
-    for (const entry of loaded) {
-        let outcome;
-        const response = await requestJson(options, "/api/ambient/evidence/upload", {
-            schema_version: "ambient-raw-evidence-upload.v1",
-            generated_at: options.generatedAt,
-            provenance: options.provenance,
-            files: [
-                {
-                    pointer: entry.file.pointer,
-                    content_base64: entry.bytes.toString("base64"),
-                },
-            ],
-        });
-        if (response.ok) {
-            const parsedLegacy = RawEvidenceLegacyUploadResponseSchema.safeParse(response.body);
-            if (!parsedLegacy.success) {
-                outcome = failedOutcome(entry.file, "legacy_upload_invalid_response");
-            }
-            else {
-                const receipt = parsedLegacy.data.uploaded.find((candidate) => candidate.raw_evidence_pointer_id ===
-                    entry.file.pointer.raw_evidence_pointer_id);
-                if (!receipt ||
-                    parsedLegacy.data.bucket !== entry.file.pointer.storage_bucket ||
-                    !legacyUploadReceiptMatchesPointer(entry.file.pointer, receipt)) {
-                    outcome = failedOutcome(entry.file, "legacy_upload_receipt_mismatch");
-                }
-                else {
-                    const pointer = pointerWithLegacyUploadResponse(entry.file.pointer, parsedLegacy.data);
-                    outcome = {
-                        pointer,
-                        object_key: entry.file.pointer.object_key ?? "",
-                        codex_session_id: entry.file.codex_session_id ?? null,
-                        kind: entry.file.kind ?? "unknown",
-                        artifact_metadata: entry.file.artifact_metadata,
-                        upload_state: "uploaded",
-                        reason: "legacy_single_shot_upload",
-                        uploaded_chunk_count: 1,
-                    };
-                }
-            }
-        }
-        else if (response.status === 409) {
-            // The pre-ledger route cannot prove that a conflicting object contains
-            // these exact bytes. Fail closed instead of seeding the cursor with an
-            // unverified pointer.
-            outcome = failedOutcome(entry.file, "legacy_upload_conflict_http_409");
-        }
-        else {
-            outcome = failedOutcome(entry.file, `legacy_upload_failed_http_${response.status}`);
-        }
-        outcomes.push(outcome);
-        for (const duplicate of entry.duplicates) {
-            outcomes.push(duplicateOutcome(outcome, duplicate));
-        }
-    }
-    return summarizeOutcomes(outcomes, true);
-}
-async function requestJson(options, routePath, body) {
-    const maxAttempts = options.maxAttemptsPerRequest ?? DEFAULT_MAX_ATTEMPTS;
-    const sleep = options.sleep ?? defaultSleep;
-    let lastStatus = 0;
-    let lastBody = null;
-    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-        try {
-            const response = await options.fetchImpl(`${options.dashboardUrl}${routePath}`, {
-                method: "POST",
-                headers: {
-                    "Authorization": `Bearer ${options.deviceToken}`,
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify(body),
-            });
-            lastStatus = response.status;
-            lastBody = await readResponseJson(response);
-            if (response.ok || (response.status < 500 && response.status !== 429)) {
-                return { ok: response.ok, status: response.status, body: lastBody };
-            }
-        }
-        catch (error) {
-            // `status: 0` is this function's word for "no answer came back", and it
-            // travels all the way to the upload ledger without ever saying whether
-            // the request left the machine. This is the exact silence BLI-2528 sat
-            // behind for 57 days; the route is named, the body never is.
-            console.error("[evidence-upload] request failed before a status came back", JSON.stringify({
-                reason: "upload_request_transport_error",
-                route: routePath,
-                attempt,
-                max_attempts: maxAttempts,
-                ...describeError(error),
-            }));
-            lastStatus = 0;
-            lastBody = null;
-        }
-        if (attempt < maxAttempts)
-            await sleep(RETRY_DELAY_MS * attempt);
-    }
-    return { ok: false, status: lastStatus, body: lastBody };
-}
-function readBeginDispositions(body) {
-    const map = new Map();
-    for (const entry of body.objects) {
-        if (map.has(entry.object_key))
-            return null;
-        map.set(entry.object_key, {
-            disposition: entry.disposition,
-            upload_id: entry.upload_id ?? null,
-            received_chunk_indexes: entry.received_chunk_indexes,
-            commit_ready: entry.commit_ready === true,
-            reason: entry.reason ?? null,
-            raw_evidence_pointer_id: entry.raw_evidence_pointer_id,
-        });
-    }
-    return map;
-}
-function failedOutcome(file, reason, uploadedChunks = 0) {
-    return {
-        pointer: file.pointer,
-        object_key: file.pointer.object_key ?? "",
-        codex_session_id: file.codex_session_id ?? null,
-        kind: file.kind ?? "unknown",
-        artifact_metadata: file.artifact_metadata,
-        upload_state: "upload_failed",
-        reason,
-        uploaded_chunk_count: uploadedChunks,
-    };
-}
-/**
- * The server's verdict that repeating this commit is pointless, or null.
- *
- * Two conditions, both required: the response says `retryable: false`, and the
- * reason is one this collector has classified as permanent. The second check is
- * the important one. A newer dashboard could declare a reason this CLI has never
- * heard of, and quietly abandoning an object on a word we cannot interpret is
- * exactly the silent drop the fleet contract forbids — so an unclassified reason
- * falls through to the ordinary retry path and stays visible.
- */
-function permanentCommitRejection(body) {
-    if (!body || typeof body !== "object")
-        return null;
-    if (body.retryable !== false)
-        return null;
-    const reason = safeFailureDetail(body);
-    return reason && isPermanentUploadFailure(reason) ? reason : null;
-}
-function safeFailureDetail(body) {
-    if (!body || typeof body !== "object")
-        return null;
-    const reason = body.reason;
-    return typeof reason === "string" && /^[a-z0-9_:-]{1,80}$/i.test(reason)
-        ? reason
-        : null;
-}
-function pointerWithLegacyUploadResponse(pointer, body) {
-    const entry = body.uploaded.find((candidate) => candidate.raw_evidence_pointer_id === pointer.raw_evidence_pointer_id);
-    if (!entry)
-        return pointer;
-    return pointerWithUploadedMetadata(pointer, {
-        content_hash_sha256: entry.content_hash_sha256,
-        byte_size: entry.byte_size,
-        redaction: entry.redaction,
-    });
-}
-function chunkCommitReceiptMatchesPointer(pointer, receipt) {
-    return (receipt.object_key === pointer.object_key &&
-        receipt.content_hash_sha256 === pointer.content_hash_sha256 &&
-        receipt.byte_size === pointer.byte_size &&
-        receipt.redaction === undefined);
-}
-function legacyUploadReceiptMatchesPointer(pointer, receipt) {
-    if (receipt.object_key !== pointer.object_key)
-        return false;
-    if (receipt.redaction) {
-        return (receipt.redaction.original_content_hash_sha256 ===
-            pointer.content_hash_sha256 &&
-            receipt.redaction.original_byte_size === pointer.byte_size &&
-            receipt.redaction.sanitized_content_hash_sha256 ===
-                receipt.content_hash_sha256 &&
-            receipt.redaction.sanitized_byte_size === receipt.byte_size);
-    }
-    return (receipt.content_hash_sha256 === pointer.content_hash_sha256 &&
-        receipt.byte_size === pointer.byte_size);
-}
-function pointerWithUploadedMetadata(pointer, metadata) {
-    const redaction = RawEvidenceRedactionMetadataSchema.safeParse(metadata.redaction);
-    return {
-        ...pointer,
-        content_hash_sha256: typeof metadata.content_hash_sha256 === "string"
-            ? metadata.content_hash_sha256
-            : pointer.content_hash_sha256,
-        byte_size: typeof metadata.byte_size === "number" ? metadata.byte_size : pointer.byte_size,
-        redaction: redaction.success ? redaction.data : pointer.redaction,
-    };
-}
-function summarizeOutcomes(outcomes, usedLegacyFallback) {
-    const uploaded = outcomes.filter((outcome) => outcome.upload_state === "uploaded");
-    return {
-        outcomes,
-        uploaded_object_keys: uploaded.map((outcome) => outcome.object_key),
-        uploaded_object_count: uploaded.length,
-        uploaded_chunk_count: outcomes.reduce((sum, outcome) => sum + outcome.uploaded_chunk_count, 0),
-        reused_count: outcomes.filter((outcome) => outcome.upload_state === "reused_existing").length,
-        failed_count: outcomes.filter((outcome) => outcome.upload_state === "upload_failed").length,
-        used_legacy_fallback: usedLegacyFallback,
-    };
-}
-/**
- * Marks a body the server did not produce as JSON.
- *
- * A dashboard route always answers with a JSON envelope, so an HTML body on a
- * 500 means the response came from the platform's error page and not from the
- * route — the process died before any handler ran. That distinction is the
- * whole difference between "the commit rejected these bytes" and "the commit
- * never got to decide", and it was invisible for the nine days of BLI-3067
- * because both collapsed into `commit_failed_http_500`.
- */
-export const NON_JSON_RESPONSE_BODY_KEY = "__cockpit_response_body_format";
-function isNonJsonResponseBody(body) {
-    return (!!body &&
-        typeof body === "object" &&
-        body[NON_JSON_RESPONSE_BODY_KEY] === "non_json");
-}
-async function readResponseJson(response) {
-    const text = await response.text();
-    if (!text)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        // The raw text is kept for the caller that wants to show it, never for a
-        // label or a log — it is an unbounded HTML page. Its SHAPE is safe and is
-        // the part that matters: a non-JSON body means something in front of the
-        // dashboard answered instead of it (BLI-3067, BLI-3238).
-        console.error("[evidence-upload] reply was not JSON", JSON.stringify({
-            reason: "response_body_not_json",
-            http_status: response.status,
-            byte_size: text.length,
-            content_type: response.headers.get("content-type") ?? "none",
-        }));
-        return { message: text, [NON_JSON_RESPONSE_BODY_KEY]: "non_json" };
-    }
-}
-function batches(items, size) {
-    const out = [];
-    for (let offset = 0; offset < items.length; offset += size) {
-        out.push(items.slice(offset, offset + size));
-    }
-    return out;
-}
-function defaultSleep(milliseconds) {
-    return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-function sha256(value) {
-    return crypto.createHash("sha256").update(value).digest("hex");
-}
+// Re-exported so every consumer keeps importing from `./evidence-upload-
+// client.js` regardless of which sibling a symbol now lives in.
+export { NON_JSON_RESPONSE_BODY_KEY };