@hue-run/sdk 0.16.0 → 0.17.0

package/dist/client.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";
+import { isMediaName } from "./inline-files.js";
 import { context, isSpanContextValid, ROOT_CONTEXT, SpanKind, SpanStatusCode, trace, } from "@opentelemetry/api";
 import { defaultTextMapGetter, defaultTextMapSetter } from "@opentelemetry/api";
 import { SeverityNumber } from "@opentelemetry/api-logs";
@@ -10,7 +11,7 @@ import { defaultResource, resourceFromAttributes } from "@opentelemetry/resource
 import { HUE_SCOPE } from "./config.js";
 import { hostedServerAddresses, hostedToolActivity, hostedToolProvider, providerErrorDescription, } from "./provider-tools.js";
 import { toolCatalogSummary } from "./tool-definitions.js";
-import { contentLimitsOf, encodeBoundedContent, encodeContent, noopSpan, safeSpan, } from "./safety.js";
+import { contentLimitsOf, encodeBoundedContent, encodeContent, noopSpan, safeSpan, spanSource, } from "./safety.js";
 import { TRUNCATED_KEY, withTruncatedKeys } from "./privacy.js";
 import { MAX_BLOB_BYTES } from "./blobs.js";
 import { createHueTransport, exportBudgetMillis, HueExportError, } from "./transport.js";
@@ -662,7 +663,7 @@ export class HueClient {
      * Adds a `hue.file` event to the active (or given) span for a file the work read, received or
      * produced: `hue.file.sha256`, `hue.file.role`, `hue.file.media_type`, `hue.file.size` when known
      * and, when `captureContent` is true, `hue.file.name`. `data` is hashed and measured locally and
-     * never exported. The event is metadata, so it is recorded in both capture modes. An invalid
+     * uploaded only with `upload: true`. The event is metadata, so it is recorded in both capture modes. An invalid
      * record, or one without an active span, is omitted and counted, never thrown; an invalid name
      * alone is omitted and counted while the rest is recorded.
      */
@@ -680,26 +681,30 @@ export class HueClient {
                 throw new TypeError("Invalid media type");
             let sha256 = typeof file.sha256 === "string" ? file.sha256.toLowerCase() : file.sha256;
             let byteSize = file.byteSize;
+            let bytes;
             if (data !== undefined) {
-                const bytes = typeof data === "string"
-                    ? (() => {
-                        // Buffer.byteLength measures UTF-8 without allocating the copy that hashing would
-                        // otherwise require. Reject before Buffer.from/createHash can retain large input.
-                        if (data.length > MAX_FILE_DATA_BYTES ||
-                            Buffer.byteLength(data, "utf8") > MAX_FILE_DATA_BYTES)
-                            throw new RangeError("File data exceeds Hue's 25 MiB limit");
-                        return Buffer.from(data, "utf8");
-                    })()
-                    : data instanceof Uint8Array
-                        ? data.byteLength <= MAX_FILE_DATA_BYTES
-                            ? data
-                            : (() => {
+                bytes =
+                    typeof data === "string"
+                        ? (() => {
+                            // Buffer.byteLength measures UTF-8 without allocating the copy that hashing would
+                            // otherwise require. Reject before Buffer.from/createHash can retain large input.
+                            if (data.length > MAX_FILE_DATA_BYTES ||
+                                Buffer.byteLength(data, "utf8") > MAX_FILE_DATA_BYTES)
                                 throw new RangeError("File data exceeds Hue's 25 MiB limit");
-                            })()
-                        : undefined;
+                            return Buffer.from(data, "utf8");
+                        })()
+                        : data instanceof Uint8Array
+                            ? data.byteLength <= MAX_FILE_DATA_BYTES
+                                ? data
+                                : (() => {
+                                    throw new RangeError("File data exceeds Hue's 25 MiB limit");
+                                })()
+                            : undefined;
                 if (!bytes)
                     throw new TypeError("File data must be bytes or a string");
-                const digest = createHash("sha256").update(bytes).digest("hex");
+                const digest = bytes.byteLength > 0 && file.upload === true && this.transport.holdsValues()
+                    ? this.transport.digestMedia(bytes, span.spanContext().traceId).sha256
+                    : createHash("sha256").update(bytes).digest("hex");
                 // A caller-supplied digest or size must describe the same bytes.
                 if ((sha256 !== undefined && sha256 !== digest) ||
                     (byteSize !== undefined && byteSize !== bytes.byteLength))
@@ -719,12 +724,55 @@ export class HueClient {
             if (byteSize !== undefined)
                 attributes["hue.file.size"] = byteSize;
             if (this.captureContent && name !== undefined) {
-                if (isLabel(name))
+                if (isMediaName(name))
                     attributes["hue.file.name"] = name;
                 else
                     this.instrumentationFailed();
             }
-            span.addEvent("hue.file", attributes);
+            // Let OpenTelemetry use the span's wall-clock anchor, then keep this event's exact
+            // timestamp for upload admission. A dropped event cannot authorize an upload.
+            const source = spanSource(span);
+            const previous = this.fileEventTimes.get(source);
+            const after = (time) => {
+                if (previous &&
+                    (time[0] < previous[0] || (time[0] === previous[0] && time[1] <= previous[1]))) {
+                    time[0] = previous[0];
+                    time[1] = previous[1] + 1;
+                    if (time[1] === 1_000_000_000) {
+                        time[0]++;
+                        time[1] = 0;
+                    }
+                }
+                return time;
+            };
+            let eventTime;
+            if (Array.isArray(source.events)) {
+                const previousEvent = source.events.at(-1);
+                span.addEvent("hue.file", attributes);
+                const event = source.events.at(-1);
+                eventTime = event && event !== previousEvent ? after(event.time) : undefined;
+            }
+            else {
+                // A span that does not expose its events (an API-only wrapper in attach mode): stamp the
+                // event with the wall clock and keep that exact time for upload admission.
+                const now = Date.now();
+                eventTime = after([Math.floor(now / 1000), (now % 1000) * 1_000_000]);
+                span.addEvent("hue.file", attributes, [eventTime[0], eventTime[1]]);
+            }
+            if (eventTime)
+                this.fileEventTimes.set(source, eventTime);
+            if (file.upload === true && this.transport.offloadsValues()) {
+                if (!this.transport.stageMedia(span, bytes && eventTime
+                    ? {
+                        bytes,
+                        digest: { sha256, size: bytes.byteLength },
+                        contentType: mediaType,
+                        eventTime,
+                        ...(isMediaName(name) ? { name } : {}),
+                    }
+                    : undefined))
+                    this.instrumentationFailed();
+            }
         }
         catch {
             this.instrumentationFailed();
@@ -732,6 +780,8 @@ export class HueClient {
     }
     /** The keys of each span's content values that were cut to Hue's value cap, for `hue.truncated`. */
     truncatedKeys = new WeakMap();
+    /** Distinguishes requests whose helper events otherwise have identical metadata. */
+    fileEventTimes = new WeakMap();
     /** A content value's bounds: Hue's value cap as the receiver last advertised it. */
     contentLimits() {
         return contentLimitsOf(this.transport.receiverLimits().valueBytes);

package/dist/evals/files.js

@@ -30,6 +30,18 @@ export const outputContentTypes = [
     "image/png",
     "image/jpeg",
     "image/webp",
+    "image/gif",
+    "image/avif",
+    "audio/mpeg",
+    "audio/wav",
+    "audio/ogg",
+    "audio/webm",
+    "audio/mp4",
+    "audio/flac",
+    "audio/opus",
+    "audio/aac",
+    "video/mp4",
+    "video/webm",
 ];
 /** Thrown when the target's declared files cannot be used; recorded as the target's error. */
 export class OutputFileError extends Error {

package/dist/inline-files.d.ts

@@ -1,6 +1,6 @@
-/** Inline file content larger than this many UTF-8 bytes is exported as its digest instead. */
+/** Text media above this decoded byte limit is offloaded; binary media always uses a digest. */
 export declare const INLINE_FILE_LIMIT: number;
-/** The longest message text, in UTF-8 bytes, inspected for inline files. */
+/** The longest message text, in UTF-16 code units, inspected for inline files. */
 export declare const MAX_INLINE_FILE_TEXT: number;
 /** Message text one record inspects for inline files in all, in UTF-16 code units. */
 export declare const INLINE_FILE_TEXT_PER_RECORD: number;
@@ -20,38 +20,47 @@ export interface InlineFileBytes {
  * `data:` URL whose data does not decode is taken as UTF-8 too.
  */
 export declare function inlineFileBytes(content: string): InlineFileBytes;
-/** The key holding a part's inline content: GenAI `blob` parts and AI SDK 6 `file` parts. */
-export declare function contentKey(part: Record<string, unknown>): "content" | "data" | undefined;
-/**
- * Replaces inline files longer than {@link INLINE_FILE_LIMIT} in a recorded message attribute
- * with their SHA-256 and byte size, so a span that inlines a large file exports the file's
- * identity instead of being rejected for its size. The part keeps its other fields (`type`,
- * `mime_type`, `modality`, `mediaType`, …). Other attributes, shorter messages and values that
- * are not JSON are returned unchanged.
- */
-export declare function hashInlineFiles(key: string, value: unknown, 
-/** Counts the files replaced by their digest, when given. */
-count?: {
-    files: number;
-}): unknown;
-/** One inline file part found in a parsed message: the part object, the key holding its inline
- * content, that content, and the part's content as a JSON Pointer (RFC 6901) into the message. */
+/** A part and the exact leaf that contains its bytes. Nested provider metadata stays in place. */
 export interface InlineFilePart {
     part: Record<string, unknown>;
-    key: "content" | "data";
+    owner: Record<string, unknown>;
+    key: string;
     content: string;
     pointer: string;
+    partPointer: string;
+    contentType?: string;
+    name?: string;
+    base64?: boolean;
 }
-/**
- * The inline file parts of a parsed message whose content text is longer than
- * {@link INLINE_FILE_LIMIT} UTF-8 bytes, in document order: the caller decodes each and keeps the
- * ones whose file bytes are over the limit. The parts are the parsed value's own objects, so the
- * caller may replace their content in place.
- */
+export declare function isMediaName(value: unknown): value is string;
+/** Whether the receiver can preview these bytes as text. */
+export declare function isTextMediaType(contentType: string): boolean;
+/** Cheap shared prefilter before bounded parsing of span message attributes. */
+export declare function mayInlineFiles(key: string, value: unknown): boolean;
+/** A printable MIME type with optional parameters, accepted by the upload contract. */
+export declare function isMediaContentType(value: unknown): value is string;
+/** Detect the content pointer, MIME, name, and encoding contract of a provider media part. */
+export declare function contentPath(part: Record<string, unknown>, pointer?: string): InlineFilePart | undefined;
+/** Inline media in document order. The caller applies the decoded text threshold. */
 export declare function largeInlineFileParts(value: unknown): InlineFilePart[];
-/** The digest an inline file part is exported as when its bytes are not uploaded: the part's
- * other fields with the file's SHA-256 and byte size, as {@link hashInlineFiles} writes it. */
-export declare function digestPart(part: Record<string, unknown>, key: "content" | "data", digest: {
+export declare function mediaBytes(file: InlineFilePart): InlineFileBytes;
+export declare function mediaContentType(file: InlineFilePart, decoded: InlineFileBytes): string;
+export interface FileDigest {
     sha256: string;
     size: number;
-}): void;
+}
+/** Bounded payload identity memo, shared by admission and export, cleared at shutdown. */
+export declare class MediaDigestMemo {
+    private entries;
+    private units;
+    clear(): void;
+    digest(file: InlineFilePart, decoded?: InlineFileBytes, traceId?: string): FileDigest;
+    bytes(bytes: Uint8Array, traceId: string): FileDigest;
+}
+/** Digest placement removes only the leaf and adds identity to the provider part. */
+export declare function digestPart(file: InlineFilePart, digest: FileDigest): void;
+export declare function hashInlineFiles(key: string, value: unknown, count?: {
+    files: number;
+}, memo?: MediaDigestMemo, traceId?: string): unknown;
+/** Nested message attributes retain small media and digest larger media without upload state. */
+export declare function hashNestedInlineFiles(key: string, value: unknown): unknown;

package/dist/inline-files.js

@@ -1,12 +1,12 @@
 import { createHash } from "node:crypto";
 import { MAX_BODY_BYTES } from "./config.js";
-/** Inline file content larger than this many UTF-8 bytes is exported as its digest instead. */
+/** Text media above this decoded byte limit is offloaded; binary media always uses a digest. */
 export const INLINE_FILE_LIMIT = 64 * 1024;
-/** The longest message text, in UTF-8 bytes, inspected for inline files. */
+/** The longest message text, in UTF-16 code units, inspected for inline files. */
 export const MAX_INLINE_FILE_TEXT = 8 * MAX_BODY_BYTES;
 /** Message text one record inspects for inline files in all, in UTF-16 code units. */
 export const INLINE_FILE_TEXT_PER_RECORD = 2 * MAX_INLINE_FILE_TEXT;
-/** Message attributes whose JSON can inline files: GenAI blob parts and AI SDK 6 file parts. */
+/** The span message attributes whose JSON may contain inline media. */
 const messageKeys = new Set([
     "gen_ai.input.messages",
     "gen_ai.output.messages",
@@ -69,76 +69,200 @@ export function inlineFileBytes(content) {
         ...(mediaType ? { urlMediaType: mediaType } : {}),
     };
 }
-function fileBytes(content) {
-    return inlineFileBytes(content).bytes;
+const audioTypes = {
+    wav: "audio/wav",
+    mp3: "audio/mpeg",
+    flac: "audio/flac",
+    ogg: "audio/ogg",
+    opus: "audio/opus",
+    aac: "audio/aac",
+    m4a: "audio/mp4",
+    webm: "audio/webm",
+    pcm16: "audio/pcm",
+};
+const documentTypes = {
+    pdf: "application/pdf",
+    csv: "text/csv",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    html: "text/html",
+    txt: "text/plain",
+    md: "text/markdown",
+};
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
 }
-/** The key holding a part's inline content: GenAI `blob` parts and AI SDK 6 `file` parts. */
-export function contentKey(part) {
-    return part.type === "blob" ? "content" : part.type === "file" ? "data" : undefined;
+function string(value) {
+    return typeof value === "string" ? value : undefined;
 }
-function hashNode(value, state, depth) {
-    if (depth > 256)
-        throw new Error("Message exceeds the supported nesting limit");
-    if (Array.isArray(value))
-        return value.map((item) => hashNode(item, state, depth + 1));
-    if (value === null || typeof value !== "object")
-        return value;
-    const part = value;
-    const key = contentKey(part);
-    const inline = key === undefined ? undefined : part[key];
-    if (key !== undefined && typeof inline === "string") {
-        const bytes = fileBytes(inline);
-        if (bytes.byteLength > INLINE_FILE_LIMIT) {
-            const { [key]: _omitted, ...rest } = part;
-            state.changed = true;
-            state.files++;
-            return {
-                ...rest,
-                sha256: createHash("sha256").update(bytes).digest("hex"),
-                size: bytes.byteLength,
-            };
-        }
-    }
-    return Object.fromEntries(Object.entries(part).map(([name, item]) => [name, hashNode(item, state, depth + 1)]));
-}
-/**
- * Replaces inline files longer than {@link INLINE_FILE_LIMIT} in a recorded message attribute
- * with their SHA-256 and byte size, so a span that inlines a large file exports the file's
- * identity instead of being rejected for its size. The part keeps its other fields (`type`,
- * `mime_type`, `modality`, `mediaType`, …). Other attributes, shorter messages and values that
- * are not JSON are returned unchanged.
- */
-export function hashInlineFiles(key, value, 
-/** Counts the files replaced by their digest, when given. */
-count) {
-    if (!messageKeys.has(key) ||
-        typeof value !== "string" ||
-        Buffer.byteLength(value, "utf8") <= INLINE_FILE_LIMIT ||
-        Buffer.byteLength(value, "utf8") > MAX_INLINE_FILE_TEXT ||
-        !(value.includes('"blob"') || value.includes('"file"')))
-        return value;
-    try {
-        const parsed = JSON.parse(value);
-        const state = { changed: false, files: 0 };
-        const hashed = hashNode(parsed, state, 0);
-        if (count)
-            count.files += state.files;
-        return state.changed ? JSON.stringify(hashed) : value;
-    }
-    catch {
-        // Not JSON, or nested too deeply to inspect: export decides the value's fate as before.
-        return value;
-    }
+export function isMediaName(value) {
+    return (typeof value === "string" &&
+        value.trim().length > 0 &&
+        value.length <= 256 &&
+        value.isWellFormed() &&
+        !Array.from(value).some((character) => {
+            const code = character.charCodeAt(0);
+            return code < 32 || code === 127;
+        }));
 }
 function pointerSegment(segment) {
     return segment.replaceAll("~", "~0").replaceAll("/", "~1");
 }
-/**
- * The inline file parts of a parsed message whose content text is longer than
- * {@link INLINE_FILE_LIMIT} UTF-8 bytes, in document order: the caller decodes each and keeps the
- * ones whose file bytes are over the limit. The parts are the parsed value's own objects, so the
- * caller may replace their content in place.
- */
+/** Whether the receiver can preview these bytes as text. */
+export function isTextMediaType(contentType) {
+    const type = contentType.split(";", 1)[0].trim().toLowerCase();
+    return (type.startsWith("text/") ||
+        type === "application/json" ||
+        type.endsWith("+json") ||
+        type === "application/xml" ||
+        type.endsWith("+xml") ||
+        type === "application/yaml" ||
+        type === "application/x-yaml" ||
+        type === "application/javascript" ||
+        type === "application/x-javascript" ||
+        type === "application/x-www-form-urlencoded");
+}
+/** Cheap shared prefilter before bounded parsing of span message attributes. */
+export function mayInlineFiles(key, value) {
+    return (isMessageKey(key) &&
+        typeof value === "string" &&
+        [
+            "blob",
+            "file",
+            "image",
+            "document",
+            "media",
+            "inlineData",
+            "inline_data",
+            "input_audio",
+            "\\u",
+        ].some((marker) => value.includes(marker)));
+}
+/** A printable MIME type with optional parameters, accepted by the upload contract. */
+export function isMediaContentType(value) {
+    return (typeof value === "string" &&
+        value.length >= 3 &&
+        value.length <= 255 &&
+        /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9!#$&^_.+-]+(?: *;[ -~]*)?$/.test(value));
+}
+/** Detect the content pointer, MIME, name, and encoding contract of a provider media part. */
+export function contentPath(part, pointer = "") {
+    let owner = part;
+    let key;
+    let path = "";
+    let contentType = string(part.mime_type ?? part.mimeType ?? part.mediaType ?? part.media_type);
+    let name = string(part.name ?? part.filename);
+    let encoded = false;
+    let dataUrlOnly = false;
+    const source = object(part.source);
+    const inline = object(part.inlineData ?? part.inline_data);
+    const audio = object(part.input_audio);
+    const chatFile = object(part.file);
+    const bedrock = object(part.image ?? part.document);
+    if (inline) {
+        owner = inline;
+        key = "data";
+        path = part.inlineData ? "/inlineData" : "/inline_data";
+        contentType = string(inline.mimeType ?? inline.mime_type);
+        encoded = true;
+        name = undefined;
+    }
+    else if (audio && part.type === "input_audio") {
+        owner = audio;
+        key = "data";
+        path = "/input_audio";
+        contentType = audioTypes[string(audio.format) ?? ""];
+        encoded = true;
+        name = undefined;
+    }
+    else if (chatFile && part.type === "file") {
+        owner = chatFile;
+        key = "file_data";
+        path = "/file";
+        name = string(chatFile.filename);
+        dataUrlOnly = true;
+    }
+    else if (bedrock && object(bedrock.source)) {
+        const isImage = object(part.image) !== undefined;
+        owner = object(bedrock.source);
+        key = "bytes";
+        path = isImage ? "/image/source" : "/document/source";
+        const format = string(bedrock.format) ?? "";
+        contentType =
+            isImage && ["png", "jpeg", "gif", "webp"].includes(format)
+                ? `image/${format}`
+                : documentTypes[format];
+        name = isImage ? undefined : string(bedrock.name);
+        encoded = true;
+    }
+    else if (source && ["image", "document"].includes(string(part.type) ?? "")) {
+        if (source.type !== "base64")
+            return undefined;
+        owner = source;
+        key = "data";
+        path = "/source";
+        contentType = string(source.media_type);
+        name = string(part.title);
+        encoded = true;
+    }
+    else if (part.type === "image_url") {
+        const image = object(part.image_url);
+        owner = image ?? part;
+        key = image ? "url" : "image_url";
+        path = image ? "/image_url" : "";
+        contentType = undefined;
+        name = undefined;
+        dataUrlOnly = true;
+    }
+    else if (part.type === "input_image") {
+        key = "image_url";
+        contentType = undefined;
+        name = undefined;
+        dataUrlOnly = true;
+    }
+    else if (part.type === "input_file") {
+        key = "file_data";
+        contentType = undefined;
+        name = string(part.filename);
+        dataUrlOnly = true;
+    }
+    else if (part.type === "image") {
+        key = "image";
+        name = undefined;
+    }
+    else if (part.type === "media") {
+        key = "data";
+        name = undefined;
+    }
+    else
+        key = part.type === "blob" ? "content" : part.type === "file" ? "data" : undefined;
+    if (!key)
+        return undefined;
+    const content = owner[key];
+    if (typeof content !== "string" || /^(?:https?:|s3:|gs:|file:|blob:)/i.test(content))
+        return undefined;
+    if (dataUrlOnly && !content.startsWith("data:"))
+        return undefined;
+    // A declared base64 source must actually decode; malformed payloads stay as recorded.
+    if (encoded && !(content.length % 4 === 0 && base64.test(content)))
+        return undefined;
+    return {
+        part,
+        owner,
+        key,
+        content,
+        pointer: `${pointer}${path}/${key}`,
+        partPointer: pointer,
+        ...(contentType ? { contentType } : {}),
+        ...(isMediaName(name) ? { name } : {}),
+        ...(encoded ? { base64: true } : {}),
+    };
+}
+/** Inline media in document order. The caller applies the decoded text threshold. */
 export function largeInlineFileParts(value) {
     const found = [];
     const visit = (node, pointer, depth) => {
@@ -148,17 +272,12 @@ export function largeInlineFileParts(value) {
             node.forEach((item, index) => visit(item, `${pointer}/${index}`, depth + 1));
             return;
         }
-        if (node === null || typeof node !== "object")
+        const part = object(node);
+        if (!part)
             return;
-        const part = node;
-        const key = contentKey(part);
-        const inline = key === undefined ? undefined : part[key];
-        // Decoding only shrinks the text, so text of at most the limit holds no file over it.
-        if (key !== undefined &&
-            typeof inline === "string" &&
-            inline.length * 3 > INLINE_FILE_LIMIT &&
-            Buffer.byteLength(inline, "utf8") > INLINE_FILE_LIMIT) {
-            found.push({ part, key, content: inline, pointer: `${pointer}/${key}` });
+        const file = contentPath(part, pointer);
+        if (file) {
+            found.push(file);
             return;
         }
         for (const [name, item] of Object.entries(part))
@@ -167,10 +286,96 @@ export function largeInlineFileParts(value) {
     visit(value, "", 0);
     return found;
 }
-/** The digest an inline file part is exported as when its bytes are not uploaded: the part's
- * other fields with the file's SHA-256 and byte size, as {@link hashInlineFiles} writes it. */
-export function digestPart(part, key, digest) {
-    delete part[key];
-    part.sha256 = digest.sha256;
-    part.size = digest.size;
+export function mediaBytes(file) {
+    if (file.base64)
+        return { bytes: Buffer.from(file.content, "base64"), decoded: true };
+    if (isMediaContentType(file.contentType) &&
+        isTextMediaType(file.contentType) &&
+        !file.content.startsWith("data:"))
+        return { bytes: Buffer.from(file.content, "utf8"), decoded: false };
+    return inlineFileBytes(file.content);
+}
+export function mediaContentType(file, decoded) {
+    return ((isMediaContentType(file.contentType) ? file.contentType : undefined) ??
+        (isMediaContentType(decoded.urlMediaType) ? decoded.urlMediaType : undefined) ??
+        (decoded.decoded ? "application/octet-stream" : "text/plain; charset=utf-8"));
+}
+/** Bounded payload identity memo, shared by admission and export, cleared at shutdown. */
+export class MediaDigestMemo {
+    entries = new Map();
+    units = 0;
+    clear() {
+        this.entries.clear();
+        this.units = 0;
+    }
+    digest(file, decoded, traceId = "") {
+        return this.bytes((decoded ?? mediaBytes(file)).bytes, traceId);
+    }
+    bytes(bytes, traceId) {
+        const digest = {
+            sha256: createHash("sha256").update(bytes).digest("hex"),
+            size: bytes.byteLength,
+        };
+        const key = `${traceId}:${digest.sha256}`;
+        const known = this.entries.get(key);
+        if (known)
+            return known;
+        const limit = 32 * 1024 * 1024;
+        if (key.length <= limit) {
+            while (this.entries.size >= 4096 || this.units + key.length > limit) {
+                const first = this.entries.keys().next().value;
+                this.units -= first.length;
+                this.entries.delete(first);
+            }
+            this.entries.set(key, digest);
+            this.units += key.length;
+        }
+        return digest;
+    }
+}
+/** Digest placement removes only the leaf and adds identity to the provider part. */
+export function digestPart(file, digest) {
+    delete file.owner[file.key];
+    file.part.sha256 = digest.sha256;
+    file.part.size = digest.size;
+}
+export function hashInlineFiles(key, value, count, memo, traceId = "") {
+    return hashFiles(key, value, false, count, memo, traceId);
+}
+/** Nested message attributes retain small media and digest larger media without upload state. */
+export function hashNestedInlineFiles(key, value) {
+    return hashFiles(key, value, true);
+}
+function hashFiles(key, value, nested, count, memo, traceId = "") {
+    if (typeof value !== "string" ||
+        !mayInlineFiles(key, value) ||
+        value.length > MAX_INLINE_FILE_TEXT)
+        return value;
+    try {
+        const parsed = JSON.parse(value);
+        const files = largeInlineFileParts(parsed);
+        let changed = false;
+        for (const file of files) {
+            const decoded = mediaBytes(file);
+            if (!decoded.bytes.byteLength)
+                continue;
+            if ((nested || isTextMediaType(mediaContentType(file, decoded))) &&
+                decoded.bytes.byteLength <= INLINE_FILE_LIMIT)
+                continue;
+            const digest = memo
+                ? memo.digest(file, decoded, traceId)
+                : {
+                    sha256: createHash("sha256").update(decoded.bytes).digest("hex"),
+                    size: decoded.bytes.byteLength,
+                };
+            digestPart(file, digest);
+            changed = true;
+            if (count)
+                count.files++;
+        }
+        return changed ? JSON.stringify(parsed) : value;
+    }
+    catch {
+        return value;
+    }
 }

package/dist/privacy.d.ts

@@ -33,7 +33,7 @@ export interface RedactionLimits {
     valueBytes?: number;
     /** The record's value strings cut when it was queued. */
     cut?: ReadonlySet<string>;
-    /** The span's own messages whose large inline files were shrunk to their digest when it was
+    /** The span's own messages whose inline media were shrunk to their digest when it was
      * queued, with how many files each: reported as not uploaded when values may be. */
     digested?: ReadonlyMap<string, DigestedMessage> | undefined;
     /**