@hue-run/sdk 0.18.0 → 0.18.2

package/dist/client.d.ts

@@ -166,10 +166,15 @@ export declare class HueClient {
     /**
      * Adds a `hue.file` event to the active (or given) span for a file the work read, received or
      * produced: `hue.file.sha256`, `hue.file.role`, `hue.file.media_type`, `hue.file.size` when known
-     * and, when `captureContent` is true, `hue.file.name`. `data` is hashed and measured locally and
-     * uploaded only with `upload: true`. The event is metadata, so it is recorded in both capture modes. An invalid
-     * record, or one without an active span, is omitted and counted, never thrown; an invalid name
-     * alone is omitted and counted while the rest is recorded.
+     * and, when `captureContent` is true, `hue.file.name`. `data` or the file at `path` is hashed and
+     * measured locally and uploaded only with `upload: true`: `data` and a file up to 25 MiB are
+     * held in memory until then, while a larger regular file, up to Hue's 1 GB upload limit, is
+     * hashed a slice at a time and read again from disk when it is uploaded, and is uploaded only if
+     * it still has the size and SHA-256 it was recorded with; a `path` that is no regular file, such
+     * as a named pipe, is refused without waiting on it. The event is metadata, so it is
+     * recorded in both capture modes. An invalid record, or one without an active span, is omitted
+     * and counted, never thrown; an invalid name alone is omitted and counted while the rest is
+     * recorded.
      */
     recordFile(file: FileRecord, explicitContext?: Context): void;
     /** The keys of each span's content values that were cut to Hue's value cap, for `hue.truncated`. */

package/dist/client.js

@@ -13,8 +13,8 @@ import { hostedServerAddresses, hostedToolActivity, hostedToolProvider, provider
 import { toolCatalogSummary } from "./tool-definitions.js";
 import { contentLimitsOf, encodeBoundedContent, encodeContent, noopSpan, safeSpan, spanSource, } from "./safety.js";
 import { TRUNCATED_KEY, withTruncatedKeys } from "./privacy.js";
-import { countFallback, MAX_BLOB_BYTES, newTally } from "./blobs.js";
-import { attachmentPart, attachmentState, holdsAttachment, MAX_ATTACHMENT_DEPTH, } from "./attachment.js";
+import { countFallback, MAX_BLOB_BYTES, newTally, sizeOf } from "./blobs.js";
+import { attachmentPart, attachmentState, fileSource, holdsAttachment, MAX_ATTACHMENT_DEPTH, readPath, } from "./attachment.js";
 import { createHueTransport, exportBudgetMillis, HueExportError, } from "./transport.js";
 import { verifyTrace } from "./receipt.js";
 import { sdkVersion } from "./version.js";
@@ -611,21 +611,22 @@ export class HueClient {
         const files = [];
         const tally = newTally();
         for (const { state, part, depth } of placed) {
-            if (!part || !state.bytes || !state.sha256) {
+            if (!part || state.size === undefined || !state.sha256) {
                 this.instrumentationFailed(signal);
                 continue;
             }
             if (state.invalidName && captureContent)
                 this.instrumentationFailed(signal);
-            if (!this.transport.offloadsValues() || !state.bytes.byteLength)
+            if (!this.transport.offloadsValues() || !state.size)
                 continue;
             if (cut || depth > MAX_ATTACHMENT_DEPTH) {
                 countFallback(tally, "budget", traceId);
                 continue;
             }
             files.push({
-                bytes: state.bytes,
-                digest: { sha256: state.sha256, size: state.bytes.byteLength },
+                // A file given by path over 25 MiB is read again from disk when it is uploaded.
+                bytes: state.file ? fileSource(state.file) : state.bytes,
+                digest: { sha256: state.sha256, size: state.size },
                 contentType: state.contentType,
                 ...(state.name === undefined ? {} : { name: state.name }),
             });
@@ -788,10 +789,15 @@ export class HueClient {
     /**
      * Adds a `hue.file` event to the active (or given) span for a file the work read, received or
      * produced: `hue.file.sha256`, `hue.file.role`, `hue.file.media_type`, `hue.file.size` when known
-     * and, when `captureContent` is true, `hue.file.name`. `data` is hashed and measured locally and
-     * uploaded only with `upload: true`. The event is metadata, so it is recorded in both capture modes. An invalid
-     * record, or one without an active span, is omitted and counted, never thrown; an invalid name
-     * alone is omitted and counted while the rest is recorded.
+     * and, when `captureContent` is true, `hue.file.name`. `data` or the file at `path` is hashed and
+     * measured locally and uploaded only with `upload: true`: `data` and a file up to 25 MiB are
+     * held in memory until then, while a larger regular file, up to Hue's 1 GB upload limit, is
+     * hashed a slice at a time and read again from disk when it is uploaded, and is uploaded only if
+     * it still has the size and SHA-256 it was recorded with; a `path` that is no regular file, such
+     * as a named pipe, is refused without waiting on it. The event is metadata, so it is
+     * recorded in both capture modes. An invalid record, or one without an active span, is omitted
+     * and counted, never thrown; an invalid name alone is omitted and counted while the rest is
+     * recorded.
      */
     recordFile(file, explicitContext) {
         if (!this.enabled || this.closed)
@@ -800,7 +806,7 @@ export class HueClient {
             const span = trace.getSpan(explicitContext ?? this.storage.getStore()?.context ?? context.active());
             if (!span?.isRecording())
                 throw new Error("File records require an active span");
-            const { role, mediaType, data, name } = file;
+            const { role, mediaType, data, name, path } = file;
             if (role !== "input" && role !== "attachment" && role !== "output")
                 throw new TypeError("Invalid file role");
             if (!isLabel(mediaType))
@@ -808,7 +814,31 @@ export class HueClient {
             let sha256 = typeof file.sha256 === "string" ? file.sha256.toLowerCase() : file.sha256;
             let byteSize = file.byteSize;
             let bytes;
-            if (data !== undefined) {
+            // A file given by path over 25 MiB: hashed now and read again from disk when it is uploaded.
+            let onDisk;
+            let given = data;
+            if (path !== undefined) {
+                if (data !== undefined)
+                    throw new TypeError("A file takes data or a path, not both");
+                if (typeof path !== "string" || !path)
+                    throw new TypeError("Invalid file path");
+                const read = readPath(path);
+                if (!read)
+                    throw new RangeError("File must be a regular file within Hue's 1 GB upload limit");
+                if ("bytes" in read)
+                    given = read.bytes;
+                else {
+                    onDisk = read.file;
+                    // A caller-supplied digest or size must describe the same bytes.
+                    if ((sha256 !== undefined && sha256 !== onDisk.sha256) ||
+                        (byteSize !== undefined && byteSize !== onDisk.size))
+                        throw new TypeError("File digest or size does not match its data");
+                    sha256 = onDisk.sha256;
+                    byteSize = onDisk.size;
+                }
+            }
+            if (given !== undefined) {
+                const data = given;
                 bytes =
                     typeof data === "string"
                         ? (() => {
@@ -888,10 +918,11 @@ export class HueClient {
             if (eventTime)
                 this.fileEventTimes.set(source, eventTime);
             if (file.upload === true && this.transport.offloadsValues()) {
-                if (!this.transport.stageMedia(span, bytes && eventTime
+                const upload = bytes ?? (onDisk ? fileSource(onDisk) : undefined);
+                if (!this.transport.stageMedia(span, upload && eventTime
                     ? {
-                        bytes,
-                        digest: { sha256, size: bytes.byteLength },
+                        bytes: upload,
+                        digest: { sha256, size: sizeOf(upload) },
                         contentType: mediaType,
                         eventTime,
                         ...(isMediaName(name) ? { name } : {}),

package/dist/evals/client.d.ts

@@ -79,6 +79,7 @@ export declare class EvaluationClient {
     }): Promise<Uint8Array>;
     /** Stage bytes at the storage capability Hue issued. The Hue key is never sent to storage. */
     uploadArtifactBytes(upload: ArtifactUpload, bytes: Uint8Array, contentType: string): Promise<void>;
+    private putArtifact;
     private page;
     private registryPage;
     /** Reads the current project to confirm the key and origin. */
@@ -106,10 +107,14 @@ export declare class EvaluationClient {
      * `files` given as bytes or a path is checked against the artifact policy and uploaded as a
      * verified artifact first, under a key derived from the version, the case's `externalKey`, the
      * role and the bytes, so sending the same case again reuses the artifact. Every file and the
-     * case itself are checked before the first upload.
+     * case itself are checked before the first upload. A file given by `path` is hashed a slice at
+     * a time when it is checked and read again when it is uploaded, one file at a time, so no more
+     * than one file is held in memory; only bytes that match the checked SHA-256 are sent.
      *
      * @throws TypeError or RangeError for `files` outside the artifact policy, or a case Hue would
-     * refuse for its fields or size, before any request.
+     * refuse for its fields or size, before any request. TypeError when a file given by `path`
+     * changed after it was checked, or can no longer be read, before any of its bytes are sent: it
+     * is not staged and the case is not written.
      */
     addCase(id: string, input: CaseWrite): Promise<{
         /** The stored case. */

package/dist/evals/client.js

@@ -402,17 +402,29 @@ export class EvaluationClient {
         }
     }
     /** Stage bytes at the storage capability Hue issued. The Hue key is never sent to storage. */
-    async uploadArtifactBytes(upload, bytes, contentType) {
+    uploadArtifactBytes(upload, bytes, contentType) {
+        return this.putArtifact(upload, contentType, bytes);
+    }
+    /** @internal Stage `byteSize` bytes read from `body` a slice at a time, without the copy a
+     * byte body is given; the request declares their length, as it does for bytes. */
+    uploadArtifactStream(upload, body, byteSize, contentType) {
+        return this.putArtifact(upload, contentType, body, byteSize);
+    }
+    async putArtifact(upload, contentType, body, byteSize) {
         const uploadUrl = signedUploadUrl(upload.uploadUrl);
         if (upload.method !== "PUT")
             throw new HueApiError();
         const headers = signedUploadHeaders(upload.headers, contentType);
+        // Storage refuses a body of unknown length, which a stream would otherwise be sent as.
+        if (byteSize !== undefined)
+            headers["content-length"] = String(byteSize);
         let response;
         try {
             response = await fetch(uploadUrl, {
                 method: "PUT",
                 headers,
-                body: bytes,
+                body,
+                ...(byteSize !== undefined ? { duplex: "half" } : {}),
                 redirect: "error",
                 signal: AbortSignal.timeout(Math.max(this.timeoutMillis, 120_000)),
             });
@@ -480,10 +492,14 @@ export class EvaluationClient {
      * `files` given as bytes or a path is checked against the artifact policy and uploaded as a
      * verified artifact first, under a key derived from the version, the case's `externalKey`, the
      * role and the bytes, so sending the same case again reuses the artifact. Every file and the
-     * case itself are checked before the first upload.
+     * case itself are checked before the first upload. A file given by `path` is hashed a slice at
+     * a time when it is checked and read again when it is uploaded, one file at a time, so no more
+     * than one file is held in memory; only bytes that match the checked SHA-256 are sent.
      *
      * @throws TypeError or RangeError for `files` outside the artifact policy, or a case Hue would
-     * refuse for its fields or size, before any request.
+     * refuse for its fields or size, before any request. TypeError when a file given by `path`
+     * changed after it was checked, or can no longer be read, before any of its bytes are sent: it
+     * is not staged and the case is not written.
      */
     async addCase(id, input) {
         // The canonical spelling: the reservation keys of uploaded files name the version.

package/dist/evals/files.js

@@ -426,15 +426,22 @@ export async function uploadOutputFiles(client, executionId, files, save, timing
 }
 /** Reserve, stage and verify one artifact; its ID once Hue verified it. Replaying the key settles
  * on the same artifact, including one Hue finished verifying after an earlier attempt stopped. */
-async function publishArtifact(client, declared, bytes, label, timing) {
+async function publishArtifact(client, declared, body, label, timing) {
     const reserved = await client.reserveArtifact(declared);
     let state = reserved.state;
     if (state !== "ready") {
         // A verification already running holds the uploaded bytes; Hue refuses another upload then.
         if (reserved.copyState !== "acknowledged" && state !== "verifying") {
+            // A checked file is read again, whole, only now and only if it still has the bytes its
+            // check hashed: a file that changed sends nothing.
+            const bytes = body instanceof Uint8Array ? body : await checkedBytes(body);
             const upload = await client.requestArtifactUpload(reserved.id);
             try {
-                await client.uploadArtifactBytes(upload, bytes, declared.contentType);
+                if (body instanceof Uint8Array)
+                    await client.uploadArtifactBytes(upload, bytes, declared.contentType);
+                // Sent from the write's own buffer a slice at a time, never copied whole.
+                else
+                    await client.uploadArtifactStream(upload, slicesOf(bytes), bytes.byteLength, declared.contentType);
             }
             catch {
                 // A lost staging acknowledgement or an immutable object already present can only be
@@ -447,6 +454,59 @@ async function publishArtifact(client, declared, bytes, label, timing) {
         throw new Error(`${label} was not verified by Hue (${state})`);
     return reserved.id;
 }
+/** How much of a case file given by path its check reads at once, to hash it. */
+const CASE_FILE_SLICE = 1024 * 1024;
+/** Bytes as a stream of 1 MiB views of them, made as the request reads them. */
+function slicesOf(bytes) {
+    let offset = 0;
+    return new ReadableStream({
+        pull(controller) {
+            if (offset >= bytes.byteLength)
+                return controller.close();
+            const end = Math.min(bytes.byteLength, offset + CASE_FILE_SLICE);
+            controller.enqueue(bytes.subarray(offset, end));
+            offset = end;
+        },
+    }, { highWaterMark: 0 });
+}
+/**
+ * The bytes of a checked case file, read whole when it is uploaded: case files are uploaded one
+ * at a time, into one buffer the write reuses, so no more than one is held in memory. Only bytes
+ * with the checked size and SHA-256 are returned, so the bytes sent are the bytes the check
+ * hashed; a file that changed after its check, or can no longer be read, is refused with a
+ * `TypeError` before anything is sent. The bytes are valid until the next file is read.
+ */
+async function checkedBytes(file) {
+    const changed = () => new TypeError(`${file.label} changed after it was checked`);
+    const unreadable = (error) => new TypeError(`${file.label} could not be read`, { cause: error });
+    const handle = await open(file.path, "r").catch((error) => {
+        throw unreadable(error);
+    });
+    try {
+        const read = (buffer, offset) => handle
+            .read(buffer, offset, buffer.byteLength - offset, null)
+            .then(({ bytesRead }) => bytesRead)
+            .catch((error) => {
+            throw unreadable(error);
+        });
+        // Never more than its checked size and one byte, the byte that shows it grew.
+        if ((file.scratch.buffer?.byteLength ?? 0) < file.byteSize)
+            file.scratch.buffer = Buffer.allocUnsafe(file.byteSize);
+        const bytes = file.scratch.buffer.subarray(0, file.byteSize);
+        for (let offset = 0; offset < bytes.byteLength;) {
+            const bytesRead = await read(bytes, offset);
+            if (!bytesRead)
+                throw changed();
+            offset += bytesRead;
+        }
+        if ((await read(Buffer.alloc(1), 0)) || sha256(bytes) !== file.sha256)
+            throw changed();
+        return bytes;
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}
 /** Roles a pinned case input can carry. */
 const caseFileRoles = [
     ...targetFileRoles,
@@ -466,8 +526,9 @@ function caseFileName(name) {
         throw new TypeError("A case file needs a well-formed filename of 1–255 UTF-16 code units without path separators or control characters");
     return name;
 }
-/** The bytes of a case file given by path: a regular file within the size limit, read once. */
-async function caseFileBytes(path, label) {
+/** A case file given by path, checked: a regular file within the size limit, hashed a slice at a
+ * time so it is never held whole. Its emptiness is the caller's check, as for bytes. */
+async function checkedFile(path, label, scratch) {
     if (typeof path !== "string" || !path)
         throw new TypeError(`${label} needs bytes or a path`);
     // A path with no file behind it, or one that cannot be read, is refused as any invalid file.
@@ -479,9 +540,32 @@ async function caseFileBytes(path, label) {
         throw new TypeError(`${label} is not a regular file`);
     if (info.size > outputFileLimits.bytes)
         throw new RangeError(`${label} exceeds 25 MiB`);
-    return readFile(path).catch((error) => {
+    const handle = await open(path, "r").catch((error) => {
         throw unreadable(error);
     });
+    try {
+        const hash = createHash("sha256");
+        const slice = Buffer.allocUnsafe(CASE_FILE_SLICE);
+        let byteSize = 0;
+        for (;;) {
+            const { bytesRead } = await handle
+                .read(slice, 0, slice.byteLength, null)
+                .catch((error) => {
+                throw unreadable(error);
+            });
+            if (!bytesRead)
+                break;
+            byteSize += bytesRead;
+            // A file that grew past the limit since its size was read is refused, not read whole.
+            if (byteSize > outputFileLimits.bytes)
+                throw new RangeError(`${label} exceeds 25 MiB`);
+            hash.update(slice.subarray(0, bytesRead));
+        }
+        return { path, label, byteSize, sha256: hash.digest("hex"), scratch };
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
 }
 /** A stand-in for an artifact a case file is uploaded as, the length of a real ID. */
 const STAND_IN_ID = "00000000-0000-4000-8000-000000000000";
@@ -502,6 +586,7 @@ export async function caseFileReferences(client, versionId, input, beforeUpload
         throw new RangeError(`A case pins at most ${MAX_CASE_FILES} files`);
     const prepared = [];
     const seen = new Set();
+    const scratch = {};
     for (const [index, file] of files.entries()) {
         const label = `Case file ${index + 1}`;
         if (!file || typeof file !== "object")
@@ -530,18 +615,21 @@ export async function caseFileReferences(client, versionId, input, beforeUpload
                 throw new TypeError(`${label} names bytes and a path; give one`);
             if (file.bytes !== undefined && !(file.bytes instanceof Uint8Array))
                 throw new TypeError(`${label} bytes must be a Uint8Array`);
-            const bytes = file.bytes ?? (await caseFileBytes(file.path, label));
-            if (!bytes.byteLength)
+            // Bytes are kept as given; a path is kept as its size and digest, and read again to upload.
+            const body = file.bytes ?? (await checkedFile(file.path, label, scratch));
+            const byteSize = body instanceof Uint8Array ? body.byteLength : body.byteSize;
+            if (!byteSize)
                 throw new RangeError(`${label} is empty`);
-            if (bytes.byteLength > outputFileLimits.bytes)
+            if (byteSize > outputFileLimits.bytes)
                 throw new RangeError(`${label} exceeds 25 MiB`);
-            const digest = sha256(bytes);
+            const digest = body instanceof Uint8Array ? sha256(body) : body.sha256;
             prepared.push({
                 role: file.role,
                 filename,
                 contentType: file.contentType,
-                bytes,
+                byteSize,
                 sha256: digest,
+                body,
             });
             identity = `file:${digest}:${file.contentType}:${filename}`;
         }
@@ -574,9 +662,9 @@ export async function caseFileReferences(client, versionId, input, beforeUpload
             idempotencyKey: `hue-sdk:case:${versionId}:${caseKey}:${item.role}:${item.sha256}:${sha256(Buffer.from(item.filename)).slice(0, 16)}:${sha256(Buffer.from(item.contentType)).slice(0, 16)}`,
             filename: item.filename,
             contentType: item.contentType,
-            byteSize: item.bytes.byteLength,
+            byteSize: item.byteSize,
             sha256: item.sha256,
-        }, item.bytes, `Case file ${item.filename}`, timing);
+        }, item.body, `Case file ${item.filename}`, timing);
         pin({ artifactId, role: item.role });
     }
     return references;

package/dist/evals/media.d.ts

@@ -38,8 +38,12 @@ export declare class MediaFetchError extends Error {
     /** HTTP status of the answer that failed, when there was one. */
     status?: number | undefined, 
     /** Seconds Hue asked the caller to wait, on `unavailable`, when it said. */
-    retryAfterSeconds?: number | undefined, options?: {
+    retryAfterSeconds?: number | undefined, 
+    /** `cause`, the error behind a failure; `snapshot`, set when a snapshot's copy was read, so a
+     * `forbidden` message names the Read and write key it needs. */
+    options?: {
         cause?: unknown;
+        snapshot?: boolean;
     });
 }
 /** One recorded file, downloaded and checked against its digest. */

package/dist/evals/media.js

@@ -11,6 +11,8 @@ const messages = {
     digest_mismatch: "The downloaded bytes do not match the requested SHA-256",
     failed: "The media request failed",
 };
+/** A snapshot's copies take only a Read and write key, where a trace's files take a Read key too. */
+const snapshotForbidden = "The key cannot read a snapshot's files; use a Read and write key";
 /** Thrown by {@link MediaClient.fetch}. The message is fixed and never includes response text. */
 export class MediaFetchError extends Error {
     reason;
@@ -22,8 +24,16 @@ export class MediaFetchError extends Error {
     /** HTTP status of the answer that failed, when there was one. */
     status, 
     /** Seconds Hue asked the caller to wait, on `unavailable`, when it said. */
-    retryAfterSeconds, options) {
-        super(reason === "failed" && status ? `${messages.failed} (HTTP ${status})` : messages[reason], options);
+    retryAfterSeconds, 
+    /** `cause`, the error behind a failure; `snapshot`, set when a snapshot's copy was read, so a
+     * `forbidden` message names the Read and write key it needs. */
+    options) {
+        const { snapshot, ...rest } = options ?? {};
+        super(reason === "failed" && status
+            ? `${messages.failed} (HTTP ${status})`
+            : reason === "forbidden" && snapshot
+                ? snapshotForbidden
+                : messages[reason], rest);
         this.reason = reason;
         this.status = status;
         this.retryAfterSeconds = retryAfterSeconds;
@@ -354,7 +364,9 @@ export class MediaClient {
             }
             if (status === 401 || status === 403) {
                 await response.body?.cancel().catch(() => undefined);
-                throw new MediaFetchError("forbidden", status);
+                throw new MediaFetchError("forbidden", status, undefined, {
+                    snapshot: path.startsWith("/trace-snapshots/"),
+                });
             }
             if (!response.ok) {
                 await response.body?.cancel().catch(() => undefined);

package/dist/evals/types.d.ts

@@ -186,9 +186,10 @@ export interface CaseFileReference {
 }
 /**
  * A pinned input file for {@link CaseWrite.files}: a {@link CaseFileReference}, or a file the
- * client uploads as a verified artifact, from `bytes` or read once from `path`. An uploaded file
- * must have one of `outputContentTypes`, a well-formed name of 1–255 UTF-16 code units without
- * path separators or control characters, and 1 byte to 25 MiB.
+ * client uploads as a verified artifact, from `bytes` or read from `path`: hashed a slice at a
+ * time when the case is checked, then read again as it is uploaded, one file at a time. An
+ * uploaded file must have one of `outputContentTypes`, a well-formed name of 1–255 UTF-16 code
+ * units without path separators or control characters, and 1 byte to 25 MiB.
  */
 export type CaseFileWrite = (CaseFileReference & {
     /** Not set on an artifact reference: the artifact keeps its own name. */

package/dist/inline-files.d.ts

@@ -27,6 +27,9 @@ export interface InlineFileBytes {
     bytes: Buffer;
     decoded: boolean;
     urlMediaType?: string;
+    /** The bytes were decoded from text that reads as base64 by its alphabet alone, not from a
+     * `data:` URL or a field its convention declares base64. */
+    bareBase64?: boolean;
 }
 /**
  * The bytes an inline file part carries, the file's own bytes whatever its media type: a `data:`
@@ -134,14 +137,21 @@ export declare function placedMediaText(media: MediaValue): string;
 /** Each JSON-encoded string a placed file sits in, written again, innermost first: the string as
  * recorded with only its placed files changed. */
 export declare function reencodeMedia(media: MediaValue): void;
-/** Whether a found file has bytes to place: nonempty, and a whole string's `data:` URL decodes. */
-export declare function placeable(file: InlineFilePart, decoded: InlineFileBytes): boolean;
+/** Whether a found file has bytes to place: nonempty (`size` bytes), and a whole string's `data:`
+ * URL decodes. */
+export declare function placeable(file: InlineFilePart, decoded: Pick<InlineFileBytes, "decoded">, size: number): boolean;
 /** Whether an uploaded file keeps a 16 KiB prefix of its content in place (text media in a
- * provider part, whose entry names the content) rather than its digest. A whole string and a
- * file inside a JSON-encoded string always take the digest form. */
-export declare function keepsPrefix(file: InlineFilePart, textual: boolean): boolean;
+ * provider part, whose entry names the content) rather than its digest. A whole string, a file
+ * inside a JSON-encoded string, and a text file a part holds as bare base64 (a GenAI `blob`,
+ * Vertex `media` or AI SDK part, whose content is not the text itself) take the digest form. */
+export declare function keepsPrefix(file: InlineFilePart, textual: boolean, decoded: Pick<InlineFileBytes, "bareBase64">): boolean;
+/** A file's bytes: a field its convention declares base64 decoded, any other content read as
+ * Hue's reader reads it, whatever the part's media type (`inlineFileBytes`): a `data:` URL by its
+ * own encoding, text that reads as base64 decoded (what the GenAI conventions, and
+ * `client.media.resolve`, write in a `blob` or `media` part for every media type), anything else
+ * as its UTF-8. */
 export declare function mediaBytes(file: InlineFilePart): InlineFileBytes;
-export declare function mediaContentType(file: InlineFilePart, decoded: InlineFileBytes): string;
+export declare function mediaContentType(file: InlineFilePart, decoded: Pick<InlineFileBytes, "decoded" | "urlMediaType">): string;
 export interface FileDigest {
     sha256: string;
     size: number;

package/dist/inline-files.js

@@ -140,6 +140,7 @@ export function inlineFileBytes(content) {
         bytes: decoded ?? Buffer.from(content, "utf8"),
         decoded: decoded !== undefined,
         ...(mediaType ? { urlMediaType: mediaType } : {}),
+        ...(decoded !== undefined && !url ? { bareBase64: true } : {}),
     };
 }
 const audioTypes = {
@@ -706,23 +707,26 @@ export function reencodeMedia(media) {
         });
     }
 }
-/** Whether a found file has bytes to place: nonempty, and a whole string's `data:` URL decodes. */
-export function placeable(file, decoded) {
-    return decoded.bytes.byteLength > 0 && (!file.whole || decoded.decoded);
+/** Whether a found file has bytes to place: nonempty (`size` bytes), and a whole string's `data:`
+ * URL decodes. */
+export function placeable(file, decoded, size) {
+    return size > 0 && (!file.whole || decoded.decoded);
 }
 /** Whether an uploaded file keeps a 16 KiB prefix of its content in place (text media in a
- * provider part, whose entry names the content) rather than its digest. A whole string and a
- * file inside a JSON-encoded string always take the digest form. */
-export function keepsPrefix(file, textual) {
-    return textual && !file.whole && !file.encoded?.length;
-}
+ * provider part, whose entry names the content) rather than its digest. A whole string, a file
+ * inside a JSON-encoded string, and a text file a part holds as bare base64 (a GenAI `blob`,
+ * Vertex `media` or AI SDK part, whose content is not the text itself) take the digest form. */
+export function keepsPrefix(file, textual, decoded) {
+    return textual && !file.whole && !file.encoded?.length && !decoded.bareBase64;
+}
+/** A file's bytes: a field its convention declares base64 decoded, any other content read as
+ * Hue's reader reads it, whatever the part's media type (`inlineFileBytes`): a `data:` URL by its
+ * own encoding, text that reads as base64 decoded (what the GenAI conventions, and
+ * `client.media.resolve`, write in a `blob` or `media` part for every media type), anything else
+ * as its UTF-8. */
 export function mediaBytes(file) {
     if (file.base64)
         return { bytes: Buffer.from(file.content, "base64"), decoded: true };
-    if (isMediaContentType(file.contentType) &&
-        isTextMediaType(file.contentType) &&
-        !file.content.startsWith("data:"))
-        return { bytes: Buffer.from(file.content, "utf8"), decoded: false };
     return inlineFileBytes(file.content);
 }
 export function mediaContentType(file, decoded) {
@@ -838,7 +842,7 @@ export function digestMedia(media, nested, count, memo, traceId = "") {
     let changed = false;
     for (const file of media.files) {
         const decoded = mediaBytes(file);
-        if (!placeable(file, decoded))
+        if (!placeable(file, decoded, decoded.bytes.byteLength))
             continue;
         if ((nested || isTextMediaType(mediaContentType(file, decoded))) &&
             decoded.bytes.byteLength <= INLINE_FILE_LIMIT)
@@ -872,7 +876,7 @@ export function digestFormBytes(value) {
             continue;
         inspected += units;
         const decoded = mediaBytes(file);
-        if (!placeable(file, decoded))
+        if (!placeable(file, decoded, decoded.bytes.byteLength))
             continue;
         if (isTextMediaType(mediaContentType(file, decoded)) &&
             decoded.bytes.byteLength <= INLINE_FILE_LIMIT)

package/dist/json-edits.js

@@ -28,6 +28,11 @@ function locate(text, wanted) {
         }
     };
     const stringEnd = (index) => {
+        // A string without escapes ends at the next quote, found natively: a long file's content
+        // is passed over without a step per character.
+        const quote = text.indexOf('"', index + 1);
+        if (quote !== -1 && !text.slice(index + 1, quote).includes("\\"))
+            return quote + 1;
         let at = index + 1;
         for (;;) {
             const code = text.charCodeAt(at);
@@ -150,32 +155,46 @@ export function applyJsonEdits(text, edits) {
             start: span.start,
             end: span.end,
             render: () => {
-                const kept = members.filter((member) => !edit.remove.has(member.key));
                 const first = members[0]?.start ?? span.end - 1;
                 const close = members.length ? members.at(-1).end : span.end - 1;
                 let out = text.slice(span.start, first);
-                kept.forEach((member, position) => {
-                    const index = members.indexOf(member);
+                let kept = 0;
+                members.forEach((member, index) => {
+                    if (edit.remove.has(member.key))
+                        return;
                     // The separator that preceded this member, comma included, unless it now comes first.
-                    if (position > 0)
+                    if (kept++ > 0)
                         out += text.slice(members[index - 1].end, member.start);
                     out += render(member.start, member.end);
                 });
                 let appended = "";
                 for (const [key, value] of edit.set)
                     if (!lastOf.has(key) || edit.remove.has(key))
-                        appended += `${kept.length || appended ? "," : ""}${JSON.stringify(key)}:${value}`;
+                        appended += `${kept || appended ? "," : ""}${JSON.stringify(key)}:${value}`;
                 return out + appended + text.slice(close, span.end);
             },
         });
     }
     pieces.sort((a, b) => a.start - b.start || b.end - a.end);
     /** The text from `start` to `end` with the pieces within it rendered; a piece inside another
-     * is rendered by the outer one. */
+     * is rendered by the outer one. Only the pieces that start within the range are visited. */
     const render = (start, end) => {
         let out = "";
         let at = start;
-        for (const piece of pieces) {
+        // The first piece starting at or after `start`, found by halving.
+        let low = 0;
+        let high = pieces.length;
+        while (low < high) {
+            const middle = (low + high) >> 1;
+            if (pieces[middle].start < start)
+                low = middle + 1;
+            else
+                high = middle;
+        }
+        for (let index = low; index < pieces.length; index++) {
+            const piece = pieces[index];
+            if (piece.start >= end)
+                break;
             if (piece.start < at || piece.end > end)
                 continue;
             out += text.slice(at, piece.start) + piece.render();