@hyperframes/aws-lambda 0.8.181 → 0.8.184

package/dist/_chunks/{chunk-PK7PO3MH.js → chunk-5FLGGUWE.js}

@@ -16,7 +16,7 @@ import {
   siteManifestUri,
   siteTarballUri,
   uploadContentAddressedFileToS3
-} from "./chunk-ZY5YIH5W.js";
+} from "./chunk-SGNVVPIS.js";
 import {
   CONTENT_STORE_RETENTION_DAYS
 } from "./chunk-YS3KY3C5.js";

package/dist/_chunks/{chunk-AK7J3QQN.js → chunk-QCYPNODV.js}

@@ -7,6 +7,7 @@ import {
   formatS3Uri,
   isSiteManifestUri,
   mapConcurrent,
+  multipartUpload,
   parseS3Uri,
   presignVerifiedS3GetUrl,
   putContentStoreFile,
@@ -14,20 +15,23 @@ import {
   untarDirectory,
   uploadContentAddressedFileToS3,
   uploadFileToS3
-} from "./chunk-ZY5YIH5W.js";
+} from "./chunk-SGNVVPIS.js";
 import {
   CONTENT_STORE_PREFIX
 } from "./chunk-YS3KY3C5.js";
 
 // src/handler.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync, rmSync as rmSync2, statSync as statSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
+import { availableParallelism, tmpdir as tmpdir2 } from "node:os";
 import { basename, join as join2 } from "node:path";
 import { GetAccountSettingsCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { S3Client } from "@aws-sdk/client-s3";
 import {
   assemble,
+  buildPlanAudio,
   chunksAreStitchedMp4,
+  plansSeparateAudio,
+  stitchesSeparateAudio,
   DEFAULT_MAX_PARALLEL_CHUNKS,
   listPlanV2ArtifactsForTarget,
   materializePlanV2Target,
@@ -109,9 +113,6 @@ async function loadSparticuzChromium() {
 
 // src/s3Stitch.ts
 import {
-  AbortMultipartUploadCommand,
-  CompleteMultipartUploadCommand,
-  CreateMultipartUploadCommand,
   GetObjectCommand,
   UploadPartCommand,
   UploadPartCopyCommand
@@ -185,41 +186,29 @@ async function sendParts(s3, parts, target) {
     (result) => result.status === "rejected"
   );
   if (failure) throw failure.reason;
-  return settled.map((result) => result.value);
+  return settled.map((result, index) => ({
+    ETag: result.value,
+    PartNumber: index + 1
+  }));
 }
 async function uploadParts(s3, parts, destUri, contentType) {
   const { bucket, key } = parseS3Uri(destUri);
-  const created = await s3.send(
-    new CreateMultipartUploadCommand({ Bucket: bucket, Key: key, ContentType: contentType })
+  await multipartUpload(
+    s3,
+    { Bucket: bucket, Key: key, ContentType: contentType },
+    (target) => sendParts(s3, parts, target)
   );
-  if (!created.UploadId) throw new Error(`[s3Stitch] no upload id for ${destUri}`);
-  const target = { Bucket: bucket, Key: key, UploadId: created.UploadId };
-  try {
-    const etags = await sendParts(s3, parts, target);
-    await s3.send(
-      new CompleteMultipartUploadCommand({
-        ...target,
-        MultipartUpload: { Parts: etags.map((ETag, index) => ({ ETag, PartNumber: index + 1 })) }
-      })
-    );
-  } catch (error) {
-    await s3.send(new AbortMultipartUploadCommand(target)).catch((abortError) => {
-      console.error(
-        `[s3Stitch] abort failed for ${destUri}; parts remain until a lifecycle rule removes them`,
-        abortError
-      );
-    });
-    throw error;
-  }
 }
-async function stitchMp4InS3(s3, chunkUris, destUri, minPartBytes = MIN_PART_BYTES) {
+async function stitchMp4InS3(s3, chunkUris, destUri, { audioUri, minPartBytes = MIN_PART_BYTES } = {}) {
+  const sourceUris = audioUri ? [audioUri, ...chunkUris] : chunkUris;
   const layouts = await Promise.all(
-    chunkUris.map((uri) => readMp4Layout((start, end) => getRange(s3, uri, start, end)))
+    sourceUris.map((uri) => readMp4Layout((start, end) => getRange(s3, uri, start, end)))
   );
+  const header = audioUri ? buildStitchedHeader(layouts.slice(1), layouts[0]) : buildStitchedHeader(layouts);
   const segments = [
-    { bytes: buildStitchedHeader(layouts) },
+    { bytes: header },
     ...layouts.map((layout, i) => ({
-      uri: chunkUris[i],
+      uri: sourceUris[i],
       start: layout.payloadStart,
       end: layout.payloadEnd
     }))
@@ -365,6 +354,8 @@ async function handler(event, deps) {
     switch (unwrapped.Action) {
       case "plan":
         return await handlePlan(unwrapped, deps);
+      case "audio":
+        return await handleAudio(unwrapped, deps);
       case "renderChunk":
         return await handleRenderChunk(unwrapped, deps);
       case "assemble":
@@ -422,7 +413,7 @@ function unwrapEvent(event) {
   );
 }
 function isLambdaAction(value) {
-  return value === "plan" || value === "renderChunk" || value === "assemble";
+  return value === "plan" || value === "audio" || value === "renderChunk" || value === "assemble";
 }
 function validatePlanProtocolShape(event) {
   const raw = event;
@@ -434,7 +425,7 @@ function validatePlanProtocolShape(event) {
     error.name = "PLAN_PROTOCOL_UNSUPPORTED";
     throw error;
   }
-  if (event.Action === "plan") return;
+  if (event.Action === "plan" || event.Action === "audio") return;
   const effectiveProtocol = protocol ?? "v2";
   const hasV1Locator = typeof raw.PlanS3Uri === "string";
   const hasV2Manifest = typeof raw.PlanV2ManifestS3Uri === "string";
@@ -447,11 +438,6 @@ function validatePlanProtocolShape(event) {
     error.name = "PLAN_PROTOCOL_UNSUPPORTED";
     throw error;
   }
-  if (effectiveProtocol === "v2" && event.Action === "assemble" && event.AudioS3Uri !== null) {
-    const error = new Error("[handler] v2 assemble audio must be materialized from the manifest");
-    error.name = "PLAN_PROTOCOL_UNSUPPORTED";
-    throw error;
-  }
 }
 function logEvent(payload) {
   console.log(JSON.stringify(payload));
@@ -466,6 +452,13 @@ function summarizeEvent(event) {
         format: event.Config.format,
         fps: event.Config.fps
       };
+    case "audio":
+      return {
+        projectS3Uri: event.ProjectS3Uri,
+        planOutputS3Prefix: event.PlanOutputS3Prefix,
+        format: event.Config.format,
+        fps: event.Config.fps
+      };
     case "renderChunk":
       return {
         planProtocol: event.PlanProtocol ?? "v2",
@@ -539,10 +532,7 @@ async function handlePlan(event, deps) {
   const config = await planConfig(event, deps);
   const s3 = deps?.s3 ?? getS3Client();
   const primitive = deps?.primitives?.plan ?? plan;
-  if (!deps?.skipChromeResolution && !process.env.PRODUCER_HEADLESS_SHELL_PATH) {
-    const chromePath = await resolveChromeExecutablePath();
-    process.env.PRODUCER_HEADLESS_SHELL_PATH = chromePath;
-  }
+  await ensureChromePath(deps);
   const work = mkdtempSync2(join2(deps?.tmpRoot ?? tmpdir2(), "hf-lambda-plan-"));
   const planDir = join2(work, "plan");
   try {
@@ -601,9 +591,7 @@ async function handlePlanV2(event, deps) {
   const config = await planConfig(event, deps);
   const s3 = deps?.s3 ?? getS3Client();
   const primitive = deps?.primitives?.planV2WithPublisher ?? planV2WithPublisher;
-  if (!deps?.skipChromeResolution && !process.env.PRODUCER_HEADLESS_SHELL_PATH) {
-    process.env.PRODUCER_HEADLESS_SHELL_PATH = await resolveChromeExecutablePath();
-  }
+  await ensureChromePath(deps);
   const work = mkdtempSync2(join2(deps?.tmpRoot ?? tmpdir2(), "hf-lambda-plan-v2-"));
   try {
     const { projectDir, remoteFiles } = await fetchProject(s3, event.ProjectS3Uri, work, true);
@@ -612,10 +600,12 @@ async function handlePlanV2(event, deps) {
       planOutputS3Prefix: event.PlanOutputS3Prefix,
       temporaryRoot: work
     });
+    const separateAudio = config.workerConcurrency > 1 && plansSeparateAudio(config, { deferAudio: true });
     const manifest = await primitive(projectDir, config, publisher, {
       stagingParentDir: work,
       remoteFiles,
-      chunksCarryAudio: true
+      chunksCarryAudio: true,
+      deferAudio: separateAudio
     });
     return {
       Action: "plan",
@@ -624,7 +614,10 @@ async function handlePlanV2(event, deps) {
       PlanV2ArtifactS3Prefix: publisher.artifactPrefix,
       PlanHash: manifest.planHash,
       ChunkCount: manifest.chunkCount,
-      MaxChunkConcurrency: Math.min(config.workerConcurrency, manifest.chunkCount),
+      MaxChunkConcurrency: Math.min(
+        config.workerConcurrency - (separateAudio ? 1 : 0),
+        manifest.chunkCount
+      ),
       TotalFrames: manifest.totalFrames,
       Fps: manifest.fps,
       Width: manifest.width,
@@ -632,6 +625,7 @@ async function handlePlanV2(event, deps) {
       Format: manifest.format,
       HasAudio: manifest.artifacts.some((artifact) => isPlanAudioArtifactPath(artifact.path)),
       AudioS3Uri: null,
+      SeparateAudio: separateAudio,
       FfmpegVersion: manifest.ffmpegVersion,
       ProducerVersion: manifest.producerVersion,
       DurationMs: Date.now() - started
@@ -640,6 +634,49 @@ async function handlePlanV2(event, deps) {
     cleanupDir(work);
   }
 }
+async function ensureChromePath(deps) {
+  if (deps?.skipChromeResolution || process.env.PRODUCER_HEADLESS_SHELL_PATH) return;
+  process.env.PRODUCER_HEADLESS_SHELL_PATH = await resolveChromeExecutablePath();
+}
+async function handleAudio(event, deps) {
+  const started = Date.now();
+  const none = () => ({
+    Action: "audio",
+    HasAudio: false,
+    AudioS3Uri: null,
+    DurationMs: Date.now() - started
+  });
+  if (!plansSeparateAudio(event.Config, { deferAudio: true })) return none();
+  const s3 = deps?.s3 ?? getS3Client();
+  await ensureChromePath(deps);
+  const work = mkdtempSync2(join2(deps?.tmpRoot ?? tmpdir2(), "hf-lambda-audio-"));
+  try {
+    const { projectDir, remoteFiles } = await fetchProject(s3, event.ProjectS3Uri, work, true);
+    const audioPath = join2(work, "audio.m4a");
+    const build = deps?.primitives?.buildPlanAudio ?? buildPlanAudio;
+    const { hasAudio } = await build(projectDir, event.Config, join2(work, "plan"), audioPath, {
+      remoteFiles
+    });
+    if (!hasAudio) return none();
+    const audioUri = `${trimTrailingSlash2(event.PlanOutputS3Prefix)}/audio/${PLAN_AUDIO_RELATIVE_PATH}`;
+    await uploadFileToS3(s3, audioPath, audioUri, "audio/mp4");
+    return {
+      Action: "audio",
+      HasAudio: true,
+      AudioS3Uri: audioUri,
+      DurationMs: Date.now() - started
+    };
+  } finally {
+    cleanupDir(work);
+  }
+}
+var LAMBDA_MB_PER_CAPTURE_BROWSER = 2048;
+function lambdaMaxCaptureWorkers() {
+  const memoryMb = Number(process.env.AWS_LAMBDA_FUNCTION_MEMORY_SIZE);
+  if (!(memoryMb > 0)) return void 0;
+  const byMemory = Math.floor(memoryMb / LAMBDA_MB_PER_CAPTURE_BROWSER);
+  return Math.max(1, Math.min(byMemory, availableParallelism() - 1));
+}
 async function handleRenderChunk(event, deps) {
   if (event.PlanProtocol !== "v1") {
     return handleRenderChunkV2(event, deps);
@@ -647,10 +684,7 @@ async function handleRenderChunk(event, deps) {
   const started = Date.now();
   const s3 = deps?.s3 ?? getS3Client();
   const primitive = deps?.primitives?.renderChunk ?? renderChunk;
-  if (!deps?.skipChromeResolution && !process.env.PRODUCER_HEADLESS_SHELL_PATH) {
-    const chromePath = await resolveChromeExecutablePath();
-    process.env.PRODUCER_HEADLESS_SHELL_PATH = chromePath;
-  }
+  await ensureChromePath(deps);
   const work = mkdtempSync2(join2(deps?.tmpRoot ?? tmpdir2(), "hf-lambda-chunk-"));
   const planTar = join2(work, "plan.tar.gz");
   const planDir = join2(work, "plan");
@@ -662,7 +696,15 @@ async function handleRenderChunk(event, deps) {
       work,
       event.Format === "png-sequence" ? `chunk-${pad(event.ChunkIndex)}` : `chunk-${pad(event.ChunkIndex)}${formatExtension(event.Format)}`
     );
-    const result = await primitive(planDir, event.ChunkIndex, chunkOutputBase);
+    const result = await primitive(planDir, event.ChunkIndex, chunkOutputBase, {
+      maxCaptureWorkers: lambdaMaxCaptureWorkers()
+    });
+    logEvent({
+      event: "chunk_capture",
+      chunkIndex: event.ChunkIndex,
+      workers: result.workers,
+      captureMode: result.captureMode
+    });
     const chunkUri = await uploadChunkOutput(
       s3,
       result,
@@ -686,9 +728,7 @@ async function handleRenderChunkV2(event, deps) {
   const started = Date.now();
   const s3 = deps?.s3 ?? getS3Client();
   const primitive = deps?.primitives?.renderChunk ?? renderChunk;
-  if (!deps?.skipChromeResolution && !process.env.PRODUCER_HEADLESS_SHELL_PATH) {
-    process.env.PRODUCER_HEADLESS_SHELL_PATH = await resolveChromeExecutablePath();
-  }
+  await ensureChromePath(deps);
   const work = mkdtempSync2(join2(deps?.tmpRoot ?? tmpdir2(), "hf-lambda-chunk-v2-"));
   try {
     const { planDir } = await downloadAndMaterializePlanV2(
@@ -701,7 +741,15 @@ async function handleRenderChunkV2(event, deps) {
       work,
       event.Format === "png-sequence" ? `chunk-${pad(event.ChunkIndex)}` : `chunk-${pad(event.ChunkIndex)}${formatExtension(event.Format)}`
     );
-    const result = await primitive(planDir, event.ChunkIndex, chunkOutputBase);
+    const result = await primitive(planDir, event.ChunkIndex, chunkOutputBase, {
+      maxCaptureWorkers: lambdaMaxCaptureWorkers()
+    });
+    logEvent({
+      event: "chunk_capture",
+      chunkIndex: event.ChunkIndex,
+      workers: result.workers,
+      captureMode: result.captureMode
+    });
     const chunkUri = await uploadChunkOutput(
       s3,
       result,
@@ -788,6 +836,11 @@ async function handleAssembleV2(event, deps) {
       { role: "assembler" },
       work
     );
+    if (event.AudioS3Uri !== null && !stitchesSeparateAudio(planDir)) {
+      const error = new Error("[handler] v2 assemble audio must be materialized from the manifest");
+      error.name = "PLAN_PROTOCOL_UNSUPPORTED";
+      throw error;
+    }
     if (chunksAreStitchedMp4(planDir, event.Cfr === true)) {
       return await stitchChunksInS3(s3, event, manifest, started);
     }
@@ -832,7 +885,9 @@ async function stitchChunksInS3(s3, event, plan2, started) {
     );
   }
   const stitchStarted = Date.now();
-  const stitched = await stitchMp4InS3(s3, event.ChunkS3Uris, event.OutputS3Uri);
+  const stitched = await stitchMp4InS3(s3, event.ChunkS3Uris, event.OutputS3Uri, {
+    audioUri: event.AudioS3Uri ?? void 0
+  });
   logEvent({
     event: "assemble_stages",
     mode: "s3-stitch",
@@ -936,6 +991,7 @@ async function downloadChunkObjects(s3, uris, workDir, format) {
 function getEventS3Uris(event) {
   switch (event.Action) {
     case "plan":
+    case "audio":
       return [event.ProjectS3Uri, event.PlanOutputS3Prefix];
     case "renderChunk":
       return event.PlanProtocol !== "v1" ? [event.PlanV2ManifestS3Uri, event.PlanV2ArtifactS3Prefix, event.ChunkOutputS3Prefix] : [event.PlanS3Uri, event.ChunkOutputS3Prefix];

package/dist/_chunks/{chunk-ZY5YIH5W.js → chunk-SGNVVPIS.js}

@@ -16,13 +16,23 @@ import { createHash } from "node:crypto";
 import { dirname } from "node:path";
 import { pipeline } from "node:stream/promises";
 import {
+  AbortMultipartUploadCommand,
+  CompleteMultipartUploadCommand,
   CopyObjectCommand,
+  CreateMultipartUploadCommand,
   GetObjectCommand,
   HeadObjectCommand,
-  PutObjectCommand
+  PutObjectCommand,
+  UploadPartCommand,
+  UploadPartCopyCommand
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import * as tar from "tar";
+var MAX_SINGLE_PUT_BYTES = 5 * 1024 ** 3;
+var MAX_PARTS = 1e4;
+var MIN_FILE_PART_BYTES = 64 * 1024 * 1024;
+var FILE_PARTS_IN_FLIGHT = 8;
+var PART_ATTEMPTS = 3;
 function parseS3Uri(uri) {
   if (!uri.startsWith("s3://")) {
     throw new Error(`[s3Transport] expected s3:// URI, got: ${JSON.stringify(uri)}`);
@@ -72,7 +82,8 @@ async function presignVerifiedS3GetUrl(client, uri, expectedSha256, expectedSize
     new HeadObjectCommand({ Bucket: bucket, Key: key, ChecksumMode: "ENABLED" })
   );
   const expectedChecksum = Buffer.from(expectedSha256, "hex").toString("base64");
-  if (head.ChecksumSHA256 !== expectedChecksum || head.ContentLength !== expectedSize) {
+  const attested = head.ChecksumSHA256 === expectedChecksum || isDigestCheckedMultipart(head, expectedSha256);
+  if (!attested || head.ContentLength !== expectedSize) {
     const error = new Error(
       `[s3Transport] PLAN_ARTIFACT_DIGEST_MISMATCH: ${uri} expected ${expectedSha256} (${expectedSize} bytes), S3 holds checksum ${String(head.ChecksumSHA256)} (${String(head.ContentLength)} bytes)`
     );
@@ -83,12 +94,23 @@ async function presignVerifiedS3GetUrl(client, uri, expectedSha256, expectedSize
     expiresIn: expiresInSeconds
   });
 }
+function isDigestCheckedMultipart(head, expectedSha256) {
+  return head.ChecksumType === "COMPOSITE" && (head.ContentLength ?? 0) > MAX_SINGLE_PUT_BYTES && head.Metadata?.sha256 === expectedSha256;
+}
 async function uploadFileToS3(client, localPath, uri, contentType) {
   if (!existsSync(localPath)) {
     throw new Error(`[s3Transport] upload source missing: ${localPath}`);
   }
   const { bucket, key } = parseS3Uri(uri);
   const size = statSync(localPath).size;
+  if (size > MAX_SINGLE_PUT_BYTES) {
+    await uploadFileInParts(client, localPath, size, {
+      Bucket: bucket,
+      Key: key,
+      ContentType: contentType
+    });
+    return;
+  }
   await client.send(
     new PutObjectCommand({
       Bucket: bucket,
@@ -111,8 +133,25 @@ async function putImmutableFile(client, localPath, uri, expectedSha256, contentT
   const size = statSync(localPath).size;
   const existing = await inspectContentAddressedObject(client, bucket, key, size, expectedSha256);
   if (existing.state === "matching")
-    return { outcome: "reused", lastModified: existing.lastModified };
+    return { outcome: "reused", lastModified: existing.lastModified, size };
   if (existing.state === "conflict") throwImmutableObjectConflict(uri);
+  try {
+    if (size > MAX_SINGLE_PUT_BYTES) {
+      const create2 = { Bucket: bucket, Key: key, ContentType: contentType };
+      await uploadFileInParts(client, localPath, size, create2, expectedSha256);
+    } else {
+      await putImmutableBody(client, localPath, bucket, key, size, expectedSha256, contentType);
+    }
+    return { outcome: "uploaded" };
+  } catch (error) {
+    if (!isS3PreconditionFailed(error)) throw error;
+    const raced = await inspectContentAddressedObject(client, bucket, key, size, expectedSha256);
+    if (raced.state === "matching") return { outcome: "reused" };
+    if (raced.state === "conflict") throwImmutableObjectConflict(uri);
+    throw error;
+  }
+}
+async function putImmutableBody(client, localPath, bucket, key, size, expectedSha256, contentType) {
   const body = createReadStream(localPath);
   try {
     await client.send(
@@ -124,23 +163,119 @@ async function putImmutableFile(client, localPath, uri, expectedSha256, contentT
         ContentLength: size,
         Metadata: { sha256: expectedSha256 },
         ChecksumSHA256: Buffer.from(expectedSha256, "hex").toString("base64"),
-        // HEAD followed by an unconditional PUT can overwrite a conflicting
-        // object published by a concurrent planner. Conditional create makes
-        // immutable CAS and fixed-key manifest publication race-safe.
         IfNoneMatch: "*"
       })
     );
-    return { outcome: "uploaded" };
-  } catch (error) {
-    if (!isS3PreconditionFailed(error)) throw error;
-    const raced = await inspectContentAddressedObject(client, bucket, key, size, expectedSha256);
-    if (raced.state === "matching") return { outcome: "reused" };
-    if (raced.state === "conflict") throwImmutableObjectConflict(uri);
-    throw error;
   } finally {
     body.destroy();
   }
 }
+async function multipartUpload(client, create2, sendParts, complete = {}) {
+  const created = await client.send(new CreateMultipartUploadCommand(create2));
+  const uri = formatS3Uri({ bucket: create2.Bucket, key: create2.Key });
+  if (!created.UploadId) throw new Error(`[s3Transport] no multipart upload id for ${uri}`);
+  const target = { Bucket: create2.Bucket, Key: create2.Key, UploadId: created.UploadId };
+  try {
+    const parts = await sendParts(target);
+    await client.send(
+      new CompleteMultipartUploadCommand({
+        ...target,
+        MultipartUpload: { Parts: parts },
+        IfNoneMatch: complete.ifNoneMatch,
+        MpuObjectSize: complete.objectSize
+      })
+    );
+  } catch (error) {
+    await client.send(new AbortMultipartUploadCommand(target)).catch((abortError) => {
+      console.error(
+        `[s3Transport] abort failed for ${uri}; parts remain until a lifecycle rule removes them`,
+        abortError
+      );
+    });
+    throw error;
+  }
+}
+async function uploadFileInParts(client, localPath, size, create2, expectedSha256) {
+  const partBytes = Math.max(MIN_FILE_PART_BYTES, Math.ceil(size / MAX_PARTS));
+  const sendParts = async (target) => {
+    const whole = createHash("sha256");
+    const parts = [];
+    const inFlight = /* @__PURE__ */ new Set();
+    let failure;
+    try {
+      for (let start = 0; start < size && !failure; start += partBytes) {
+        if (inFlight.size >= FILE_PARTS_IN_FLIGHT) await Promise.race(inFlight);
+        const range = { start, end: Math.min(start + partBytes, size) };
+        const checksum = await hashRange(localPath, range, whole);
+        const sent = sendFilePart(client, target, parts.length + 1, localPath, range, checksum);
+        parts.push(sent);
+        const slot = sent.then(
+          () => void inFlight.delete(slot),
+          (error) => {
+            failure ??= { error };
+            inFlight.delete(slot);
+          }
+        );
+        inFlight.add(slot);
+      }
+    } finally {
+      await Promise.all(inFlight);
+    }
+    if (failure) throw failure.error;
+    const actual = whole.digest("hex");
+    if (expectedSha256 && actual !== expectedSha256) {
+      const error = new Error(
+        `[s3Transport] PLAN_ARTIFACT_DIGEST_MISMATCH: ${localPath} changed: expected ${expectedSha256}, read ${actual}`
+      );
+      error.name = "PLAN_ARTIFACT_DIGEST_MISMATCH";
+      throw error;
+    }
+    return Promise.all(parts);
+  };
+  await multipartUpload(
+    client,
+    {
+      ...create2,
+      Metadata: expectedSha256 ? { sha256: expectedSha256 } : void 0,
+      ChecksumAlgorithm: "SHA256"
+    },
+    sendParts,
+    { ifNoneMatch: expectedSha256 ? "*" : void 0, objectSize: size }
+  );
+}
+async function hashRange(path, { start, end }, whole) {
+  const part = createHash("sha256");
+  let read = 0;
+  for await (const chunk of createReadStream(path, { start, end: end - 1 })) {
+    whole.update(chunk);
+    part.update(chunk);
+    read += chunk.length;
+  }
+  if (read !== end - start) throw new Error(`[s3Transport] ${path} shrank while uploading`);
+  return part.digest("base64");
+}
+async function sendFilePart(client, target, partNumber, path, { start, end }, checksum) {
+  for (let attempt = 1; ; attempt++) {
+    const body = createReadStream(path, { start, end: end - 1 });
+    try {
+      const result = await client.send(
+        new UploadPartCommand({
+          ...target,
+          PartNumber: partNumber,
+          Body: body,
+          ContentLength: end - start,
+          ChecksumSHA256: checksum
+        })
+      );
+      if (!result.ETag) throw new Error(`[s3Transport] part ${partNumber} returned no ETag`);
+      return { ETag: result.ETag, PartNumber: partNumber, ChecksumSHA256: checksum };
+    } catch (error) {
+      if (attempt >= PART_ATTEMPTS) throw error;
+    } finally {
+      body.destroy();
+    }
+  }
+}
 async function mapConcurrent(values, concurrency, fn) {
   let cursor = 0;
   async function worker() {
@@ -184,8 +319,8 @@ async function inspectContentAddressedObject(client, bucket, key, expectedSize,
 }
 async function putContentStoreFile(client, localPath, bucket, sha256) {
   const uri = contentStoreUri(bucket, sha256);
-  const { outcome, lastModified } = await putImmutableFile(client, localPath, uri, sha256);
-  if (lastModified) await refreshAgingObject(client, uri, sha256, lastModified);
+  const { outcome, lastModified, size } = await putImmutableFile(client, localPath, uri, sha256);
+  if (lastModified) await refreshAgingObject(client, uri, sha256, lastModified, size ?? 0);
   return outcome;
 }
 async function ensureContentStoreObject(client, bucket, sha256, sizeBytes) {
@@ -193,7 +328,9 @@ async function ensureContentStoreObject(client, bucket, sha256, sizeBytes) {
   const { key } = parseS3Uri(uri);
   const existing = await inspectContentAddressedObject(client, bucket, key, sizeBytes, sha256);
   if (existing.state === "matching") {
-    if (existing.lastModified) await refreshAgingObject(client, uri, sha256, existing.lastModified);
+    if (existing.lastModified) {
+      await refreshAgingObject(client, uri, sha256, existing.lastModified, sizeBytes);
+    }
     return;
   }
   if (existing.state === "conflict") throwImmutableObjectConflict(uri);
@@ -209,10 +346,42 @@ async function presignS3GetUrl(client, uri, expiresInSeconds) {
     expiresIn: expiresInSeconds
   });
 }
-async function refreshAgingObject(client, uri, sha256, lastModified) {
+async function refreshAgingObject(client, uri, sha256, lastModified, size) {
   const { bucket, key } = parseS3Uri(uri);
   const ageMs = Date.now() - lastModified.getTime();
   if (ageMs < CONTENT_STORE_REFRESH_AFTER_DAYS * 864e5) return;
+  if (size > MAX_SINGLE_PUT_BYTES) {
+    const create2 = {
+      Bucket: bucket,
+      Key: key,
+      Metadata: { sha256 },
+      ChecksumAlgorithm: "SHA256"
+    };
+    await multipartUpload(client, create2, async (target) => {
+      const parts = [];
+      for (let start = 0; start < size; start += MAX_SINGLE_PUT_BYTES) {
+        const end = Math.min(start + MAX_SINGLE_PUT_BYTES, size);
+        const PartNumber = parts.length + 1;
+        const { CopyPartResult } = await client.send(
+          new UploadPartCopyCommand({
+            ...target,
+            PartNumber,
+            CopySource: `${bucket}/${key}`,
+            CopySourceRange: `bytes=${start}-${end - 1}`
+          })
+        );
+        if (!CopyPartResult?.ETag)
+          throw new Error(`[s3Transport] copy part ${PartNumber} of ${uri} returned no ETag`);
+        parts.push({
+          ETag: CopyPartResult.ETag,
+          PartNumber,
+          ChecksumSHA256: CopyPartResult.ChecksumSHA256
+        });
+      }
+      return parts;
+    });
+    return;
+  }
   await client.send(
     new CopyObjectCommand({
       Bucket: bucket,
@@ -361,6 +530,7 @@ export {
   presignVerifiedS3GetUrl,
   uploadFileToS3,
   uploadContentAddressedFileToS3,
+  multipartUpload,
   mapConcurrent,
   sha256File,
   putContentStoreFile,