@pepys/ingest 0.3.1 → 0.4.1

package/src/pull/make-pull-runner.ts

@@ -1,15 +1,19 @@
-import type { CheckedDeployment, PullPath, Pulled, SourceDefinition } from '@pepys/kit';
+import type { CheckedDeployment, Logger, PullPath, Pulled, SourceDefinition } from '@pepys/kit';
 import type { BatchAppender } from '../fact-log/make-batch-appender.ts';
-import { findBatchProblem } from '../receive/find-batch-problem.ts';
-import { planBatch } from '../receive/plan-batch.ts';
 import type { ResyncMarks } from '../receive/resync-marks/create-resync-marks.ts';
 import { writeBatch } from '../receive/write-batch.ts';
 import type { StreamTurns } from '../receive/write-batch.ts';
+import { pickBatchPlan } from '../utils/pick-batch-plan.ts';
+import { buildCursorRecord } from './cursors/build-cursor-record.ts';
+import { cursorStream } from './cursors/cursor-stream.ts';
+import { withSourceLock } from './with-source-lock.ts';
+import type { SourceLocks } from './with-source-lock.ts';
 
 export type PullPathName = 'live' | 'recovery' | 'backfill' | 'resync';
 
-// `stored`: the batch is in the log, and the next run starts from `cursor`. `not-stored`: an append
-// failed, so the next run starts from the same cursor. Any other answer is the pull's own.
+// `stored`: the batch and then the cursor record are in the log, and the next run starts from
+// `cursor`. `not-stored`: an append failed, so the next run starts from the same cursor. Any other
+// answer is the pull's own.
 export type PullRun =
   | { kind: 'stored'; stored: number; cursor: string; isDone: boolean }
   | { kind: 'not-stored' }
@@ -20,6 +24,7 @@ export type PullRunner = (
   source: string,
   path: PullPathName,
   cursor: string | null,
+  signal: AbortSignal,
 ) => Promise<PullRun>;
 
 interface PullRunnerDependencies {
@@ -31,13 +36,16 @@ interface PullRunnerDependencies {
   turns: StreamTurns;
   resyncMarks: ResyncMarks;
   now: () => number;
+  logger: Logger;
 }
 
-// For a resync pull, removes each mark it was given that no tie set again since. A pull's fact is
-// noted in no mark: a resynced fact ties with the body it replaces, and would mark its entity again
-// on every run.
+// The pull paths of one source run one after the other, in the order they were asked for, and the
+// pull paths of two sources run at the same time. A run that waits for its source ends as refused
+// when its signal aborts, and its pull never starts.
 export function makePullRunner(dependencies: PullRunnerDependencies): PullRunner {
-  return async (sourceName, pathName, cursor) => {
+  const locks: SourceLocks = new Map();
+
+  return async (sourceName, pathName, cursor, signal) => {
     const source = dependencies.deployment.sources.find(
       (candidate) => candidate.name === sourceName,
     );
@@ -48,58 +56,97 @@ export function makePullRunner(dependencies: PullRunnerDependencies): PullRunner
       return { kind: 'refused', reason: `the source ${sourceName} has no ${pathName} pull` };
     }
 
-    const marks = pathName === 'resync' ? dependencies.resyncMarks.list(source.name) : [];
-    const env: Record<string, string> = {};
-
-    for (const name of path.env ?? []) {
-      env[name] = dependencies.secrets[name] ?? '';
-    }
-
-    const pulled = await path.pull(cursor, { env, marks, now: dependencies.now });
-
-    if (pulled.kind !== 'batch') {
-      return pulled;
-    }
+    const run = await withSourceLock(locks, source.name, signal, () =>
+      runPull(dependencies, { source, path, pathName, cursor, signal }),
+    );
 
-    const problem = findBatchProblem(source, pulled.batch);
+    return run === 'stopped'
+      ? { kind: 'refused', reason: `the ${pathName} pull of ${sourceName} stopped before its turn` }
+      : run;
+  };
+}
 
-    if (problem !== undefined) {
-      return { kind: 'refused', reason: problem };
-    }
+function findPullPath(source: SourceDefinition, pathName: PullPathName): PullPath | undefined {
+  const path = source[pathName];
 
-    if (pulled.batch.facts.some((pending) => pending.blobs.length > 0)) {
-      return { kind: 'refused', reason: 'ingest has no blob store' };
-    }
+  return path?.kind === 'pull' ? path : undefined;
+}
 
-    const plan = planBatch(pulled.batch);
+interface PullRequest {
+  source: SourceDefinition;
+  path: PullPath;
+  pathName: PullPathName;
+  cursor: string | null;
+  signal: AbortSignal;
+}
 
-    if (!plan.ok) {
-      return { kind: 'refused', reason: 'one fact is larger than one append of the log takes' };
-    }
+// For a resync pull, removes each mark it was given that no tie set again since. A pull's fact is
+// noted in no mark: a resynced fact ties with the body it replaces, and would mark its entity again
+// on every run.
+async function runPull(
+  dependencies: PullRunnerDependencies,
+  request: PullRequest,
+): Promise<PullRun> {
+  const source = request.source;
+  const marks = request.pathName === 'resync' ? dependencies.resyncMarks.list(source.name) : [];
+  const env: Record<string, string> = {};
+
+  for (const name of request.path.env ?? []) {
+    env[name] = dependencies.secrets[name] ?? '';
+  }
+
+  const pulled = await request.path.pull(request.cursor, {
+    env,
+    marks,
+    now: dependencies.now,
+    log: dependencies.logger,
+    signal: request.signal,
+  });
+
+  if (pulled.kind !== 'batch') {
+    return pulled;
+  }
+
+  const plan = pickBatchPlan(source, pulled.batch);
+
+  if (!plan.ok) {
+    return { kind: 'refused', reason: plan.failure.reason };
+  }
+
+  const outcome = await writeBatch(plan.value, dependencies);
+
+  if (outcome !== 'stored') {
+    return outcome === 'not-stored'
+      ? { kind: 'not-stored' }
+      : { kind: 'refused', reason: 'the log refused the batch' };
+  }
+
+  // A run that leaves the cursor where it was has nothing to save.
+  if (pulled.cursor !== request.cursor) {
+    const record = buildCursorRecord({
+      source: source.name,
+      path: request.pathName,
+      cursor: pulled.cursor,
+      nowMs: dependencies.now(),
+    });
 
-    const outcome = await writeBatch(plan.value, dependencies);
+    const saved = await writeBatch(new Map([[cursorStream, [[record]]]]), dependencies);
 
-    if (outcome !== 'stored') {
-      return outcome === 'not-stored'
+    if (saved !== 'stored') {
+      return saved === 'not-stored'
         ? { kind: 'not-stored' }
-        : { kind: 'refused', reason: 'the log refused the batch' };
+        : { kind: 'refused', reason: 'the log refused the cursor record' };
     }
+  }
 
-    for (const mark of marks) {
-      dependencies.resyncMarks.remove(source.name, mark);
-    }
+  for (const mark of marks) {
+    dependencies.resyncMarks.remove(source.name, mark);
+  }
 
-    return {
-      kind: 'stored',
-      stored: pulled.batch.facts.length,
-      cursor: pulled.cursor,
-      isDone: pulled.isDone,
-    };
+  return {
+    kind: 'stored',
+    stored: pulled.batch.facts.length,
+    cursor: pulled.cursor,
+    isDone: pulled.isDone,
   };
 }
-
-function findPullPath(source: SourceDefinition, pathName: PullPathName): PullPath | undefined {
-  const path = source[pathName];
-
-  return path?.kind === 'pull' ? path : undefined;
-}

package/src/pull/with-source-lock.ts

@@ -0,0 +1,76 @@
+// One chain of turns per source, for the whole process: the promise that settles when every run
+// that asked for the source's lock so far has ended.
+export type SourceLocks = Map<string, Promise<void>>;
+
+// Runs `work` once every earlier run of the source has ended, so the runs of one source go one
+// after the other in the order they asked. Returns `stopped`, and never calls `work`, when the
+// signal aborts before the turn comes.
+export async function withSourceLock<Value>(
+  locks: SourceLocks,
+  source: string,
+  signal: AbortSignal,
+  work: () => Promise<Value>,
+): Promise<Value | 'stopped'> {
+  const previous = locks.get(source) ?? Promise.resolve();
+  const done = Promise.withResolvers<void>();
+
+  // A run that stops while it waits ends early, and the runs behind it still wait for the runs
+  // ahead of it.
+  const turn = waitForBoth(previous, done.promise);
+
+  locks.set(source, turn);
+
+  try {
+    const waited = await waitForTurn(previous, signal);
+
+    return waited === 'stopped' ? 'stopped' : await work();
+  } finally {
+    done.resolve();
+
+    // A run that stops while it waits ends before the runs ahead of it, so the entry stays until
+    // those runs end too.
+    void removeEndedTurn(locks, source, turn);
+  }
+}
+
+async function waitForBoth(first: Promise<void>, second: Promise<void>): Promise<void> {
+  await first;
+  await second;
+}
+
+async function waitForTurn(
+  previous: Promise<void>,
+  signal: AbortSignal,
+): Promise<'turn' | 'stopped'> {
+  if (signal.aborted) {
+    return 'stopped';
+  }
+
+  const stopped = Promise.withResolvers<void>();
+
+  const stop = (): void => {
+    stopped.resolve();
+  };
+
+  signal.addEventListener('abort', stop);
+
+  try {
+    await Promise.race([previous, stopped.promise]);
+
+    return signal.aborted ? 'stopped' : 'turn';
+  } finally {
+    signal.removeEventListener('abort', stop);
+  }
+}
+
+async function removeEndedTurn(
+  locks: SourceLocks,
+  source: string,
+  turn: Promise<void>,
+): Promise<void> {
+  await turn;
+
+  if (locks.get(source) === turn) {
+    locks.delete(source);
+  }
+}

package/src/receive/answers/build-failure-answer.ts

@@ -3,7 +3,8 @@ export function buildFailureAnswer(status: number, reason: string): Response {
   return Response.json({ error: reason }, { status });
 }
 
-// 503 means "send the same delivery again, unchanged": every sender of v1 does that.
+// 503 means "send the same delivery again, unchanged". A sender that never sends a batch twice,
+// such as Codex's exporter, loses the batch.
 export function buildRetryAnswer(): Response {
   return Response.json(
     { error: 'the batch is not stored, send it again' },

package/src/receive/create-ingest.ts

@@ -1,4 +1,5 @@
-import type { CheckedDeployment, SenderProof } from '@pepys/kit';
+import { createLogger } from '@pepys/kit';
+import type { CheckedDeployment, Logger, SenderProof } from '@pepys/kit';
 import type { FactLog } from '../fact-log/fact-log.ts';
 import { makeBatchAppender } from '../fact-log/make-batch-appender.ts';
 import { makePullRunner } from '../pull/make-pull-runner.ts';
@@ -20,6 +21,9 @@ export interface IngestOptions {
   senderProof: SenderProof;
   appendRetry: { maxAttempts: number; retryDelayMs: number };
   now: () => number;
+
+  // Defaults to a logger that writes to stderr. A source's `read` and `pull` get it as `log`.
+  logger?: Logger | undefined;
 }
 
 export interface Ingest {
@@ -38,7 +42,8 @@ const recentBodyMaxAgeMs = 3_600_000;
 
 // The receive routes of a deployment over a given log, as one fetch function with no listener.
 export function createIngest(options: IngestOptions): Ingest {
-  const append = makeBatchAppender({ log: options.log, ...options.appendRetry });
+  const logger = options.logger ?? createLogger(process.stderr);
+  const append = makeBatchAppender({ log: options.log, logger, ...options.appendRetry });
 
   const turns: StreamTurns = new Map();
 
@@ -60,6 +65,7 @@ export function createIngest(options: IngestOptions): Ingest {
       makeReceiveHandler(source, path, {
         secret,
         senderProof: options.senderProof,
+        logger,
         append,
         turns,
         recentBodies: createRecentBodies({
@@ -74,7 +80,7 @@ export function createIngest(options: IngestOptions): Ingest {
     for (const route of path.ignoredRoutes ?? []) {
       handlers.set(
         route,
-        makeIgnoredRouteHandler(path, { secret, senderProof: options.senderProof }),
+        makeIgnoredRouteHandler(path, { secret, senderProof: options.senderProof, logger }),
       );
     }
   }
@@ -99,6 +105,7 @@ export function createIngest(options: IngestOptions): Ingest {
       turns,
       resyncMarks: resync.marks,
       now: options.now,
+      logger,
     }),
   };
 }

package/src/receive/make-receive-handler.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { isDeliveryAuthentic } from '@pepys/kit';
 import type {
+  Logger,
   ReceivePath,
   Received,
   Sender,
@@ -12,8 +13,7 @@ import { match } from 'ts-pattern';
 import type { BatchAppender } from '../fact-log/make-batch-appender.ts';
 import { buildFailureAnswer, buildRetryAnswer } from './answers/build-failure-answer.ts';
 import { buildSuccessAnswer } from './answers/build-success-answer.ts';
-import { findBatchProblem } from './find-batch-problem.ts';
-import { planBatch } from './plan-batch.ts';
+import { pickReceivedStep } from './pick-received-step.ts';
 import { readDecodedBody } from './read-decoded-body.ts';
 import { readSentBody } from './read-sent-body.ts';
 import type { RecentBodies } from './recent-bodies/create-recent-bodies.ts';
@@ -25,6 +25,7 @@ export interface ReceiveDependencies {
   // the value of the path's `check.secretEnv`; an empty secret passes no delivery
   secret: string;
   senderProof: SenderProof;
+  logger: Logger;
   append: BatchAppender;
   turns: StreamTurns;
   recentBodies: RecentBodies;
@@ -77,51 +78,33 @@ export function makeReceiveHandler(
       return pickDecodeFailure(body);
     }
 
-    const received = readSourceDelivery(source, path, {
+    const received = readSourceDelivery(source, path, dependencies.logger, {
       headers: request.headers,
       body,
       ...(checked.sender === undefined ? {} : { sender: checked.sender }),
     });
 
-    if (received === 'threw') {
-      return buildFailureAnswer(500, 'the source could not read the delivery');
-    }
+    const step = pickReceivedStep(source, received, factLimit);
 
-    if (received.kind === 'refused') {
-      return buildFailureAnswer(received.status, received.reason);
+    if (step.kind === 'refuse') {
+      return buildFailureAnswer(step.status, step.reason);
     }
 
-    if (received.kind === 'ignored' || received.batch.facts.length === 0) {
+    if (step.kind === 'ignore') {
       return buildSuccessAnswer(path, 'ignored', 0);
     }
 
-    const facts = received.batch.facts;
-
-    if (facts.length > factLimit) {
-      return buildFailureAnswer(413, `a batch holds ${factLimit} facts at most`);
-    }
-
-    const problem = findBatchProblem(source, received.batch);
-
-    if (problem !== undefined) {
-      return buildFailureAnswer(422, problem);
-    }
-
-    if (facts.some((pending) => pending.blobs.length > 0)) {
-      console.error(
+    if (step.kind === 'has-blob') {
+      dependencies.logger.error(
         `the source ${source.name} read a fact with a blob, and ingest has no blob store`,
       );
 
       return buildFailureAnswer(500, 'ingest has no blob store');
     }
 
-    const plan = planBatch(received.batch);
-
-    if (!plan.ok) {
-      return buildFailureAnswer(413, 'one fact is larger than one append of the log takes');
-    }
+    const facts = step.facts;
 
-    const outcome = await writeBatch(plan.value, dependencies);
+    const outcome = await writeBatch(step.plan, dependencies);
 
     if (outcome === 'not-stored') {
       return buildRetryAnswer();
@@ -152,7 +135,7 @@ export function makeReceiveHandler(
 // the ignored answer. It reads no body further and stores nothing.
 export function makeIgnoredRouteHandler(
   path: ReceivePath,
-  dependencies: Pick<ReceiveDependencies, 'secret' | 'senderProof'>,
+  dependencies: Pick<ReceiveDependencies, 'secret' | 'senderProof' | 'logger'>,
 ): Handler {
   return async (request) => {
     const checked = await readCheckedDelivery(request, path, dependencies);
@@ -170,7 +153,7 @@ type CheckedDelivery =
 async function readCheckedDelivery(
   request: Request,
   path: ReceivePath,
-  dependencies: Pick<ReceiveDependencies, 'secret' | 'senderProof'>,
+  dependencies: Pick<ReceiveDependencies, 'secret' | 'senderProof' | 'logger'>,
 ): Promise<CheckedDelivery> {
   if (request.method !== 'POST') {
     return { kind: 'answer', answer: buildFailureAnswer(405, 'method not allowed') };
@@ -190,7 +173,7 @@ async function readCheckedDelivery(
     return { kind: 'checked', sent, sender: undefined };
   }
 
-  const sender = await readProvenSender(path.sender, request.headers, dependencies.senderProof);
+  const sender = await readProvenSender(path.sender, request.headers, dependencies);
 
   if (sender === null) {
     return { kind: 'answer', answer: buildFailureAnswer(401, 'not authorised') };
@@ -203,14 +186,14 @@ async function readCheckedDelivery(
 async function readProvenSender(
   requirement: SenderRequirement,
   headers: Headers,
-  senderProof: SenderProof,
+  dependencies: Pick<ReceiveDependencies, 'senderProof' | 'logger'>,
 ): Promise<Sender | null> {
   try {
-    const sender = await senderProof.prove(requirement, headers);
+    const sender = await dependencies.senderProof.prove(requirement, headers);
 
     return sender;
   } catch {
-    console.error('the sender proof threw, so the delivery proves no sender');
+    dependencies.logger.error('the sender proof threw, so the delivery proves no sender');
 
     return null;
   }
@@ -233,12 +216,13 @@ function pickDecodeFailure(failure: 'unsupported' | 'too-large' | 'corrupt'): Re
 function readSourceDelivery(
   source: SourceDefinition,
   path: ReceivePath,
+  logger: Logger,
   delivery: Parameters<ReceivePath['read']>[0],
 ): Received | 'threw' {
   try {
-    return path.read(delivery, { name: source.name, families: source.families });
+    return path.read(delivery, { name: source.name, families: source.families, log: logger });
   } catch (error: unknown) {
-    console.error(`the read of the source ${source.name} threw`, error);
+    logger.error(`the read of the source ${source.name} threw`, error);
 
     return 'threw';
   }

package/src/receive/pick-received-step.ts

@@ -0,0 +1,56 @@
+import type { PendingFact, Received, SourceContext } from '@pepys/kit';
+import { match } from 'ts-pattern';
+import { pickBatchPlan } from '../utils/pick-batch-plan.ts';
+import type { BatchPlan } from '../utils/plan-batch.ts';
+
+// `has-blob`: the source read a fact with a blob, a fault of the deployment that ingest answers 500.
+export type ReceivedStep =
+  | { kind: 'refuse'; status: number; reason: string }
+  | { kind: 'has-blob' }
+  | { kind: 'ignore' }
+  | { kind: 'write'; facts: readonly PendingFact[]; plan: BatchPlan };
+
+// What follows the source's read of a delivery, `threw` when the read threw.
+export function pickReceivedStep(
+  source: Pick<SourceContext, 'name' | 'families'>,
+  received: Received | 'threw',
+  factLimit: number,
+): ReceivedStep {
+  if (received === 'threw') {
+    return { kind: 'refuse', status: 500, reason: 'the source could not read the delivery' };
+  }
+
+  if (received.kind === 'refused') {
+    return { kind: 'refuse', status: received.status, reason: received.reason };
+  }
+
+  if (received.kind === 'ignored' || received.batch.facts.length === 0) {
+    return { kind: 'ignore' };
+  }
+
+  const facts = received.batch.facts;
+
+  if (facts.length > factLimit) {
+    return { kind: 'refuse', status: 413, reason: `a batch holds ${factLimit} facts at most` };
+  }
+
+  const plan = pickBatchPlan(source, received.batch);
+
+  if (!plan.ok) {
+    return match(plan.failure.kind)
+      .with('bad-batch', () => ({
+        kind: 'refuse' as const,
+        status: 422,
+        reason: plan.failure.reason,
+      }))
+      .with('has-blob', () => ({ kind: 'has-blob' as const }))
+      .with('too-large', () => ({
+        kind: 'refuse' as const,
+        status: 413,
+        reason: plan.failure.reason,
+      }))
+      .exhaustive();
+  }
+
+  return { kind: 'write', facts, plan: plan.value };
+}

package/src/receive/write-batch.ts

@@ -1,6 +1,6 @@
-import type { StreamName } from '@pepys/kit';
+import type { Logger, StreamName } from '@pepys/kit';
 import type { BatchAppender } from '../fact-log/make-batch-appender.ts';
-import type { BatchPlan } from './plan-batch.ts';
+import type { BatchPlan } from '../utils/plan-batch.ts';
 
 export type BatchOutcome = 'stored' | 'refused' | 'not-stored';
 
@@ -11,6 +11,7 @@ export type StreamTurns = Map<StreamName, Promise<void>>;
 interface WriteBatchDependencies {
   append: BatchAppender;
   turns: StreamTurns;
+  logger: Logger;
 }
 
 // The streams append at the same time, and the appends of one stream one after the other. Every
@@ -21,12 +22,12 @@ export async function writeBatch(
 ): Promise<BatchOutcome> {
   const settled = await Promise.all(
     [...plan].map(([stream, runs]) =>
-      withStreamTurn(dependencies.turns, stream, async () => {
+      withStreamTurn(dependencies, stream, async () => {
         for (const run of runs) {
           const appended = await dependencies.append(stream, run);
 
           if (!appended.ok) {
-            console.error(`an append to ${stream} failed`, appended.failure);
+            dependencies.logger.error(`an append to ${stream} failed`, appended.failure);
 
             return appended.failure.kind;
           }
@@ -42,10 +43,11 @@ export async function writeBatch(
 
 // A throw is a refusal the log gives no outcome for, such as a bad access token.
 async function withStreamTurn(
-  turns: StreamTurns,
+  dependencies: Pick<WriteBatchDependencies, 'turns' | 'logger'>,
   stream: StreamName,
   work: () => Promise<BatchOutcome>,
 ): Promise<BatchOutcome> {
+  const turns = dependencies.turns;
   const previous = turns.get(stream) ?? Promise.resolve();
   const done = Promise.withResolvers<void>();
 
@@ -56,7 +58,7 @@ async function withStreamTurn(
 
     return await work();
   } catch (error: unknown) {
-    console.error(`an append to ${stream} threw`, error);
+    dependencies.logger.error(`an append to ${stream} threw`, error);
 
     return 'refused';
   } finally {

package/src/sender-proof/imp-identity/create-imp-identity-sender-proof.ts

@@ -1,17 +1,23 @@
 import type { verifyImpIdentity } from '@impz/client/identity';
-import type { SenderProof } from '@pepys/kit';
+import { createLogger } from '@pepys/kit';
+import type { Logger, SenderProof } from '@pepys/kit';
 import type { ImpIdentityTrust } from './types.ts';
 
 interface ImpIdentityOptions {
   verify: typeof verifyImpIdentity;
   trust: ImpIdentityTrust;
   now: () => number;
+
+  // defaults to a logger that writes to stderr
+  logger?: Logger | undefined;
 }
 
 // Proves the sender from the signed identity token in the `imp-identity` header. The issuer and
 // the subject come only from the verified token, and every failure, a throw included, proves
 // nothing. It never logs the token.
 export function createImpIdentitySenderProof(options: ImpIdentityOptions): SenderProof {
+  const logger = options.logger ?? createLogger(process.stderr);
+
   return {
     prove: async (requirement, headers) => {
       const documents = options.trust.issuers.get(requirement.issuersEnv) ?? [];
@@ -33,7 +39,7 @@ export function createImpIdentitySenderProof(options: ImpIdentityOptions): Sende
           ? null
           : { issuer: verified.issuer, subject: verified.id, name: verified.name };
       } catch {
-        console.error('the identity verifier failed, so the delivery proves no sender');
+        logger.error('the identity verifier failed, so the delivery proves no sender');
 
         return null;
       }

package/src/sender-proof/imp-identity/read-imp-identity-sender-proof.ts

@@ -1,5 +1,5 @@
 import { verifyImpIdentity } from '@impz/client/identity';
-import type { Result, SenderProof, SourceDefinition } from '@pepys/kit';
+import type { Logger, Result, SenderProof, SourceDefinition } from '@pepys/kit';
 import { createImpIdentitySenderProof } from './create-imp-identity-sender-proof.ts';
 import { readImpIdentityTrust } from './read-imp-identity-trust.ts';
 
@@ -7,6 +7,9 @@ interface SenderProofReadOptions {
   sources: readonly SourceDefinition[];
   environment: Readonly<Record<string, string | undefined>>;
   now: () => number;
+
+  // defaults to a logger that writes to stderr
+  logger?: Logger | undefined;
 }
 
 // The sender proof that `serveIngest` runs: the trust of the deployment's environment and the
@@ -30,6 +33,7 @@ export async function readImpIdentitySenderProof(
       verify: verifyImpIdentity,
       trust: trust.value,
       now: options.now,
+      logger: options.logger,
     }),
   };
 }