@shpitdev/convex-cliproxy-observability 0.1.0

package/src/component/ingest.ts

@@ -0,0 +1,328 @@
+import { v } from "convex/values";
+import { mutation } from "./_generated/server.js";
+import { blobValue } from "./schema.js";
+const bounded = (value: string, limit: number) => {
+  if (new TextEncoder().encode(value).byteLength > limit) throw new Error("component byte limit");
+};
+const identity = (value: string) => {
+  if (!/^[a-f0-9]{64}$/.test(value)) throw new Error("invalid identity");
+};
+export const admit = mutation({
+  args: {
+    destinationId: v.string(),
+    instanceId: v.string(),
+    pluginBootId: v.string(),
+    executionId: v.string(),
+    callId: v.string(),
+    sequence: v.number(),
+    throughSequence: v.number(),
+    terminalSequence: v.optional(v.number()),
+    identity: v.string(),
+    digest: v.string(),
+    reference: blobValue,
+    summaryJson: v.string(),
+    observedAt: v.string(),
+    correlation: v.object({
+      requestId: v.optional(v.string()),
+      runId: v.optional(v.string()),
+      jobId: v.optional(v.string()),
+      rootExecutionId: v.optional(v.string()),
+      opencodeSessionId: v.optional(v.string()),
+    }),
+  },
+  handler: async (ctx, args) => {
+    identity(args.identity);
+    identity(args.digest);
+    identity(args.callId);
+    bounded(args.summaryJson, 8 * 1024);
+    if (
+      args.reference.sha256 !== args.digest ||
+      args.reference.byteLength > 2 * 1028 * 1024 ||
+      args.reference.byteLength < 1 ||
+      !Number.isSafeInteger(args.sequence) ||
+      args.sequence < 1 ||
+      !Number.isSafeInteger(args.throughSequence) ||
+      args.throughSequence < args.sequence ||
+      args.throughSequence - args.sequence > 255
+    )
+      throw new Error("invalid segment");
+    bounded(JSON.stringify(args), 28 * 1024);
+    const receipt = await ctx.db
+      .query("receipts")
+      .withIndex("by_identity", (q) =>
+        q.eq("destinationId", args.destinationId).eq("identity", args.identity),
+      )
+      .unique();
+    if (receipt) {
+      if (receipt.digest !== args.digest) throw new Error("capture_digest_conflict");
+      return { identity: args.identity, digest: args.digest, callId: args.callId, duplicate: true };
+    }
+    const existingSequence = await ctx.db
+      .query("segments")
+      .withIndex("by_sequence", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("callId", args.callId)
+          .eq("sequence", args.sequence),
+      )
+      .unique();
+    if (existingSequence) throw new Error("capture_sequence_conflict");
+    const previous = await ctx.db
+      .query("segments")
+      .withIndex("by_sequence", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("callId", args.callId)
+          .lt("sequence", args.sequence),
+      )
+      .order("desc")
+      .first();
+    const next = await ctx.db
+      .query("segments")
+      .withIndex("by_sequence", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("callId", args.callId)
+          .gt("sequence", args.sequence),
+      )
+      .order("asc")
+      .first();
+    if (
+      (previous && previous.throughSequence >= args.sequence) ||
+      (next && next.sequence <= args.throughSequence)
+    )
+      throw new Error("capture_sequence_conflict");
+    const now = Date.now();
+    let call = await ctx.db
+      .query("calls")
+      .withIndex("by_call", (q) =>
+        q.eq("destinationId", args.destinationId).eq("callId", args.callId),
+      )
+      .unique();
+    if (!call) {
+      const document = await ctx.db.insert("calls", {
+        destinationId: args.destinationId,
+        callId: args.callId,
+        instanceId: args.instanceId,
+        pluginBootId: args.pluginBootId,
+        executionId: args.executionId,
+        receivedAt: now,
+        revision: 0,
+        projectedThroughSequence: 0,
+        persistedThroughSequence: 0,
+        summaryJson: args.summaryJson,
+        checkpointJson: "{}",
+        ...args.correlation,
+      });
+      call = await ctx.db.get("calls", document);
+    }
+    if (!call) throw new Error("call missing");
+    if (
+      call.instanceId !== args.instanceId ||
+      call.pluginBootId !== args.pluginBootId ||
+      call.executionId !== args.executionId ||
+      (call.terminalSequence !== undefined && args.throughSequence > call.terminalSequence)
+    )
+      throw new Error("capture_sequence_conflict");
+    if (args.sequence === 1) await ctx.db.patch("calls", call._id, args.correlation);
+    await ctx.db.insert("segments", {
+      destinationId: args.destinationId,
+      callId: args.callId,
+      sequence: args.sequence,
+      throughSequence: args.throughSequence,
+      identity: args.identity,
+      digest: args.digest,
+      reference: args.reference,
+      receivedAt: now,
+    });
+    await ctx.db.insert("receipts", {
+      destinationId: args.destinationId,
+      identity: args.identity,
+      digest: args.digest,
+      callId: args.callId,
+      sequence: args.sequence,
+      receivedAt: now,
+    });
+    // Bounded contiguous watermark advance. Projection workers continue it in bounded pages.
+    const pending = await ctx.db
+      .query("segments")
+      .withIndex("by_sequence", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("callId", args.callId)
+          .gt("sequence", call.persistedThroughSequence),
+      )
+      .take(8);
+    let through = call.persistedThroughSequence;
+    for (const segment of pending) {
+      if (segment.sequence !== through + 1) break;
+      through = segment.throughSequence;
+    }
+    const patch: { persistedThroughSequence: number; terminalSequence?: number } = {
+      persistedThroughSequence: through,
+    };
+    if (args.terminalSequence !== undefined) patch.terminalSequence = args.terminalSequence;
+    await ctx.db.patch("calls", call._id, patch);
+    const status = await ctx.db
+      .query("sourceStatus")
+      .withIndex("by_source", (q) =>
+        q.eq("destinationId", args.destinationId).eq("instanceId", args.instanceId),
+      )
+      .unique();
+    const health = {
+      destinationId: args.destinationId,
+      instanceId: args.instanceId,
+      pluginBootId: args.pluginBootId,
+      lastObservedAt: args.observedAt,
+      lastReceivedAt: now,
+      coverage: "precommit_and_pre_hook_unavailable",
+      healthJson: status?.pluginBootId === args.pluginBootId ? status.healthJson : undefined,
+    };
+    if (status && Date.parse(status.lastObservedAt) <= Date.parse(args.observedAt))
+      await ctx.db.patch("sourceStatus", status._id, health);
+    else if (!status) await ctx.db.insert("sourceStatus", health);
+    return { identity: args.identity, digest: args.digest, callId: args.callId, duplicate: false };
+  },
+});
+export const commitProjection = mutation({
+  args: {
+    destinationId: v.string(),
+    callId: v.string(),
+    expectedRevision: v.number(),
+    throughSequence: v.number(),
+    summaryJson: v.string(),
+    checkpointJson: v.string(),
+  },
+  handler: async (ctx, args) => {
+    bounded(args.summaryJson, 8 * 1024);
+    bounded(args.checkpointJson, 68 * 1024);
+    const call = await ctx.db
+      .query("calls")
+      .withIndex("by_call", (q) =>
+        q.eq("destinationId", args.destinationId).eq("callId", args.callId),
+      )
+      .unique();
+    if (!call) throw new Error("call missing");
+    if (call.revision !== args.expectedRevision)
+      return { committed: false, revision: call.revision };
+    if (
+      args.throughSequence < call.projectedThroughSequence ||
+      args.throughSequence > call.projectedThroughSequence + 8 * 256
+    )
+      throw new Error("projection range limit");
+    const rows = await ctx.db
+      .query("segments")
+      .withIndex("by_sequence", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("callId", args.callId)
+          .gt("sequence", call.projectedThroughSequence),
+      )
+      .take(8);
+    let through = call.projectedThroughSequence;
+    for (const row of rows) {
+      if (row.sequence !== through + 1 || row.throughSequence > args.throughSequence) break;
+      through = row.throughSequence;
+    }
+    if (through !== args.throughSequence) throw new Error("projection crosses gap");
+    await ctx.db.patch("calls", call._id, {
+      revision: call.revision + 1,
+      projectedThroughSequence: through,
+      persistedThroughSequence: Math.max(call.persistedThroughSequence, through),
+      summaryJson: args.summaryJson,
+      checkpointJson: args.checkpointJson,
+      projectionFailure: undefined,
+    });
+    return { committed: true, revision: call.revision + 1 };
+  },
+});
+
+export const recordProjectionFailure = mutation({
+  args: { destinationId: v.string(), callId: v.string(), expectedRevision: v.number() },
+  handler: async (ctx, args) => {
+    const call = await ctx.db
+      .query("calls")
+      .withIndex("by_call", (q) =>
+        q.eq("destinationId", args.destinationId).eq("callId", args.callId),
+      )
+      .unique();
+    if (call && call.revision === args.expectedRevision)
+      await ctx.db.patch("calls", call._id, {
+        projectionFailure: { reason: "projection_processing_failed", at: Date.now() },
+      });
+  },
+});
+
+export const recordHealth = mutation({
+  args: {
+    destinationId: v.string(),
+    instanceId: v.string(),
+    pluginBootId: v.string(),
+    startedAt: v.string(),
+    observedAt: v.string(),
+    observationsTotal: v.number(),
+    droppedObservationsTotal: v.number(),
+    lostControlObservationsTotal: v.number(),
+    scopeConflictsTotal: v.number(),
+    expiredScopesTotal: v.number(),
+    activeCalls: v.number(),
+  },
+  handler: async (ctx, args) => {
+    bounded(JSON.stringify(args), 4096);
+    const at = Date.parse(args.observedAt);
+    if (!Number.isFinite(at) || !Number.isFinite(Date.parse(args.startedAt)))
+      throw new Error("invalid health time");
+    for (const value of [
+      args.observationsTotal,
+      args.droppedObservationsTotal,
+      args.lostControlObservationsTotal,
+      args.scopeConflictsTotal,
+      args.expiredScopesTotal,
+      args.activeCalls,
+    ])
+      if (!Number.isSafeInteger(value) || value < 0) throw new Error("invalid health counter");
+    const healthJson = JSON.stringify({
+      ...args,
+      counterScope: "plugin_boot",
+      precommitCoverage: "unknown_before_local_commit",
+    });
+    const boot = await ctx.db
+      .query("bootHealth")
+      .withIndex("by_boot", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("instanceId", args.instanceId)
+          .eq("pluginBootId", args.pluginBootId),
+      )
+      .unique();
+    if (!boot)
+      await ctx.db.insert("bootHealth", {
+        destinationId: args.destinationId,
+        instanceId: args.instanceId,
+        pluginBootId: args.pluginBootId,
+        observedAt: at,
+        healthJson,
+      });
+    else if (at >= boot.observedAt)
+      await ctx.db.patch("bootHealth", boot._id, { observedAt: at, healthJson });
+    const status = await ctx.db
+      .query("sourceStatus")
+      .withIndex("by_source", (q) =>
+        q.eq("destinationId", args.destinationId).eq("instanceId", args.instanceId),
+      )
+      .unique();
+    const row = {
+      destinationId: args.destinationId,
+      instanceId: args.instanceId,
+      pluginBootId: args.pluginBootId,
+      lastObservedAt: args.observedAt,
+      lastReceivedAt: Date.now(),
+      coverage: "precommit_and_pre_hook_unavailable",
+      healthJson,
+    };
+    if (!status) await ctx.db.insert("sourceStatus", row);
+    else if (at >= Date.parse(status.lastObservedAt))
+      await ctx.db.patch("sourceStatus", status._id, row);
+    return { committed: true };
+  },
+});

package/src/component/queries.ts

@@ -0,0 +1,248 @@
+import type { ModelCallV1 } from "../model-call/index.js";
+import { v } from "convex/values";
+import { query, type QueryCtx } from "./_generated/server.js";
+async function summaryView(
+  ctx: QueryCtx,
+  row: {
+    summaryJson: string;
+    destinationId: string;
+    instanceId: string;
+    pluginBootId: string;
+    terminalSequence?: number;
+  },
+) {
+  const summary = JSON.parse(row.summaryJson) as ModelCallV1;
+  if (summary.state === "in_progress" && row.terminalSequence === undefined) {
+    const source = await ctx.db
+      .query("sourceStatus")
+      .withIndex("by_source", (q) =>
+        q.eq("destinationId", row.destinationId).eq("instanceId", row.instanceId),
+      )
+      .unique();
+    if (source?.healthJson && source.pluginBootId !== row.pluginBootId) {
+      summary.state = "unknown";
+      summary.capture.raw = "partial";
+      summary.capture.gaps = [...summary.capture.gaps, "completion_unobserved_prior_boot"].slice(
+        -8,
+      );
+    }
+  }
+  return summary;
+}
+const owner = { destinationId: v.string(), callId: v.string() };
+export const getCall = query({
+  args: owner,
+  handler: async (ctx, args) => {
+    const call = await ctx.db
+      .query("calls")
+      .withIndex("by_call", (q) =>
+        q.eq("destinationId", args.destinationId).eq("callId", args.callId),
+      )
+      .unique();
+    if (!call) return null;
+    return {
+      ...call,
+      summaryJson: JSON.stringify(await summaryView(ctx, call)),
+      checkpointJson: undefined,
+    };
+  },
+});
+export const getProcessingState = query({
+  args: owner,
+  handler: async (ctx, args) =>
+    ctx.db
+      .query("calls")
+      .withIndex("by_call", (q) =>
+        q.eq("destinationId", args.destinationId).eq("callId", args.callId),
+      )
+      .unique(),
+});
+export const pageEventSegments = query({
+  args: { ...owner, afterSequence: v.optional(v.number()), limit: v.optional(v.number()) },
+  handler: async (ctx, args) => {
+    const limit = Math.max(1, Math.min(8, Math.floor(args.limit ?? 7)));
+    const rows = await ctx.db
+      .query("segments")
+      .withIndex("by_sequence", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("callId", args.callId)
+          .gt("sequence", args.afterSequence ?? 0),
+      )
+      .take(limit + 1);
+    return {
+      segments: rows.slice(0, limit),
+      cursor: rows.length
+        ? rows[Math.min(rows.length, limit) - 1]!.throughSequence
+        : (args.afterSequence ?? 0),
+      done: rows.length <= limit,
+    };
+  },
+});
+const cursor = v.object({ receivedAt: v.number(), creationTime: v.number() });
+export const pageRecentSummaries = query({
+  args: {
+    destinationId: v.string(),
+    cursor: v.optional(cursor),
+    limit: v.optional(v.number()),
+    correlation: v.optional(
+      v.object({
+        kind: v.union(
+          v.literal("requestId"),
+          v.literal("runId"),
+          v.literal("jobId"),
+          v.literal("rootExecutionId"),
+          v.literal("opencodeSessionId"),
+        ),
+        value: v.string(),
+      }),
+    ),
+  },
+  handler: async (ctx, args) => {
+    const limit = Math.max(1, Math.min(3, Math.floor(args.limit ?? 3)));
+    const correlation = args.correlation;
+    const c = args.cursor;
+    async function read(mode: "first" | "tie" | "older", take: number) {
+      if (correlation?.kind === "requestId")
+        return ctx.db
+          .query("calls")
+          .withIndex("by_request", (q) => {
+            const base = q
+              .eq("destinationId", args.destinationId)
+              .eq("requestId", correlation.value);
+            return !c
+              ? base
+              : mode === "tie"
+                ? base.eq("receivedAt", c.receivedAt).lt("_creationTime", c.creationTime)
+                : base.lt("receivedAt", c.receivedAt);
+          })
+          .order("desc")
+          .take(take);
+      if (correlation?.kind === "runId")
+        return ctx.db
+          .query("calls")
+          .withIndex("by_run", (q) => {
+            const base = q.eq("destinationId", args.destinationId).eq("runId", correlation.value);
+            return !c
+              ? base
+              : mode === "tie"
+                ? base.eq("receivedAt", c.receivedAt).lt("_creationTime", c.creationTime)
+                : base.lt("receivedAt", c.receivedAt);
+          })
+          .order("desc")
+          .take(take);
+      if (correlation?.kind === "jobId")
+        return ctx.db
+          .query("calls")
+          .withIndex("by_job", (q) => {
+            const base = q.eq("destinationId", args.destinationId).eq("jobId", correlation.value);
+            return !c
+              ? base
+              : mode === "tie"
+                ? base.eq("receivedAt", c.receivedAt).lt("_creationTime", c.creationTime)
+                : base.lt("receivedAt", c.receivedAt);
+          })
+          .order("desc")
+          .take(take);
+      if (correlation?.kind === "rootExecutionId")
+        return ctx.db
+          .query("calls")
+          .withIndex("by_root_execution", (q) => {
+            const base = q
+              .eq("destinationId", args.destinationId)
+              .eq("rootExecutionId", correlation.value);
+            return !c
+              ? base
+              : mode === "tie"
+                ? base.eq("receivedAt", c.receivedAt).lt("_creationTime", c.creationTime)
+                : base.lt("receivedAt", c.receivedAt);
+          })
+          .order("desc")
+          .take(take);
+      if (correlation?.kind === "opencodeSessionId")
+        return ctx.db
+          .query("calls")
+          .withIndex("by_opencode_session", (q) => {
+            const base = q
+              .eq("destinationId", args.destinationId)
+              .eq("opencodeSessionId", correlation.value);
+            return !c
+              ? base
+              : mode === "tie"
+                ? base.eq("receivedAt", c.receivedAt).lt("_creationTime", c.creationTime)
+                : base.lt("receivedAt", c.receivedAt);
+          })
+          .order("desc")
+          .take(take);
+      return ctx.db
+        .query("calls")
+        .withIndex("by_received", (q) => {
+          const base = q.eq("destinationId", args.destinationId);
+          return !c
+            ? base
+            : mode === "tie"
+              ? base.eq("receivedAt", c.receivedAt).lt("_creationTime", c.creationTime)
+              : base.lt("receivedAt", c.receivedAt);
+        })
+        .order("desc")
+        .take(take);
+    }
+    const rows = c ? await read("tie", limit + 1) : await read("first", limit + 1);
+    if (c && rows.length < limit + 1) rows.push(...(await read("older", limit + 1 - rows.length)));
+    const calls: ModelCallV1[] = [];
+    let bytes = 256;
+    let next = args.cursor;
+    let consumed = 0;
+    for (const row of rows.slice(0, limit)) {
+      const view = await summaryView(ctx, row);
+      const summary = {
+        ...view,
+        sourceDocumentId: row._id,
+        receivedAt: row.receivedAt,
+        capture: {
+          ...view.capture,
+          projectedThroughSequence: row.projectedThroughSequence,
+          persistedThroughSequence: row.persistedThroughSequence,
+        },
+      };
+      const length = new TextEncoder().encode(JSON.stringify(summary)).byteLength;
+      if (bytes + length > 31 * 1024) break;
+      calls.push(summary);
+      bytes += length;
+      consumed++;
+      next = { receivedAt: row.receivedAt, creationTime: row._creationTime };
+    }
+    return { calls, cursor: next ?? null, done: consumed === rows.length };
+  },
+});
+export const getCaptureCoverage = query({
+  args: { destinationId: v.string() },
+  handler: async (ctx, args) => {
+    const sources = await ctx.db
+      .query("sourceStatus")
+      .withIndex("by_source", (q) => q.eq("destinationId", args.destinationId))
+      .take(17);
+    return {
+      retention: "indefinite" as const,
+      preHook: "unavailable" as const,
+      previews: "not_enrolled" as const,
+      attemptDetail: "unavailable" as const,
+      sources: sources.slice(0, 16),
+      sourcesComplete: sources.length <= 16,
+    };
+  },
+});
+
+export const getBootHealth = query({
+  args: { destinationId: v.string(), instanceId: v.string(), pluginBootId: v.string() },
+  handler: async (ctx, args) =>
+    ctx.db
+      .query("bootHealth")
+      .withIndex("by_boot", (q) =>
+        q
+          .eq("destinationId", args.destinationId)
+          .eq("instanceId", args.instanceId)
+          .eq("pluginBootId", args.pluginBootId),
+      )
+      .unique(),
+});

package/src/component/schema.ts

@@ -0,0 +1,73 @@
+import { defineSchema, defineTable } from "convex/server";
+import { v } from "convex/values";
+export const blobValue = v.object({
+  key: v.string(),
+  sha256: v.string(),
+  byteLength: v.number(),
+  contentType: v.string(),
+});
+export default defineSchema({
+  calls: defineTable({
+    destinationId: v.string(),
+    callId: v.string(),
+    instanceId: v.string(),
+    pluginBootId: v.string(),
+    executionId: v.string(),
+    receivedAt: v.number(),
+    revision: v.number(),
+    projectedThroughSequence: v.number(),
+    persistedThroughSequence: v.number(),
+    terminalSequence: v.optional(v.number()),
+    summaryJson: v.string(),
+    checkpointJson: v.string(),
+    projectionFailure: v.optional(v.object({ reason: v.string(), at: v.number() })),
+    requestId: v.optional(v.string()),
+    runId: v.optional(v.string()),
+    jobId: v.optional(v.string()),
+    rootExecutionId: v.optional(v.string()),
+    opencodeSessionId: v.optional(v.string()),
+  })
+    .index("by_call", ["destinationId", "callId"])
+    .index("by_received", ["destinationId", "receivedAt"])
+    .index("by_request", ["destinationId", "requestId", "receivedAt"])
+    .index("by_run", ["destinationId", "runId", "receivedAt"])
+    .index("by_job", ["destinationId", "jobId", "receivedAt"])
+    .index("by_root_execution", ["destinationId", "rootExecutionId", "receivedAt"])
+    .index("by_opencode_session", ["destinationId", "opencodeSessionId", "receivedAt"]),
+  segments: defineTable({
+    destinationId: v.string(),
+    callId: v.string(),
+    sequence: v.number(),
+    throughSequence: v.number(),
+    identity: v.string(),
+    digest: v.string(),
+    reference: blobValue,
+    receivedAt: v.number(),
+  })
+    .index("by_identity", ["destinationId", "identity"])
+    .index("by_sequence", ["destinationId", "callId", "sequence"]),
+  receipts: defineTable({
+    destinationId: v.string(),
+    identity: v.string(),
+    digest: v.string(),
+    callId: v.string(),
+    sequence: v.number(),
+    receivedAt: v.number(),
+  }).index("by_identity", ["destinationId", "identity"]),
+  bootHealth: defineTable({
+    destinationId: v.string(),
+    instanceId: v.string(),
+    pluginBootId: v.string(),
+    observedAt: v.number(),
+    healthJson: v.string(),
+  }).index("by_boot", ["destinationId", "instanceId", "pluginBootId"]),
+  sourceStatus: defineTable({
+    destinationId: v.string(),
+    instanceId: v.string(),
+    pluginBootId: v.string(),
+    lastObservedAt: v.string(),
+    lastReceivedAt: v.number(),
+    coverage: v.string(),
+    healthJson: v.optional(v.string()),
+  }).index("by_source", ["destinationId", "instanceId"]),
+});

package/src/content/index.ts

@@ -0,0 +1,53 @@
+import { sha256 } from "../capture/index.js";
+import type { PrivateContentReference } from "../model-call/index.js";
+export type PrivateCaptureStorage = {
+  put: (reference: PrivateContentReference, bytes: Uint8Array) => Promise<void>;
+  get: (key: string) => Promise<ReadableStream<Uint8Array>>;
+};
+/** The host must obtain manifest from the authorized selected call, never from model content. */
+export async function resolveCallBlob(
+  storage: Pick<PrivateCaptureStorage, "get">,
+  manifest: readonly PrivateContentReference[],
+  selected: PrivateContentReference,
+  maxBytes = 2 * 1024 * 1024,
+): Promise<Uint8Array> {
+  if (
+    !manifest.some(
+      (ref) =>
+        ref.key === selected.key &&
+        ref.sha256 === selected.sha256 &&
+        ref.byteLength === selected.byteLength &&
+        ref.contentType === selected.contentType,
+    ) ||
+    !Number.isSafeInteger(selected.byteLength) ||
+    selected.byteLength < 0 ||
+    selected.byteLength > maxBytes
+  )
+    throw new Error("unowned or oversized content reference");
+  const reader = (await storage.get(selected.key)).getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > selected.byteLength || size > maxBytes) {
+        await reader.cancel();
+        throw new Error("stored content bound exceeded");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  if (size !== selected.byteLength || (await sha256(body)) !== selected.sha256)
+    throw new Error("stored content integrity failure");
+  return body;
+}