@substrat-run/kernel 0.133.0 → 0.134.0

package/dist/attachment-text.js

@@ -0,0 +1,497 @@
+/**
+ * Attachment content search (#1575): the text an attachment's bytes carry, extracted off
+ * the upload by a job and indexed in the scope, keyed by attachment id.
+ *
+ * `ctx.search` answers over an entity's declared columns. An attachment had nothing but
+ * its filename there, because nothing ever read its bytes. This is the reading, and the
+ * place the result lands. It is kernel-owned for the reasons the entity index is (see
+ * `search-index.ts`): no module may write `_substrat_attachments`'s neighbourhood, a
+ * kernel-maintained index cannot be desynchronised by a writer that forgets it, and the
+ * permission gate is already the kernel's.
+ *
+ * ## The flow
+ *
+ * 1. **Upload** writes the attachment row, a `pending` text row and a job run
+ *    (`ATTACHMENT_TEXT_MODULE` / `ATTACHMENT_TEXT_JOB`, instance = the attachment id), all
+ *    in the upload's own transaction. Nothing is extracted on the upload path, so an
+ *    extraction failure cannot fail an upload: the bytes and the record have landed
+ *    whatever happens next.
+ * 2. **The job driver** (`runDueJobs`, which the scope sweeper calls when a deployment
+ *    opts into `runJobs`) runs `attachmentTextJob`: read the record, read the bytes, run
+ *    the host's extractor for its type (K-43), write the outcome. Each adapter supplies
+ *    the handler itself for this key, so no deployment has to register it.
+ * 3. **Search** is `ScopeAttachments.search`, authorized before it matches (below).
+ *
+ * ## Reading the bytes needs no grant, and that is deliberate
+ *
+ * Extraction is a derivation the kernel owns, like the entity index's triggers reading a
+ * module's rows. Reading through `getSystemAttachments` instead would need
+ * `system:<module>` to hold every target's read key, and a CP-less vertical has no way to
+ * seat that grant short of declaring a schedule it does not have. The gate that decides
+ * what a PERSON learns is at search time, and it is the same check `list` and `open` make.
+ *
+ * ## The search gate, and what it refuses to leak
+ *
+ * A search AUTHORIZES FIRST, from the scope and the caller alone, and only then matches
+ * (`searchAttachments`). The owners the caller may read — the check `open` makes, the
+ * target's `readPermission` on the owning entity — are decided before the term is looked
+ * at, and handed to the query, so `ORDER BY … LIMIT` runs over readable rows only. A match
+ * the caller cannot open neither appears nor takes a slot, however many there are: the
+ * page a caller gets is the page they would get if those attachments did not exist. And
+ * because nothing is examined and then dropped, there is no scan bound whose cutoff — or
+ * whose running time — depends on hidden rows. Three more choices follow from the same
+ * rule, each because the alternative would leak.
+ *
+ * - **No count and no "more" marker.** Either would count matches the caller cannot see.
+ * - **No score, and newest-first order instead of relevance.** FTS5's `bm25` weighs a term
+ *   by how many documents in the WHOLE index contain it, including the ones the caller
+ *   cannot open. Exposing the score, or ordering a multi-term result by it, would let a
+ *   caller infer how often a term occurs in attachments they may not read. Ordering by
+ *   attachment id (a ULID, so upload time) depends only on rows the caller can see.
+ * - **No snippet.** A snippet is text from the attachment, and producing one for a denied
+ *   row would be the leak itself.
+ *
+ * The bound that remains is on authorization, not on matches: a caller without scope-level
+ * read on a target type has its owners checked one by one, at most
+ * `ATTACHMENT_SEARCH_OWNER_MAX` of them, and past that the search is refused with a stable
+ * reason (`ATTACHMENT_SEARCH_TOO_MANY_OWNERS`). Whether it refuses depends on the scope's
+ * owner count and the caller's rights — the same answer for every term. What still scales
+ * with every match is the FTS index's own read of its posting lists, which is the same work
+ * whoever asks.
+ *
+ * ## Where the text lives, and where it does not go
+ *
+ * Both tables carry the `_substrat_search_` prefix, which is what keeps them out of every
+ * scope dump (`isSearchIndexTable`). That is the point, not a convenience: a dump carries
+ * an attachment's METADATA row and never its bytes, so the text extracted from those bytes
+ * stays where the bytes are. A restore or a preview carry that brings an attachment row
+ * back re-queues its extraction (`reconcileAttachmentText`), which re-reads the bytes if
+ * they are still there — the same scope — and records a legible failure where they are
+ * not, as in a fork into a new scope. The lake streams the outbox only, so the text never
+ * reaches it either.
+ *
+ * Erasure: `shredSubject` does not reach attachments — they carry no subject and their
+ * bytes are not sealed per subject — so there is no shred path for the text to outlive.
+ * What does make bytes unreadable is deleting the attachment row (`remove`, or any other
+ * delete), and a trigger on `_substrat_attachments` removes the text row with it, which
+ * takes its index entries out through the index's own triggers.
+ */
+import { attachmentRecord, substratError, utf8Length, } from '@substrat-run/contracts';
+import { attachmentSha256 } from './scope-host.js';
+import { searchLimit, searchMatchExpression } from './search-index.js';
+import { DEFAULT_ATTACHMENT_TEXT_BOUNDS, assertAttachmentTextBounds, chooseAttachmentExtractor, inputBoundRefusal, mediaTypeOf, runAttachmentExtractor, } from './attachment-extractor.js';
+/** The job's module: the kernel itself, which owns the index. Parses as a `ModuleId`. */
+export const ATTACHMENT_TEXT_MODULE = '@substrat-run/kernel';
+/** The job's name. With the module, the key every adapter supplies a handler for. */
+export const ATTACHMENT_TEXT_JOB = 'attachment-text';
+/** Is this run one of the kernel's extraction runs? */
+export function isAttachmentTextRun(run) {
+    return run.module_id === ATTACHMENT_TEXT_MODULE && run.job === ATTACHMENT_TEXT_JOB;
+}
+/**
+ * Refuse a job registered under the kernel's own module id — every adapter's `registerJob`
+ * calls this first.
+ *
+ * The kernel's jobs are each host's own: it supplies their handlers at dispatch, bound to
+ * the scope it is driving, and dispatch looks there before the registry. A handler
+ * registered under the kernel's id would therefore never run, and say nothing — the one
+ * outcome a registration must not have. The whole id is reserved, not only today's job
+ * name, so a later kernel job cannot be shadowed by a registration that predates it.
+ */
+export function assertJobRegistrable(moduleId, name) {
+    if (moduleId === ATTACHMENT_TEXT_MODULE) {
+        throw new Error(`job '${moduleId}/${name}' is reserved: '${ATTACHMENT_TEXT_MODULE}' jobs are the host's own, ` +
+            'so a handler registered under that module id would never run');
+    }
+}
+/**
+ * The text rows and their index, as both adapters build them.
+ *
+ * Shared for the reason `JOB_RUN_DDL` is: `lint:spine-ddl` compares what each adapter's
+ * `KERNEL_DDL` executes, and one definition keeps the two the same shape.
+ *
+ * **The double underscore is a reservation.** A module's derived index is named
+ * `_substrat_search_<slug(module)>_<slug(entity)>`, and `slug` can never produce a leading
+ * underscore, so no module's index can ever collide with these two names.
+ *
+ * **External content.** The index stores terms and points at the text row's `rid`; the
+ * text is stored once, in the row. The three triggers keep the index in step with the
+ * row however it is written, and the fourth removes the row when its attachment goes.
+ * Interpolated into each adapter's `KERNEL_DDL` after `_substrat_attachments`, which the
+ * fourth trigger names.
+ *
+ * **Only a body reaches the index.** Most rows never carry one — every upload starts
+ * `pending`, and an image or a PDF stays bodiless — so the index triggers are guarded on
+ * it: a NULL body would index no term and still cost the index's own bookkeeping writes,
+ * inside the upload's transaction. An update that leaves the body as it was (a replayed
+ * extraction) re-tokenizes nothing.
+ */
+export const ATTACHMENT_TEXT_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_search__attachment_text (
+    -- The rowid alias the index points at. Never exposed: the attachment id is the key.
+    rid INTEGER PRIMARY KEY,
+    attachment_id TEXT NOT NULL UNIQUE,
+    -- 'pending' | 'indexed' | 'empty' | 'unsupported' | 'failed'. Only 'indexed' has a body.
+    status TEXT NOT NULL,
+    -- Which extractor ran ('text', 'html', 'docx', 'xlsx', 'pptx'). NULL while pending,
+    -- and for a type no extractor reads.
+    extractor TEXT,
+    -- The extracted text, normalized and capped. NULL unless indexed.
+    body TEXT,
+    -- UTF-8 bytes of body. NULL unless indexed.
+    body_bytes INTEGER,
+    -- 1 when body was cut at the per-attachment bound.
+    truncated INTEGER NOT NULL DEFAULT 0,
+    -- Why there is no body: the unsupported type, the damaged file, the bound exceeded.
+    -- Never quotes the file.
+    detail TEXT,
+    updated_at TEXT NOT NULL
+  );
+  CREATE VIRTUAL TABLE IF NOT EXISTS _substrat_search__attachments USING fts5(
+    body, content='_substrat_search__attachment_text', content_rowid='rid', tokenize='unicode61'
+  );
+  CREATE TRIGGER IF NOT EXISTS _substrat_search__attachment_text_ai
+    AFTER INSERT ON _substrat_search__attachment_text WHEN new.body IS NOT NULL BEGIN
+    INSERT INTO _substrat_search__attachments(rowid, body) VALUES (new.rid, new.body);
+  END;
+  CREATE TRIGGER IF NOT EXISTS _substrat_search__attachment_text_ad
+    AFTER DELETE ON _substrat_search__attachment_text WHEN old.body IS NOT NULL BEGIN
+    INSERT INTO _substrat_search__attachments(_substrat_search__attachments, rowid, body)
+      VALUES ('delete', old.rid, old.body);
+  END;
+  CREATE TRIGGER IF NOT EXISTS _substrat_search__attachment_text_au
+    AFTER UPDATE ON _substrat_search__attachment_text WHEN old.body IS NOT new.body BEGIN
+    INSERT INTO _substrat_search__attachments(_substrat_search__attachments, rowid, body)
+      SELECT 'delete', old.rid, old.body WHERE old.body IS NOT NULL;
+    INSERT INTO _substrat_search__attachments(rowid, body)
+      SELECT new.rid, new.body WHERE new.body IS NOT NULL;
+  END;
+  CREATE TRIGGER IF NOT EXISTS _substrat_attachments_text_ad
+    AFTER DELETE ON _substrat_attachments BEGIN
+    DELETE FROM _substrat_search__attachment_text WHERE attachment_id = old.id;
+  END;
+`;
+/*
+ * The writes below take the kernel's own UNGUARDED spine handle (`spineSql` on the pure
+ * adapter, `doSpineSql` on the DO). Both drivers are synchronous, so each write runs inside
+ * whatever transaction the caller already holds — the upload's, or a restore's.
+ */
+const RUN_PAYLOAD_KEY = 'attachmentId';
+/**
+ * Start one attachment's extraction run unless a LIVE one exists — the driver's own
+ * coalescing rule (`startJobRun`), as one statement, so a re-queue joins an extraction in
+ * flight rather than racing it.
+ */
+function startAttachmentTextRun(sql, attachmentId, runId, at) {
+    sql.exec(`INSERT INTO _substrat_job_runs
+       (id, module_id, job, instance, payload, subject_id, status, cursor, counters, attempts,
+        last_error, started_at, updated_at, next_attempt_at, ended_at)
+     SELECT ?, ?, ?, ?, ?, NULL, 'running', NULL, '{}', 0, NULL, ?, ?, NULL, NULL
+      WHERE NOT EXISTS (
+        SELECT 1 FROM _substrat_job_runs
+         WHERE module_id = ? AND job = ? AND instance = ? AND status = 'running'
+      )`, [
+        runId,
+        ATTACHMENT_TEXT_MODULE,
+        ATTACHMENT_TEXT_JOB,
+        attachmentId,
+        JSON.stringify({ [RUN_PAYLOAD_KEY]: attachmentId }),
+        at,
+        at,
+        ATTACHMENT_TEXT_MODULE,
+        ATTACHMENT_TEXT_JOB,
+        attachmentId,
+    ]);
+}
+/**
+ * Queue one attachment's extraction: a `pending` row and a coalesced run, inside the
+ * caller's transaction. An existing text row is left as it is: re-extracting an indexed
+ * attachment keeps its current text searchable until the new outcome replaces it.
+ */
+export function enqueueAttachmentText(sql, attachmentId, runId, at) {
+    sql.exec(`INSERT INTO _substrat_search__attachment_text (attachment_id, status, updated_at)
+       VALUES (?, 'pending', ?)
+       ON CONFLICT (attachment_id) DO NOTHING`, [attachmentId, at]);
+    startAttachmentTextRun(sql, attachmentId, runId, at);
+}
+/**
+ * Write one extraction outcome — only while the attachment still exists.
+ *
+ * A run reads the bytes outside any lock, so the attachment can be removed while it
+ * extracts. The remove's trigger has already taken the text row away; an unguarded upsert
+ * would put the text of a deleted attachment straight back. So the existence check and
+ * the write are one statement, and the return says which happened.
+ *
+ * Idempotent: the same outcome written twice leaves one row and one set of index entries,
+ * because an upsert on a present row is an UPDATE, whose trigger replaces the old terms
+ * with the new ones (and touches nothing when the body did not change).
+ */
+export function recordAttachmentText(sql, attachmentId, outcome, at) {
+    const indexed = outcome.status === 'indexed' ? outcome : null;
+    const { changes } = sql.exec(`INSERT INTO _substrat_search__attachment_text
+       (attachment_id, status, extractor, body, body_bytes, truncated, detail, updated_at)
+     SELECT ?, ?, ?, ?, ?, ?, ?, ?
+      WHERE EXISTS (SELECT 1 FROM _substrat_attachments WHERE id = ?)
+     ON CONFLICT (attachment_id) DO UPDATE SET
+       status = excluded.status, extractor = excluded.extractor, body = excluded.body,
+       body_bytes = excluded.body_bytes, truncated = excluded.truncated,
+       detail = excluded.detail, updated_at = excluded.updated_at`, [
+        attachmentId,
+        outcome.status,
+        'extractor' in outcome ? outcome.extractor : null,
+        indexed?.text ?? null,
+        indexed ? utf8Length(indexed.text) : null,
+        indexed?.truncated ? 1 : 0,
+        'detail' in outcome ? outcome.detail : null,
+        at,
+        attachmentId,
+    ]);
+    return changes > 0;
+}
+/**
+ * After a restore or a fork: drop text whose attachment the load did not bring back, and
+ * queue extraction for every attachment that has no text row.
+ *
+ * The text tables are not in a dump, so a load leaves them as they were: an in-place
+ * restore keeps the text of attachments that exist on both sides (an attachment id names
+ * one write-once object, so that text is still the text of those bytes), and holds rows
+ * for attachments the restore rewound away, which must go. A fork starts with none.
+ * Every attachment row without text is queued; its run re-reads the bytes, and where they
+ * are not reachable — a fork, whose objects stay under the source scope's key — the
+ * outcome is a `failed` row that says so.
+ */
+export function reconcileAttachmentText(sql, mintId, at) {
+    const removed = sql.query(`DELETE FROM _substrat_search__attachment_text
+      WHERE attachment_id NOT IN (SELECT id FROM _substrat_attachments)
+     RETURNING attachment_id`).length;
+    const queued = sql.query(`INSERT INTO _substrat_search__attachment_text (attachment_id, status, updated_at)
+     SELECT id, 'pending', ? FROM _substrat_attachments
+      WHERE id NOT IN (SELECT attachment_id FROM _substrat_search__attachment_text)
+     RETURNING attachment_id`, [at]);
+    // One run each: a run id is a ULID, which SQL cannot mint.
+    for (const { attachment_id } of queued)
+        startAttachmentTextRun(sql, attachment_id, mintId(), at);
+    return { removed, queued: queued.length };
+}
+/**
+ * An attachment's extraction state, or null when none was ever recorded — an attachment
+ * uploaded before extraction existed, or one a fork carried without its text.
+ *
+ * Reads the spine through `ctx.sql`, which module code may (it may never write it). Like
+ * `readTimeline`, it checks no permission: the caller does, first, as it would before
+ * `open`.
+ *
+ * A `pending` row whose latest run has FAILED is reported as `failed`, with the run's
+ * error. That run will not be retried, so "pending" would be a promise nobody keeps; the
+ * row itself is left alone so a re-queue picks it up.
+ */
+export function readAttachmentText(ctx, attachmentId) {
+    const rows = ctx.sql.query(`SELECT t.attachment_id, t.status, t.extractor, t.body_bytes, t.truncated, t.detail, t.updated_at,
+            r.status AS run_status, r.last_error AS run_error
+       FROM _substrat_search__attachment_text t
+       LEFT JOIN _substrat_job_runs r ON r.id = (
+         SELECT id FROM _substrat_job_runs
+          WHERE module_id = ? AND job = ? AND instance = t.attachment_id
+          ORDER BY id DESC LIMIT 1
+       )
+      WHERE t.attachment_id = ?`, [ATTACHMENT_TEXT_MODULE, ATTACHMENT_TEXT_JOB, attachmentId]);
+    const row = rows[0];
+    if (!row)
+        return null;
+    const stalled = row.status === 'pending' && row.run_status === 'failed';
+    return {
+        attachmentId: row.attachment_id,
+        status: stalled ? 'failed' : row.status,
+        extractor: row.extractor,
+        bytes: row.body_bytes === null ? null : Number(row.body_bytes),
+        truncated: Number(row.truncated) === 1,
+        detail: stalled ? `extraction run failed: ${row.run_error ?? 'unknown error'}` : row.detail,
+        updatedAt: row.updated_at,
+    };
+}
+// -- search -----------------------------------------------------------------------------
+/**
+ * The most owners a search will check one by one, for a caller without scope-level read
+ * on their type. Past it the search is REFUSED (`ATTACHMENT_SEARCH_TOO_MANY_OWNERS`), never
+ * truncated: a truncated owner set would drop readable hits silently, by an order the
+ * caller cannot see.
+ */
+export const ATTACHMENT_SEARCH_OWNER_MAX = 2_000;
+/** The `forbidden` reason a refused search carries — stable, so a UI can explain it. */
+export const ATTACHMENT_SEARCH_TOO_MANY_OWNERS = 'attachment_search_too_many_owners';
+/** A check that cannot answer is a check that refuses: an evaluator failure is never a disclosure. */
+const allows = async (decision) => {
+    try {
+        return (await decision()).allowed;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Authorize FIRST, from the scope and the caller alone — never from the term or its matches.
+ *
+ * 1. Each declared target type is checked once at the SCOPE: an allow there is an allow on
+ *    every entity of the type (the evaluator grants at the node before it walks an entity,
+ *    and the walk only adds), so the type is "wide" and costs nothing more. A caller with
+ *    a role or a scope grant — staff, editors — stops here: one check per declared type.
+ * 2. For every other type, the owners that HAVE indexed text are enumerated and checked one
+ *    by one. Only a narrowed caller pays this (entity grants, a capability), and it is
+ *    bounded by `ATTACHMENT_SEARCH_OWNER_MAX`.
+ *
+ * Neither step reads a match, so what this costs and whether it refuses depend on the
+ * scope's owners and the caller's rights only: nothing about what the term would find.
+ */
+async function readableOwners(sql, gate) {
+    const wideTypes = [];
+    const narrowTypes = [];
+    for (const [entityType, target] of gate.targets) {
+        (await allows(() => gate.check(target.read)) ? wideTypes : narrowTypes).push(entityType);
+    }
+    if (narrowTypes.length === 0)
+        return { wideTypes, owners: [] };
+    const candidates = sql.query(ATTACHMENT_SEARCH_OWNERS_SQL, [
+        JSON.stringify(narrowTypes),
+        ATTACHMENT_SEARCH_OWNER_MAX + 1,
+    ]);
+    if (candidates.length > ATTACHMENT_SEARCH_OWNER_MAX) {
+        throw substratError('forbidden', `attachment search: this scope has more than ${ATTACHMENT_SEARCH_OWNER_MAX} owners with indexed ` +
+            'files of a type the caller holds no scope-level read on, too many to authorize one by one', { reason: ATTACHMENT_SEARCH_TOO_MANY_OWNERS });
+    }
+    const owners = [];
+    for (const { entity_type: entityType, entity_id: entityId } of candidates) {
+        const read = gate.targets.get(entityType).read;
+        if (await allows(() => gate.check(read, { entityType, entityId })))
+            owners.push([entityType, entityId]);
+    }
+    return { wideTypes, owners };
+}
+/**
+ * The owners a narrowed caller is checked over: those of the given types that HAVE text,
+ * one more than the cap so a refusal can tell "at the cap" from "past it". Walks the
+ * `(entity_type, entity_id)` index on `_substrat_attachments`. Params: types (JSON array),
+ * limit.
+ */
+export const ATTACHMENT_SEARCH_OWNERS_SQL = `SELECT DISTINCT a.entity_type, a.entity_id
+   FROM _substrat_attachments a
+   JOIN _substrat_search__attachment_text t ON t.attachment_id = a.id
+  WHERE t.body IS NOT NULL AND a.entity_type IN (SELECT value FROM json_each(?))
+  ORDER BY a.entity_type, a.entity_id
+  LIMIT ?`;
+/**
+ * The match, restricted to readable owners BEFORE the order and the limit. A wide type is
+ * one `IN` over the JSON array of types; a narrowed owner is a row-value `IN` over JSON
+ * pairs, which SQLite answers from an ephemeral index on the subquery rather than per
+ * pair — one bound JSON array, never a `?` per owner, since a Durable Object refuses the
+ * 101st parameter. Params: match, wide types (JSON array), owners (JSON array of
+ * `[entityType, entityId]`), limit.
+ */
+export const ATTACHMENT_SEARCH_SQL = `SELECT a.id, a.entity_type, a.entity_id, a.filename, a.content_type, a.size,
+        a.sha256, a.visibility, a.created_by, a.created_at
+   FROM _substrat_search__attachments
+   JOIN _substrat_search__attachment_text t ON t.rid = _substrat_search__attachments.rowid
+   JOIN _substrat_attachments a ON a.id = t.attachment_id
+  WHERE _substrat_search__attachments MATCH ?
+    AND (a.entity_type IN (SELECT value FROM json_each(?))
+         OR (a.entity_type, a.entity_id) IN
+            (SELECT json_extract(value, '$[0]'), json_extract(value, '$[1]') FROM json_each(?)))
+  ORDER BY a.id DESC
+  LIMIT ?`;
+/**
+ * Search extracted text: attachments the caller may open, newest first, at most `limit`.
+ *
+ * The readable owners are decided first (`readableOwners`) and handed to the query, so the
+ * `ORDER BY … LIMIT` runs over readable rows only: a match the caller cannot open neither
+ * appears nor takes a slot, however many there are or how new. Nothing is examined and then
+ * dropped, so there is no scan bound whose cutoff could depend on hidden rows.
+ *
+ * The term is judged before anything else, so a too-short term refuses at no cost. The FTS
+ * table is not aliased: its own name is the hidden column `MATCH` reads (`searchQuery`).
+ */
+export async function searchAttachments(sql, gate, term, limit) {
+    const match = searchMatchExpression(term, 'prefix');
+    const { wideTypes, owners } = await readableOwners(sql, gate);
+    if (wideTypes.length === 0 && owners.length === 0)
+        return [];
+    return sql
+        .query(ATTACHMENT_SEARCH_SQL, [
+        match,
+        JSON.stringify(wideTypes),
+        JSON.stringify(owners),
+        searchLimit(limit),
+    ])
+        .map(attachmentRecordOfRow);
+}
+/** The metadata fact an attachment row records — parsed, so a malformed row throws here. */
+export function attachmentRecordOfRow(row) {
+    return attachmentRecord.parse({
+        id: row.id,
+        entity: { entityType: row.entity_type, entityId: row.entity_id },
+        filename: row.filename,
+        contentType: row.content_type,
+        size: Number(row.size),
+        sha256: row.sha256,
+        visibility: row.visibility,
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+    });
+}
+function attachmentIdOf(payload) {
+    const id = payload?.[RUN_PAYLOAD_KEY];
+    if (typeof id !== 'string' || id.length === 0) {
+        throw new Error('attachment-text run payload carries no attachmentId');
+    }
+    return id;
+}
+/**
+ * The extraction job: one pass per attachment, done when its outcome is written.
+ *
+ * Everything decidable without the bytes is decided first — no extractor for the type, a
+ * recorded size over the input bound — so those files are never fetched. Bytes that are
+ * gone, or that no longer match the recorded hash, are recorded `failed`: retrying cannot
+ * bring them back. Only a throw from the store is retried, by the driver's backoff; what
+ * the EXTRACTOR does, it answers for in its outcome (`runAttachmentExtractor`).
+ *
+ * The extractors are the host's, handed in (K-43): the kernel parses no format itself.
+ *
+ * No `step()`: the pass is one idempotent unit (read, extract, upsert), so a replay after
+ * a crash simply does it again, and a step memo would only park the extracted text in
+ * `_substrat_job_steps`, which a dump carries.
+ */
+export function attachmentTextJob(source, extractors, bounds = DEFAULT_ATTACHMENT_TEXT_BOUNDS) {
+    assertAttachmentTextBounds(bounds);
+    const outcomeFor = async (record) => {
+        const extractor = chooseAttachmentExtractor(extractors, record.contentType, record.filename);
+        if (!extractor) {
+            return {
+                status: 'unsupported',
+                detail: `no extractor for content type '${mediaTypeOf(record.contentType) || 'unknown'}'`,
+            };
+        }
+        const failed = (detail) => ({ status: 'failed', extractor: extractor.name, detail });
+        // The kernel's ceiling first and on its own, then the extractor's own bound if it is a valid
+        // one: an invalid declaration (a `NaN` past the host's check) can disable neither.
+        const refusal = inputBoundRefusal(record.size, extractor, bounds);
+        if (refusal !== null)
+            return failed(refusal);
+        const body = await source.bytes(record);
+        if (body === null)
+            return failed('the bytes are missing from the blob store');
+        if ((await attachmentSha256(body)) !== record.sha256)
+            return failed('the bytes do not match the recorded sha256');
+        return runAttachmentExtractor(extractor, { body, contentType: record.contentType, filename: record.filename }, bounds);
+    };
+    return async (pass) => {
+        const attachmentId = attachmentIdOf(pass.payload);
+        const record = await source.record(attachmentId);
+        if (!record) {
+            pass.count('gone');
+            return { done: true };
+        }
+        const outcome = await outcomeFor(record);
+        const kept = await source.write(attachmentId, outcome);
+        pass.count(kept ? outcome.status : 'gone');
+        return { done: true };
+    };
+}
+//# sourceMappingURL=attachment-text.js.map

package/dist/attachment-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-text.js","sourceRoot":"","sources":["../src/attachment-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,GAMX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAkB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAkC,CAAC;AAEzE,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CAAC,GAAuC;IACzE,OAAO,GAAG,CAAC,SAAS,KAAK,sBAAsB,IAAI,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC;AACrF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAY;IACjE,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,QAAQ,QAAQ,IAAI,IAAI,mBAAmB,sBAAsB,6BAA6B;YAC5F,8DAA8D,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4ClC,CAAC;AAkBF;;;;GAIG;AAEH,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAc,EAAE,YAAoB,EAAE,KAAa,EAAE,EAAU;IAC7F,GAAG,CAAC,IAAI,CACN;;;;;;;QAOI,EACJ;QACE,KAAK;QACL,sBAAsB;QACtB,mBAAmB;QACnB,YAAY;QACZ,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC;QACnD,EAAE;QACF,EAAE;QACF,sBAAsB;QACtB,mBAAmB;QACnB,YAAY;KACb,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAc,EAAE,YAAoB,EAAE,KAAa,EAAE,EAAU;IACnG,GAAG,CAAC,IAAI,CACN;;8CAE0C,EAC1C,CAAC,YAAY,EAAE,EAAE,CAAC,CACnB,CAAC;IACF,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAc,EACd,YAAoB,EACpB,OAA0B,EAC1B,EAAU;IAEV,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAC1B;;;;;;;kEAO8D,EAC9D;QACE,YAAY;QACZ,OAAO,CAAC,MAAM;QACd,WAAW,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACjD,OAAO,EAAE,IAAI,IAAI,IAAI;QACrB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACzC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC3C,EAAE;QACF,YAAY;KACb,CACF,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAc,EACd,MAAoB,EACpB,EAAU;IAEV,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CACvB;;6BAEyB,CAC1B,CAAC,MAAM,CAAC;IACT,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CACtB;;;6BAGyB,EACzB,CAAC,EAAE,CAAC,CACL,CAAC;IACF,2DAA2D;IAC3D,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,MAAM;QAAE,sBAAsB,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA+C,EAC/C,YAAoB;IAEpB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAWxB;;;;;;;;gCAQ4B,EAC5B,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;IACxE,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;QACvC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,KAAK,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,GAAG,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;QAC3F,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,0FAA0F;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAC;AAkBrF,sGAAsG;AACtG,MAAM,MAAM,GAAG,KAAK,EAAE,QAAiC,EAAoB,EAAE;IAC3E,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,GAA6B,EAAE,IAA0B;IACrF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAA6C,4BAA4B,EAAE;QACrG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;QAC3B,2BAA2B,GAAG,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACpD,MAAM,aAAa,CACjB,WAAW,EACX,+CAA+C,2BAA2B,uBAAuB;YAC/F,2FAA2F,EAC7F,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC;QAChD,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;UAKlC,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;UAU3B,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAA6B,EAC7B,IAA0B,EAC1B,IAAY,EACZ,KAAa;IAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,OAAO,GAAG;SACP,KAAK,CAAqB,qBAAqB,EAAE;QAChD,KAAK;QACL,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACtB,WAAW,CAAC,KAAK,CAAC;KACnB,CAAC;SACD,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAChC,CAAC;AAgBD,4FAA4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAC5B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;QAChE,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC,CAAC;AACL,CAAC;AAqBD,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,EAAE,GAAI,OAA0C,EAAE,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA4B,EAC5B,UAA0C,EAC1C,MAAM,GAAyB,8BAA8B;IAE7D,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,EAAE,MAAwB,EAA8B,EAAE;QAChF,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,kCAAkC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,SAAS,GAAG;aAC1F,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAqB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAChH,6FAA6F;QAC7F,mFAAmF;QACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAClH,OAAO,sBAAsB,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IACzH,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/idempotency.d.ts

@@ -98,9 +98,10 @@ export declare function idempotencyLookupQuery(subject: CheckSubject, key: strin
  * - **Reuse.** Same key, different request. The client's assertion that this is
  *   the request it sent before is false, and the one thing that must not happen
  *   is serving the earlier request's response to it.
- * - **Unavailable.** The original response was too large to record. Refused
- *   rather than re-executed, which is the fail-closed direction: an error the
- *   caller can act on, instead of the duplicate work the key was sent to avoid.
+ * - **Unavailable.** The original response was too large to record, or a subject
+ *   erasure has since redacted it (#1632). Refused rather than re-executed, which
+ *   is the fail-closed direction: an error the caller can act on, instead of the
+ *   duplicate work the key was sent to avoid.
  */
 export declare function replayFor(key: string, fingerprint: string, row: IdempotencyRow): IdempotentReplay;
 /**

package/dist/idempotency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,+nCAuB3B,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMtD;AAED,2CAA2C;AAC3C,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAO3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,cAAc,GAClB,gBAAgB,CAsBlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,EAAE,EAAE,MAAM,GACT;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,CAmBzG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;CAAE,CAMxF;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpE"}
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,+nCAuB3B,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMtD;AAED,2CAA2C;AAC3C,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAO3C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,cAAc,GAClB,gBAAgB,CAgClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,EAAE,EAAE,MAAM,GACT;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,CAmBzG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;CAAE,CAMxF;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpE"}

package/dist/idempotency.js

@@ -1,4 +1,5 @@
 import { IDEMPOTENCY_REPLAY_UNAVAILABLE, IDEMPOTENCY_RESULT_LIMIT, IDEMPOTENCY_RETENTION_MS, IDEMPOTENCY_REUSED, isValidIdempotencyKey, subjectRef, substratError, } from '@substrat-run/contracts';
+import { isRedactedPayload } from './subject-redaction.js';
 /**
  * The spine half of request idempotency (#116) — what remembers a key, and what
  * a second request carrying it is answered with.
@@ -117,9 +118,10 @@ export function idempotencyLookupQuery(subject, key) {
  * - **Reuse.** Same key, different request. The client's assertion that this is
  *   the request it sent before is false, and the one thing that must not happen
  *   is serving the earlier request's response to it.
- * - **Unavailable.** The original response was too large to record. Refused
- *   rather than re-executed, which is the fail-closed direction: an error the
- *   caller can act on, instead of the duplicate work the key was sent to avoid.
+ * - **Unavailable.** The original response was too large to record, or a subject
+ *   erasure has since redacted it (#1632). Refused rather than re-executed, which
+ *   is the fail-closed direction: an error the caller can act on, instead of the
+ *   duplicate work the key was sent to avoid.
  */
 export function replayFor(key, fingerprint, row) {
     if (row.fingerprint !== fingerprint) {
@@ -131,10 +133,16 @@ export function replayFor(key, fingerprint, row) {
             'so this retry cannot be answered from it — the original request did complete, ' +
             'and re-running it would duplicate the work the key exists to prevent', { reason: IDEMPOTENCY_REPLAY_UNAVAILABLE });
     }
-    return {
-        result: row.result === null ? undefined : JSON.parse(row.result),
-        entityVersion: row.entity_version,
-    };
+    const result = row.result === null ? undefined : JSON.parse(row.result);
+    // A subject erasure (#1632) replaced the recorded response with its tombstone. Refused like
+    // an oversized one, for the same reason: the original did complete, so running it again is
+    // the one answer that is certainly wrong, and the tombstone is not the response it sent.
+    if (isRedactedPayload(result)) {
+        throw substratError('conflict', `the original response for Idempotency-Key '${key}' was redacted by a subject erasure, ` +
+            'so this retry cannot be answered from it — the original request did complete, ' +
+            'and re-running it would duplicate the work the key exists to prevent', { reason: IDEMPOTENCY_REPLAY_UNAVAILABLE });
+    }
+    return { result, entityVersion: row.entity_version };
 }
 /**
  * The row a completed operation leaves behind.

package/dist/idempotency.js.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,GAEd,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuB9B,CAAC;AAiBF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB;IACtD,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,MAAM,aAAa,CACjB,mBAAmB,EACnB,uEAAuE,CACxE,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,sBAAsB,CACpC,OAAqB,EACrB,GAAW;IAEX,OAAO;QACL,GAAG,EACD,mEAAmE;YACnE,0DAA0D;QAC5D,MAAM,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,WAAmB,EACnB,GAAmB;IAEnB,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,aAAa,CACjB,UAAU,EACV,oBAAoB,GAAG,6CAA6C;YAClE,IAAI,GAAG,CAAC,SAAS,kDAAkD,EACrE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,aAAa,CACjB,UAAU,EACV,8CAA8C,GAAG,6BAA6B;YAC5E,gFAAgF;YAChF,sEAAsE,EACxE,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAChE,aAAa,EAAE,GAAG,CAAC,cAAc;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAqB,EACrB,GAAW,EACX,SAAiB,EACjB,WAAmB,EACnB,MAAe,EACf,aAA4B,EAC5B,EAAU;IAEV,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,GAAG,wBAAwB,CAAC;IACtF,OAAO;QACL,GAAG,EACD,oCAAoC;YACpC,yFAAyF;YACzF,iCAAiC;QACnC,MAAM,EAAE;YACN,kBAAkB,CAAC,OAAO,CAAC;YAC3B,GAAG;YACH,SAAS;YACT,WAAW;YACX,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC7B,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,aAAa;YACb,EAAE;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO;QACL,GAAG,EAAE,yDAAyD;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,OAAO,CACL,GAAG,SAAS,0EAA0E;QACtF,yEAAyE,CAC1E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,GAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuB9B,CAAC;AAiBF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB;IACtD,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,MAAM,aAAa,CACjB,mBAAmB,EACnB,uEAAuE,CACxE,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,sBAAsB,CACpC,OAAqB,EACrB,GAAW;IAEX,OAAO;QACL,GAAG,EACD,mEAAmE;YACnE,0DAA0D;QAC5D,MAAM,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,WAAmB,EACnB,GAAmB;IAEnB,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,aAAa,CACjB,UAAU,EACV,oBAAoB,GAAG,6CAA6C;YAClE,IAAI,GAAG,CAAC,SAAS,kDAAkD,EACrE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,aAAa,CACjB,UAAU,EACV,8CAA8C,GAAG,6BAA6B;YAC5E,gFAAgF;YAChF,sEAAsE,EACxE,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAY,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjF,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,UAAU,EACV,8CAA8C,GAAG,uCAAuC;YACtF,gFAAgF;YAChF,sEAAsE,EACxE,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAqB,EACrB,GAAW,EACX,SAAiB,EACjB,WAAmB,EACnB,MAAe,EACf,aAA4B,EAC5B,EAAU;IAEV,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,GAAG,wBAAwB,CAAC;IACtF,OAAO;QACL,GAAG,EACD,oCAAoC;YACpC,yFAAyF;YACzF,iCAAiC;QACnC,MAAM,EAAE;YACN,kBAAkB,CAAC,OAAO,CAAC;YAC3B,GAAG;YACH,SAAS;YACT,WAAW;YACX,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC7B,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,aAAa;YACb,EAAE;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO;QACL,GAAG,EAAE,yDAAyD;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,OAAO,CACL,GAAG,SAAS,0EAA0E;QACtF,yEAAyE,CAC1E,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-export type { AccessLogFilter, AttachmentUploadInput, AuditLogFilter, BlobStoreProvisionInput, BlobStoreRecord, ConsumerHandler, ImportHandler, ExecutorDeadLetter, ExecutorDrainReport, ExecutorHandler, ExecutorRetryPolicy, ConnectorConnection, ScopedConnectorConnection, ConnectorContext, ConnectorHandler, ConnectorOptions, ConnectorRequestInit, ConnectorResponse, Clock, FetchLike, GuardPredicate, HostAdmin, MigrateScopeOutcome, MigrationFrontier, ModuleRegistration, ConsumersOf, EventContract, EventPayloadOf, EventTypeOf, TypedConsumerHandler, TypedConsumers, OpenedAttachment, OperationContext, PageParams, OperationHandler, AppliedMigration, OpsFailureFilter, OpsFailureInput, IssueFilter, SweepRunFilter, SweepRunInput, ProvisionScopeInput, RoleFilter, FreshnessRegistration, FreshnessReport, LiveChange, LiveReadSurface, LiveRefusal, LiveUpgradeRequest, ScheduleRegistration, ScheduleRunReport, ScopeAttachments, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, ScopeStubOptions, InvokeOptions, EmittedEvent, EmittedReport, SqlMigration, SqlValue, TenantBlobStore, TenantRelationalStore, TenantStoreProvisionInput, TenantStoreRecord, } from './scope-host.js';
+export type { AccessLogFilter, AttachmentSearchOptions, AttachmentUploadInput, AuditLogFilter, BlobStoreProvisionInput, BlobStoreRecord, ConsumerHandler, ImportHandler, ExecutorDeadLetter, ExecutorDrainReport, ExecutorHandler, ExecutorRetryPolicy, ConnectorConnection, ScopedConnectorConnection, ConnectorContext, ConnectorHandler, ConnectorOptions, ConnectorRequestInit, ConnectorResponse, Clock, FetchLike, GuardPredicate, HostAdmin, MigrateScopeOutcome, MigrationFrontier, ModuleRegistration, ConsumersOf, EventContract, EventPayloadOf, EventTypeOf, TypedConsumerHandler, TypedConsumers, OpenedAttachment, OperationContext, PageParams, OperationHandler, AppliedMigration, OpsFailureFilter, OpsFailureInput, IssueFilter, TelemetryPruneReport, SweepRunFilter, SweepRunInput, ProvisionScopeInput, RoleFilter, FreshnessRegistration, FreshnessReport, LiveChange, LiveReadSurface, LiveRefusal, LiveUpgradeRequest, ScheduleRegistration, ScheduleRunReport, ScopeAttachments, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, ScopeStubOptions, InvokeOptions, EmittedEvent, EmittedReport, SqlMigration, SqlValue, TenantBlobStore, TenantRelationalStore, TenantStoreProvisionInput, TenantStoreRecord, } from './scope-host.js';
 export type { AnalyticsEngineDatasetLike, ConnectionUseOutcome, ConnectionUseTiming, ConnectorCallErrorType, ConnectorCallRecord, ConnectorCallRecorder, CountingConnectorCallRecorder, } from './connector-calls.js';
 export { CONNECTOR_CALL_DATA_POINT_LAYOUT, CONNECTOR_CALL_ERROR_TYPES, analyticsEngineConnectorCallRecorder, connectorCallDataPoint, connectorCallErrorType, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from './connector-calls.js';
-export { assertRedrainWindow, attachmentBlobKey, consumersFor, entitlementDenial, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, EMITTED_REPORT_CAP, LIVE_MODE_HEADER, isUpgradeRequest, } from './scope-host.js';
+export { assertRedrainWindow, attachmentBlobKey, attachmentSha256, consumersFor, entitlementDenial, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, TELEMETRY_PRUNE_BATCH, assertRowLimit, assertRowOffset, EMITTED_REPORT_CAP, LIVE_MODE_HEADER, isUpgradeRequest, } from './scope-host.js';
 export { isSecretBoxConfigured, SecretBoxUnconfiguredError, unconfiguredSecretBox, webCryptoSecretBox, } from './secret-box.js';
 export type { SealedSecret, SecretBox } from './secret-box.js';
 export { ConnectionSealingKeyUnavailableError, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, SealedKeyUnavailableError, } from './sealed-box.js';
@@ -23,6 +23,10 @@ export { createAtomic } from './sub-transaction.js';
 export type { RunSub, AtomicMarks } from './sub-transaction.js';
 export { DEFAULT_SEARCH_LIMIT, MAX_SEARCH_LIMIT, MIN_SEARCH_TERM, NotSearchable, SEARCH_INDEX_PREFIX, SearchTermTooShort, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchPlansByEntityType, searchQuery, } from './search-index.js';
 export type { SearchHit, SearchIndexPlan, SearchOptions, SearchTokenizer, SearchableDeclaration, } from './search-index.js';
+export { ATTACHMENT_SEARCH_OWNER_MAX, ATTACHMENT_SEARCH_OWNERS_SQL, ATTACHMENT_SEARCH_SQL, ATTACHMENT_SEARCH_TOO_MANY_OWNERS, ATTACHMENT_TEXT_DDL, ATTACHMENT_TEXT_JOB, ATTACHMENT_TEXT_MODULE, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, readAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, } from './attachment-text.js';
+export type { AttachmentRowShape, AttachmentSearchGate, AttachmentTextSource, AttachmentTextState, AttachmentTextStatus, } from './attachment-text.js';
+export { DEFAULT_ATTACHMENT_TEXT_BOUNDS, assertAttachmentExtractors, assertAttachmentTextBounds, chooseAttachmentExtractor, inputBoundRefusal, isPositiveIntegerBound, mediaTypeOf, normalizeExtractedText, runAttachmentExtractor, truncateUtf8, } from './attachment-extractor.js';
+export type { AttachmentExtractor, AttachmentExtractorInput, AttachmentExtractorResult, AttachmentTextBounds, ExtractionOutcome, ExtractionSignal, } from './attachment-extractor.js';
 export { FilterNotDeclared, LIST_INDEX_PREFIX, NotListable, SortNotDeclared, cursorOf, isListIndexName, listIndexColumns, listIndexDdl, listIndexMigrations, listIndexPlans, listPlansByEntityType, listQuery, splitCursor, } from './list-index.js';
 export type { ComposedListQuery, ListDeclaration, ListIndexPlan, ListQueryParams, } from './list-index.js';
 export { moduleMigrations } from './module-migrations.js';
@@ -41,8 +45,8 @@ export { signConnectState, verifyConnectState, ConnectStateError, CONNECT_STATE_
 export type { ConnectStateClaim } from './connect-state.js';
 export { PLATFORM_REQUEST_COLUMNS, platformRequestHistoryQuery, platformRequestOf, UNDECODED_REQUESTER, } from './platform-request-query.js';
 export type { PlatformRequestRawRow } from './platform-request-query.js';
-export { CANCELLED_INTENT_NOTE, CANCELLED_JOB_NOTE, DELIVERY_ERROR_REDACTION_SQL, intentPayloadCarriesSubject, JOB_RUN_REDACTION_SQL, JOB_STEP_REDACTION_SQL, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, REDACTED_DELIVERY_NOTE, REDACTED_INTENT_MARKER, REDACTED_INTENT_NOTE, REDACTED_JOB_NOTE, redactedIntentPayload, redactSubjectJobRuns, } from './subject-redaction.js';
-export type { LegacySubjectRedactionCounts, PlatformRequestRedactionCandidate, RedactionSql, SubjectRedactionCounts, } from './subject-redaction.js';
+export { CANCELLED_INTENT_NOTE, CANCELLED_JOB_NOTE, DELIVERY_ERROR_REDACTION_SQL, intentPayloadCarriesSubject, JOB_RUN_REDACTION_SQL, JOB_STEP_REDACTION_SQL, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, REDACTED_DELIVERY_NOTE, REDACTED_INTENT_MARKER, REDACTED_INTENT_NOTE, REDACTED_JOB_NOTE, redactedIntentPayload, redactSubjectJobRuns, REDACTED_FAILURE_NOTE, redactSubjectScopeText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, redactSubjectDirectoryText, platformIntentFailureMessage, intentIdOfFailureMessage, } from './subject-redaction.js';
+export type { LegacySubjectRedactionCounts, PlatformRequestRedactionCandidate, RedactionSql, SubjectRedactionCounts, SubjectTextTarget, IssueExemplarOwner, } from './subject-redaction.js';
 export { effectiveRoleGrantQuery, seatScopeTuple } from './scope-tuple-seat.js';
 export { repointScopeGrants, type RepointSource } from './scope-repoint.js';
 export { LEGACY_SCOPE_ROWS_BACKFILL, assertDirectoryTablesBuilt, assertSpineTablesBuilt, dumpRowsInsert, isSpineTable, loadDirectoryDump, spineColumnAdditions, spineRowsInsert, type KernelColumnsOf } from './spine-restore.js';