@substrat-run/kernel 0.159.0 → 0.161.0

package/dist/billing-retention.d.ts

@@ -0,0 +1,46 @@
+import type { RedactionSql } from './subject-redaction.js';
+/**
+ * How long the platform keeps its billing rollups (#2501): the compact per-(tenant, vertical)
+ * daily counts a later invoice, or a dispute about one, is answered from. Today that is the daily
+ * request rollup (`request-rollup.ts`) and the daily meter snapshot (`meter-days.ts`). The raw
+ * captures behind a rollup keep their own, shorter windows, and no existing retention follows
+ * this constant: the storage gauge's day rows stay `STORAGE_GAUGE_RETENTION_MONTHS` and model
+ * usage stays `MODEL_USAGE_RETENTION_DAYS`.
+ *
+ * `null` means the rollups are never pruned. That is a placeholder, not a decision: the horizon
+ * waits on the maintainer's bookkeeping, and no legal period is written here. Keeping
+ * everything is the reversible default, since a pruned row cannot be brought back while a
+ * horizon can be set later. The rollups hold counts and bytes only, never personal content.
+ */
+export declare const BILLING_ROLLUP_RETENTION_MONTHS: number | null;
+/**
+ * The first day a billing retention of `months` keeps, or null when `months` is null (kept for
+ * good). A horizon is a whole number of months, at least one. Every billing rollup prunes by it.
+ */
+export declare function billingRollupHorizon(nowMs: number, months: number | null): string | null;
+/**
+ * The UTC day `months` calendar months before `nowMs`. The day of the month is clamped to the
+ * target month's last day, so the 31st counts back to the 28th, 29th or 30th rather than rolling
+ * forward into the month after.
+ */
+export declare function utcDayMonthsBefore(nowMs: number, months: number): string;
+/** The UTC day an instant falls on. */
+export declare function utcDayOf(ms: number): string;
+/** `day`, refused unless it is a UTC day that exists (`YYYY-MM-DD`). */
+export declare function assertUtcDay(name: string, day: string): string;
+/** Push an inclusive window of UTC days onto a `WHERE` list and its parameters, each day checked first. */
+export declare function pushDayWindow(filter: {
+    since?: string;
+    until?: string;
+}, where: string[], params: (string | number)[]): void;
+/**
+ * Delete at most `limit` rows of a billing rollup's `rows` table older than a retention of
+ * `months`, oldest first, then the `records` of the days that are gone. `months` null deletes
+ * nothing. A record goes only once its day holds no row, so a day still being pruned stays marked
+ * done and is not rolled up again in between. Returns how many rows went.
+ */
+export declare function pruneBillingDays(sql: RedactionSql, tables: {
+    rows: string;
+    records: string;
+}, nowMs: number, limit: number, months: number | null): number;
+//# sourceMappingURL=billing-retention.d.ts.map

package/dist/billing-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-retention.d.ts","sourceRoot":"","sources":["../src/billing-retention.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,EAAE,MAAM,GAAG,IAAW,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAMxF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMxE;AAED,uCAAuC;AACvC,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAS5H;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,CAWR"}

package/dist/billing-retention.js

@@ -0,0 +1,78 @@
+import { utcDay } from '@substrat-run/contracts';
+import { assertRowLimit, boundedRetentionDelete } from './scope-host.js';
+/**
+ * How long the platform keeps its billing rollups (#2501): the compact per-(tenant, vertical)
+ * daily counts a later invoice, or a dispute about one, is answered from. Today that is the daily
+ * request rollup (`request-rollup.ts`) and the daily meter snapshot (`meter-days.ts`). The raw
+ * captures behind a rollup keep their own, shorter windows, and no existing retention follows
+ * this constant: the storage gauge's day rows stay `STORAGE_GAUGE_RETENTION_MONTHS` and model
+ * usage stays `MODEL_USAGE_RETENTION_DAYS`.
+ *
+ * `null` means the rollups are never pruned. That is a placeholder, not a decision: the horizon
+ * waits on the maintainer's bookkeeping, and no legal period is written here. Keeping
+ * everything is the reversible default, since a pruned row cannot be brought back while a
+ * horizon can be set later. The rollups hold counts and bytes only, never personal content.
+ */
+export const BILLING_ROLLUP_RETENTION_MONTHS = null;
+/**
+ * The first day a billing retention of `months` keeps, or null when `months` is null (kept for
+ * good). A horizon is a whole number of months, at least one. Every billing rollup prunes by it.
+ */
+export function billingRollupHorizon(nowMs, months) {
+    if (months === null)
+        return null;
+    if (!Number.isInteger(months) || months < 1) {
+        throw new Error(`a billing retention must be a whole number of months, at least one, or null, got ${String(months)}`);
+    }
+    return utcDayMonthsBefore(nowMs, months);
+}
+/**
+ * The UTC day `months` calendar months before `nowMs`. The day of the month is clamped to the
+ * target month's last day, so the 31st counts back to the 28th, 29th or 30th rather than rolling
+ * forward into the month after.
+ */
+export function utcDayMonthsBefore(nowMs, months) {
+    const now = new Date(nowMs);
+    const month = now.getUTCMonth() - months;
+    // Day 0 of the following month is the last day of the target month.
+    const lastDay = new Date(Date.UTC(now.getUTCFullYear(), month + 1, 0)).getUTCDate();
+    return new Date(Date.UTC(now.getUTCFullYear(), month, Math.min(now.getUTCDate(), lastDay))).toISOString().slice(0, 10);
+}
+/** The UTC day an instant falls on. */
+export function utcDayOf(ms) {
+    return new Date(ms).toISOString().slice(0, 10);
+}
+/** `day`, refused unless it is a UTC day that exists (`YYYY-MM-DD`). */
+export function assertUtcDay(name, day) {
+    if (!utcDay.safeParse(day).success)
+        throw new Error(`${name} must be a UTC day (YYYY-MM-DD), got ${JSON.stringify(day)}`);
+    return day;
+}
+/** Push an inclusive window of UTC days onto a `WHERE` list and its parameters, each day checked first. */
+export function pushDayWindow(filter, where, params) {
+    if (filter.since !== undefined) {
+        where.push('day >= ?');
+        params.push(assertUtcDay('since', filter.since));
+    }
+    if (filter.until !== undefined) {
+        where.push('day <= ?');
+        params.push(assertUtcDay('until', filter.until));
+    }
+}
+/**
+ * Delete at most `limit` rows of a billing rollup's `rows` table older than a retention of
+ * `months`, oldest first, then the `records` of the days that are gone. `months` null deletes
+ * nothing. A record goes only once its day holds no row, so a day still being pruned stays marked
+ * done and is not rolled up again in between. Returns how many rows went.
+ */
+export function pruneBillingDays(sql, tables, nowMs, limit, months) {
+    const capped = assertRowLimit('limit', limit);
+    const horizon = billingRollupHorizon(nowMs, months);
+    if (horizon === null)
+        return 0;
+    const pruned = sql(boundedRetentionDelete(tables.rows, 'day'), [horizon, capped]).length;
+    sql(`DELETE FROM ${tables.records}
+      WHERE day < ? AND NOT EXISTS (SELECT 1 FROM ${tables.rows} d WHERE d.day = ${tables.records}.day)`, [horizon]);
+    return pruned;
+}
+//# sourceMappingURL=billing-retention.js.map

package/dist/billing-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-retention.js","sourceRoot":"","sources":["../src/billing-retention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAkB,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,MAAqB;IACvE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oFAAoF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC;IACzC,oEAAoE;IACpE,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpF,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzH,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAW;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,MAA0C,EAAE,KAAe,EAAE,MAA2B;IACpH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAiB,EACjB,MAAyC,EACzC,KAAa,EACb,KAAa,EACb,MAAqB;IAErB,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACzF,GAAG,CACD,eAAe,MAAM,CAAC,OAAO;oDACmB,MAAM,CAAC,IAAI,oBAAoB,MAAM,CAAC,OAAO,OAAO,EACpG,CAAC,OAAO,CAAC,CACV,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/byte-stream.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Bytes as a stream (#2498, `docs/rfc/file-bearing-sources.md` §6).
+ *
+ * The byte seams between a provider, a connector and the attachment store each took the whole
+ * body as one buffer, so the largest file a connector could land was whatever the worker had
+ * memory for. Each seam now also takes a {@link SizedByteStream}: a stream, plus the length its
+ * producer declares. The length is declared rather than counted because the stores need it
+ * before the first byte (R2 refuses a stream of unknown length), and it is enforced on the way
+ * through: a stream that carries more or fewer bytes than it declared errors instead of landing.
+ *
+ * Structural, for the reason `FetchLike` is: the kernel depends on no platform typings, and a
+ * web `ReadableStream<Uint8Array>` from Node, workerd or a browser satisfies {@link ByteStream}
+ * without either being required.
+ */
+/** One read from a {@link ByteStreamReader}: a chunk, or the end. */
+export interface ByteStreamRead {
+    readonly done: boolean;
+    readonly value?: Uint8Array;
+}
+/** The reader a {@link ByteStream} hands out — the slice of `ReadableStreamDefaultReader` used here. */
+export interface ByteStreamReader {
+    read(): Promise<ByteStreamRead>;
+    cancel(reason?: unknown): Promise<void>;
+    releaseLock(): void;
+}
+/** A web `ReadableStream<Uint8Array>`, structurally. */
+export interface ByteStream {
+    getReader(): ByteStreamReader;
+}
+/** A byte stream with the length its producer declares. */
+export interface SizedByteStream {
+    readonly stream: ByteStream;
+    readonly length: number;
+}
+/** A body a byte seam takes: the whole buffer, as before, or a sized stream. */
+export type ByteBody = Uint8Array | SizedByteStream;
+/**
+ * Bytes a connector already holds, in the shape a connector upload takes (#2538): the buffer itself
+ * up to {@link CONNECTOR_ATTACHMENT_BUFFERED_MAX_BYTES}, and above it a {@link SizedByteStream} of the
+ * same bytes, which the platform sends by the streamed route instead of refusing. It does not shrink
+ * what the connector holds; it keeps a file the connector could fetch landing end to end. The stream
+ * is one-shot: read it once, and call this again for another upload of the same bytes.
+ */
+export declare function connectorUploadBody(bytes: Uint8Array): ByteBody;
+/**
+ * Bytes already held, as a one-shot {@link SizedByteStream} handed out 1 MiB at a time. It saves no
+ * memory, since the buffer is held; it lets a buffer go where a seam takes a stream. Each chunk is a
+ * copy, not a view of `bytes`, so a consumer that takes a chunk's buffer cannot detach the rest.
+ */
+export declare function bytesStream(bytes: Uint8Array): SizedByteStream;
+/** Is `body` a sized stream rather than a buffer? */
+export declare function isSizedByteStream(body: unknown): body is SizedByteStream;
+/**
+ * A running SHA-256, fed one chunk at a time. The kernel holds no implementation: Web Crypto has
+ * no incremental digest and a hand-rolled one is not an option, so each adapter passes its
+ * runtime's own (workerd's `crypto.DigestStream`, Node's `createHash`).
+ */
+export interface IncrementalSha256 {
+    update(chunk: Uint8Array): void | Promise<void>;
+    /** The lowercase hex digest of everything fed so far. Called once, after the last chunk. */
+    hex(): Promise<string>;
+}
+/**
+ * What makes the runtime's own running SHA-256, where it has one (workerd's `crypto.DigestStream`), or
+ * `undefined` where it has none (Node, a browser): the kernel finds the runtime's, it never holds one.
+ * A maker rather than a digest, so a caller can learn whether it can check bytes before it asks for
+ * any, and opens a digest only for bytes it has.
+ */
+export declare function runtimeSha256(): (() => IncrementalSha256) | undefined;
+/** What a witnessed stream's bytes were, once they have all passed. */
+export interface StreamWitness {
+    readonly sha256: string;
+    readonly size: number;
+}
+/** A sized stream that hashes and counts its bytes as its reader takes them. */
+export interface WitnessedStream {
+    readonly body: SizedByteStream;
+    /**
+     * The bytes' sha256 and size. Throws until the stream has been read to its end, so a store
+     * that answered without consuming the body cannot have a record written for bytes it never saw.
+     */
+    witness(): StreamWitness;
+}
+/**
+ * Hash and count `body` while it flows to wherever it is going. The digest is fed each chunk
+ * before the chunk moves on, and the final digest is taken before the stream reports its end, so
+ * once the consumer has read to the end — a store's `put` has resolved — {@link
+ * WitnessedStream.witness} answers.
+ */
+export declare function witnessedStream(body: SizedByteStream, digest: IncrementalSha256): WitnessedStream;
+/**
+ * The largest chunk a {@link verifiedStream} hands on, and so the most it holds back at its end. A
+ * source chunk larger than this is handed on in pieces of this size.
+ */
+export declare const VERIFIED_STREAM_CHUNK_MAX_BYTES: number;
+/**
+ * Stored bytes on their way out, held to the record that witnesses them (#2514): its `size` and its
+ * `sha256`, both checked as the bytes pass rather than before the first one, so nothing is held whole.
+ *
+ * **What a consumer sees when the bytes are wrong.** The digest is known only after the last byte, so
+ * the chunk that completes the declared size is held back until the source has ended and the digest
+ * matches. A mismatch, a source that ends short, or one that carries more errors the stream instead,
+ * and that last chunk is never handed on. So a consumer can never have received all `size` bytes of a
+ * file that did not verify. One that counts to `size` and stops reading is as safe as one that reads to
+ * the end. What it may have received before the error is a prefix, and it is told so by the error.
+ *
+ * The held-back chunk is at most {@link VERIFIED_STREAM_CHUNK_MAX_BYTES}: a source chunk larger than
+ * that is handed on in copies of that size, so the wait never holds more than one such piece beside the
+ * source chunk it came from. A source chunk within the cap is handed on as the source gave it.
+ *
+ * Throws before reading anything when the stream's length is not the record's `size`, or the record
+ * carries no sha256 to verify against, so a file is never handed on as verified when it could not be.
+ */
+export declare function verifiedStream(body: SizedByteStream, expected: {
+    readonly size: number;
+    readonly sha256: string;
+}, digest: IncrementalSha256): SizedByteStream;
+/**
+ * `body` as a stream of known length that the runtime takes, held to its declared length: a
+ * stream that carries more or fewer bytes errors whatever reads it. On workerd that is a
+ * `FixedLengthStream`, which a `fetch` sends with a `Content-Length` rather than chunked and
+ * which R2's `put` accepts (it refuses a stream of unknown length); the runtime enforces the
+ * length there, so a web stream is piped straight in. Elsewhere it is the stream passed through
+ * a relay that enforces the length.
+ */
+export declare function knownLengthStream(body: SizedByteStream): ByteStream;
+/**
+ * A request init whose body is a sized stream, as the runtime's `fetch` takes it: the body
+ * as {@link knownLengthStream}, and off workerd the `Content-Length` header and `duplex: 'half'`
+ * a streamed request body needs there. `fetchLikeOf` sends through it, so a `FetchLike` does not
+ * call this itself: a runtime `fetch` becomes one by `fetchLikeOf`. A caller that holds a
+ * runtime `fetch` it does not make a `FetchLike` (the platform's vertical client) does.
+ */
+export declare function knownLengthInit<Init extends {
+    headers?: Record<string, string>;
+    body: SizedByteStream;
+}>(init: Init): Omit<Init, 'body'> & {
+    body: ByteStream;
+    headers: Record<string, string>;
+    duplex?: 'half';
+};
+//# sourceMappingURL=byte-stream.d.ts.map

package/dist/byte-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byte-stream.d.ts","sourceRoot":"","sources":["../src/byte-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,WAAW,IAAI,IAAI,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,SAAS,IAAI,gBAAgB,CAAC;CAC/B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,eAAe,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CAkB9D;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,eAAe,CAQxE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,4FAA4F;IAC5F,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACxB;AAQD;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,SAAS,CAcrE;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B;;;OAGG;IACH,OAAO,IAAI,aAAa,CAAC;CAC1B;AAmED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,GAAG,eAAe,CAiBjG;AAED;;;GAGG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAI3D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC5D,MAAM,EAAE,iBAAiB,GACxB,eAAe,CAgEjB;AAUD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,UAAU,CAOnE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,EACtG,IAAI,EAAE,IAAI,GACT,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F"}

package/dist/byte-stream.js

@@ -0,0 +1,274 @@
+/**
+ * Bytes as a stream (#2498, `docs/rfc/file-bearing-sources.md` §6).
+ *
+ * The byte seams between a provider, a connector and the attachment store each took the whole
+ * body as one buffer, so the largest file a connector could land was whatever the worker had
+ * memory for. Each seam now also takes a {@link SizedByteStream}: a stream, plus the length its
+ * producer declares. The length is declared rather than counted because the stores need it
+ * before the first byte (R2 refuses a stream of unknown length), and it is enforced on the way
+ * through: a stream that carries more or fewer bytes than it declared errors instead of landing.
+ *
+ * Structural, for the reason `FetchLike` is: the kernel depends on no platform typings, and a
+ * web `ReadableStream<Uint8Array>` from Node, workerd or a browser satisfies {@link ByteStream}
+ * without either being required.
+ */
+import { CONNECTOR_ATTACHMENT_BUFFERED_MAX_BYTES } from '@substrat-run/contracts';
+/**
+ * Bytes a connector already holds, in the shape a connector upload takes (#2538): the buffer itself
+ * up to {@link CONNECTOR_ATTACHMENT_BUFFERED_MAX_BYTES}, and above it a {@link SizedByteStream} of the
+ * same bytes, which the platform sends by the streamed route instead of refusing. It does not shrink
+ * what the connector holds; it keeps a file the connector could fetch landing end to end. The stream
+ * is one-shot: read it once, and call this again for another upload of the same bytes.
+ */
+export function connectorUploadBody(bytes) {
+    if (bytes.byteLength <= CONNECTOR_ATTACHMENT_BUFFERED_MAX_BYTES)
+        return bytes;
+    return bytesStream(bytes);
+}
+/**
+ * Bytes already held, as a one-shot {@link SizedByteStream} handed out 1 MiB at a time. It saves no
+ * memory, since the buffer is held; it lets a buffer go where a seam takes a stream. Each chunk is a
+ * copy, not a view of `bytes`, so a consumer that takes a chunk's buffer cannot detach the rest.
+ */
+export function bytesStream(bytes) {
+    const CHUNK = 1024 * 1024;
+    let at = 0;
+    const stream = new ReadableStream({
+        async pull(controller) {
+            if (at >= bytes.byteLength) {
+                controller.close();
+                return;
+            }
+            controller.enqueue(bytes.slice(at, Math.min(at + CHUNK, bytes.byteLength)));
+            at += CHUNK;
+        },
+        async cancel() { },
+    }, { highWaterMark: 0 });
+    return { stream, length: bytes.byteLength };
+}
+/** Is `body` a sized stream rather than a buffer? */
+export function isSizedByteStream(body) {
+    return (typeof body === 'object' &&
+        body !== null &&
+        !ArrayBuffer.isView(body) &&
+        typeof body.stream?.getReader === 'function' &&
+        typeof body.length === 'number');
+}
+/**
+ * What makes the runtime's own running SHA-256, where it has one (workerd's `crypto.DigestStream`), or
+ * `undefined` where it has none (Node, a browser): the kernel finds the runtime's, it never holds one.
+ * A maker rather than a digest, so a caller can learn whether it can check bytes before it asks for
+ * any, and opens a digest only for bytes it has.
+ */
+export function runtimeSha256() {
+    const DigestStream = globalThis.crypto?.DigestStream;
+    if (!DigestStream)
+        return undefined;
+    return () => {
+        const digest = new DigestStream('SHA-256');
+        const writer = digest.getWriter();
+        return {
+            update: (chunk) => writer.write(chunk),
+            hex: async () => {
+                await writer.close();
+                return [...new Uint8Array(await digest.digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+            },
+        };
+    };
+}
+/** Refuse a declared length no stream can have. */
+function assertDeclaredLength(length) {
+    if (!Number.isSafeInteger(length) || length < 0) {
+        throw new Error(`a byte stream's declared length must be a non-negative integer, not ${length}`);
+    }
+}
+/**
+ * A new stream that passes `source` through chunk by chunk, holding it to `length`. Pull-driven
+ * with no queue of its own (`highWaterMark: 0`), so a chunk is read from the source only when the
+ * consumer asks for one: at most one chunk is in flight, whatever the body's size.
+ */
+function relay(source, length, onChunk, onEnd) {
+    assertDeclaredLength(length);
+    const reader = source.getReader();
+    let size = 0;
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done) {
+                    if (size !== length) {
+                        throw new Error(`the byte stream ended after ${size} bytes; it declared ${length}`);
+                    }
+                    await onEnd?.();
+                    controller.close();
+                    return;
+                }
+                // A read that neither ends nor carries a chunk is a broken source: answering it by
+                // returning would leave the consumer's read waiting for a pull that never comes.
+                if (!value)
+                    throw new Error('the byte stream yielded a read with neither a chunk nor its end');
+                size += value.byteLength;
+                if (size > length) {
+                    throw new Error(`the byte stream carried more than the ${length} bytes it declared`);
+                }
+                await onChunk?.(value);
+                controller.enqueue(value);
+            }
+            catch (err) {
+                controller.error(err);
+                await reader.cancel(err).catch(() => { });
+            }
+        },
+        cancel: (reason) => reader.cancel(reason),
+    }, { highWaterMark: 0 });
+}
+/**
+ * Hash and count `body` while it flows to wherever it is going. The digest is fed each chunk
+ * before the chunk moves on, and the final digest is taken before the stream reports its end, so
+ * once the consumer has read to the end — a store's `put` has resolved — {@link
+ * WitnessedStream.witness} answers.
+ */
+export function witnessedStream(body, digest) {
+    let witnessed;
+    const stream = relay(body.stream, body.length, (chunk) => digest.update(chunk), async () => {
+        witnessed = { sha256: await digest.hex(), size: body.length };
+    });
+    return {
+        body: { stream, length: body.length },
+        witness: () => {
+            if (!witnessed)
+                throw new Error('the byte stream was not read to its end, so its bytes are unwitnessed');
+            return witnessed;
+        },
+    };
+}
+/**
+ * The largest chunk a {@link verifiedStream} hands on, and so the most it holds back at its end. A
+ * source chunk larger than this is handed on in pieces of this size.
+ */
+export const VERIFIED_STREAM_CHUNK_MAX_BYTES = 1024 * 1024;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * Stored bytes on their way out, held to the record that witnesses them (#2514): its `size` and its
+ * `sha256`, both checked as the bytes pass rather than before the first one, so nothing is held whole.
+ *
+ * **What a consumer sees when the bytes are wrong.** The digest is known only after the last byte, so
+ * the chunk that completes the declared size is held back until the source has ended and the digest
+ * matches. A mismatch, a source that ends short, or one that carries more errors the stream instead,
+ * and that last chunk is never handed on. So a consumer can never have received all `size` bytes of a
+ * file that did not verify. One that counts to `size` and stops reading is as safe as one that reads to
+ * the end. What it may have received before the error is a prefix, and it is told so by the error.
+ *
+ * The held-back chunk is at most {@link VERIFIED_STREAM_CHUNK_MAX_BYTES}: a source chunk larger than
+ * that is handed on in copies of that size, so the wait never holds more than one such piece beside the
+ * source chunk it came from. A source chunk within the cap is handed on as the source gave it.
+ *
+ * Throws before reading anything when the stream's length is not the record's `size`, or the record
+ * carries no sha256 to verify against, so a file is never handed on as verified when it could not be.
+ */
+export function verifiedStream(body, expected, digest) {
+    assertDeclaredLength(body.length);
+    if (body.length !== expected.size) {
+        throw new Error(`the stored object is ${body.length} bytes; its record says ${expected.size}`);
+    }
+    if (!SHA256_HEX.test(expected.sha256)) {
+        throw new Error('the record carries no sha256 to verify the bytes against');
+    }
+    const length = body.length;
+    const reader = body.stream.getReader();
+    let rest;
+    let delivered = 0;
+    /** The next non-empty piece of the source, at most the cap, or `null` at its end. */
+    const nextPiece = async () => {
+        while (!rest || rest.byteLength === 0) {
+            const { done, value } = await reader.read();
+            if (done)
+                return null;
+            if (!value)
+                throw new Error('the byte stream yielded a read with neither a chunk nor its end');
+            rest = value;
+        }
+        if (rest.byteLength <= VERIFIED_STREAM_CHUNK_MAX_BYTES) {
+            const piece = rest;
+            rest = undefined;
+            return piece;
+        }
+        // A copy, not a view: a consumer may take the piece's buffer, which would take the rest with it.
+        const piece = rest.slice(0, VERIFIED_STREAM_CHUNK_MAX_BYTES);
+        rest = rest.subarray(VERIFIED_STREAM_CHUNK_MAX_BYTES);
+        return piece;
+    };
+    const stream = new ReadableStream({
+        async pull(controller) {
+            try {
+                const piece = delivered < length ? await nextPiece() : null;
+                if (delivered < length) {
+                    if (!piece)
+                        throw new Error(`the stored object ended after ${delivered} bytes; its record says ${length}`);
+                    if (delivered + piece.byteLength > length) {
+                        throw new Error(`the stored object carried more than the ${length} bytes its record says`);
+                    }
+                    await digest.update(piece);
+                    delivered += piece.byteLength;
+                    if (delivered < length) {
+                        controller.enqueue(piece);
+                        return;
+                    }
+                }
+                // The last bytes: handed on only once the source has ended and the digest matches.
+                if (await nextPiece())
+                    throw new Error(`the stored object carried more than the ${length} bytes its record says`);
+                if ((await digest.hex()) !== expected.sha256)
+                    throw new Error('the bytes do not match the recorded sha256');
+                if (piece)
+                    controller.enqueue(piece);
+                controller.close();
+            }
+            catch (err) {
+                controller.error(err);
+                await reader.cancel(err).catch(() => { });
+            }
+        },
+        cancel: (reason) => reader.cancel(reason),
+    }, { highWaterMark: 0 });
+    return { stream, length };
+}
+/** The runtime's own `FixedLengthStream`, where it has one (workerd). */
+function fixedLengthStream() {
+    return globalThis.FixedLengthStream;
+}
+/**
+ * `body` as a stream of known length that the runtime takes, held to its declared length: a
+ * stream that carries more or fewer bytes errors whatever reads it. On workerd that is a
+ * `FixedLengthStream`, which a `fetch` sends with a `Content-Length` rather than chunked and
+ * which R2's `put` accepts (it refuses a stream of unknown length); the runtime enforces the
+ * length there, so a web stream is piped straight in. Elsewhere it is the stream passed through
+ * a relay that enforces the length.
+ */
+export function knownLengthStream(body) {
+    const Fixed = fixedLengthStream();
+    if (!Fixed)
+        return relay(body.stream, body.length);
+    assertDeclaredLength(body.length);
+    const piped = body.stream;
+    const source = typeof piped.pipeThrough === 'function' ? piped : relay(body.stream, body.length);
+    return source.pipeThrough(new Fixed(body.length));
+}
+/**
+ * A request init whose body is a sized stream, as the runtime's `fetch` takes it: the body
+ * as {@link knownLengthStream}, and off workerd the `Content-Length` header and `duplex: 'half'`
+ * a streamed request body needs there. `fetchLikeOf` sends through it, so a `FetchLike` does not
+ * call this itself: a runtime `fetch` becomes one by `fetchLikeOf`. A caller that holds a
+ * runtime `fetch` it does not make a `FetchLike` (the platform's vertical client) does.
+ */
+export function knownLengthInit(init) {
+    const length = init.body.length;
+    const onWorkerd = fixedLengthStream() !== undefined;
+    return {
+        ...init,
+        body: knownLengthStream(init.body),
+        headers: { ...init.headers, ...(onWorkerd ? {} : { 'content-length': String(length) }) },
+        ...(onWorkerd ? {} : { duplex: 'half' }),
+    };
+}
+//# sourceMappingURL=byte-stream.js.map

package/dist/byte-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"byte-stream.js","sourceRoot":"","sources":["../src/byte-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,uCAAuC,EAAE,MAAM,yBAAyB,CAAC;AA6BlF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACnD,IAAI,KAAK,CAAC,UAAU,IAAI,uCAAuC;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B;QACE,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,EAAE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5E,EAAE,IAAI,KAAK,CAAC;QACd,CAAC;QACD,KAAK,CAAC,MAAM,KAAI,CAAC;KAClB,EACD,EAAE,aAAa,EAAE,CAAC,EAAE,CACrB,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AAC9C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QACzB,OAAQ,IAA6C,CAAC,MAAM,EAAE,SAAS,KAAK,UAAU;QACtF,OAAQ,IAA6B,CAAC,MAAM,KAAK,QAAQ,CAC1D,CAAC;AACJ,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,YAAY,GAAI,UAA+D,CAAC,MAAM,EAAE,YAAY,CAAC;IAC3G,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO,GAAG,EAAE;QACV,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACtC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AA6BD,mDAAmD;AACnD,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uEAAuE,MAAM,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CACZ,MAAkB,EAClB,MAAc,EACd,OAAqD,EACrD,KAAkC;IAElC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,cAAc,CACvB;QACE,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,uBAAuB,MAAM,EAAE,CAAC,CAAC;oBACtF,CAAC;oBACD,MAAM,KAAK,EAAE,EAAE,CAAC;oBAChB,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,mFAAmF;gBACnF,iFAAiF;gBACjF,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBAC/F,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,oBAAoB,CAAC,CAAC;gBACvF,CAAC;gBACD,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBACvB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1C,EACD,EAAE,aAAa,EAAE,CAAC,EAAE,CACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAqB,EAAE,MAAyB;IAC9E,IAAI,SAAoC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAClB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,SAAS,GAAG,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC,CACF,CAAC;IACF,OAAO;QACL,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACrC,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACzG,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3D,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAqB,EACrB,QAA4D,EAC5D,MAAyB;IAEzB,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,2BAA2B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,IAAI,IAA4B,CAAC;IACjC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,qFAAqF;IACrF,MAAM,SAAS,GAAG,KAAK,IAAgC,EAAE;QACvD,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAC/F,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,+BAA+B,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,IAAI,GAAG,SAAS,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,iGAAiG;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC7D,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B;QACE,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5D,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;oBACvB,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,2BAA2B,MAAM,EAAE,CAAC,CAAC;oBAC3G,IAAI,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,wBAAwB,CAAC,CAAC;oBAC7F,CAAC;oBACD,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC3B,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;oBAC9B,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;wBACvB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;wBAC1B,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,mFAAmF;gBACnF,IAAI,MAAM,SAAS,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,wBAAwB,CAAC,CAAC;gBAClH,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC5G,IAAI,KAAK;oBAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACrC,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1C,EACD,EAAE,aAAa,EAAE,CAAC,EAAE,CACrB,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAKD,yEAAyE;AACzE,SAAS,iBAAiB;IACxB,OAAQ,UAA4D,CAAC,iBAAiB,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAoE,CAAC;IACxF,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAA6B,CAAC;IAC9H,OAAO,MAAM,CAAC,WAAY,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAU;IAEV,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAChC,MAAM,SAAS,GAAG,iBAAiB,EAAE,KAAK,SAAS,CAAC;IACpD,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACxF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/connection-landings.d.ts

@@ -1,5 +1,5 @@
-import type { Connection, ConnectionLandingOptions, ManifestConnectionLandings, PlatformActorId, ScopeId, TenantId } from '@substrat-run/contracts';
-import type { ScopeHost } from './scope-host.js';
+import type { Connection, ConnectionLandingOptions, ManifestConnectionLandings, PlatformActorId, Scope, ScopeId, TenantId } from '@substrat-run/contracts';
+import type { ScopeFilter, ScopeHost } from './scope-host.js';
 /**
  * Connection landings, applied (#2316): the connector pass's step that turns a vertical's declared
  * `connections` into a held key and a binding for every live connection of that provider.
@@ -94,9 +94,21 @@ export declare class LandingPass {
     private readonly actor;
     private readonly input;
     private readonly concurrency;
+    /**
+     * How the pass reads a tenant's scopes: the sweep's own reader, so a directory row that does
+     * not read as a scope is stepped over here too and named once with the pass's others, rather
+     * than failing every landing in its tenant.
+     */
+    private readonly listScopes;
     private readonly targets;
     private readonly held;
-    constructor(host: ScopeHost, actor: PlatformActorId, input: ConnectionLandingOptionsInput, concurrency: number);
+    constructor(host: ScopeHost, actor: PlatformActorId, input: ConnectionLandingOptionsInput, concurrency: number, 
+    /**
+     * How the pass reads a tenant's scopes: the sweep's own reader, so a directory row that does
+     * not read as a scope is stepped over here too and named once with the pass's others, rather
+     * than failing every landing in its tenant.
+     */
+    listScopes: (filter: ScopeFilter) => Promise<Scope[]>);
     /** Grant and bind what `connection`'s installs declare for its provider, and say what happened. */
     apply(connection: Connection): Promise<LandingOutcome>;
     /** Every primary, active install of `vertical` in `tenantId`, with what its running version declares. */

package/dist/connection-landings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection-landings.d.ts","sourceRoot":"","sources":["../src/connection-landings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EAGf,OAAO,EACP,QAAQ,EACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAMjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IAC9H,kGAAkG;IAClG,IAAI,CACF,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,CACN,GAAG,EAAE,wBAAwB,GAAG,SAAS,EACzC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACnE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;CAC9G;AAED,MAAM,WAAW,6BAA6B;IAC5C,0GAA0G;IAC1G,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACnF,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,oEAAoE;IACpE,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,2FAA2F;IAC3F,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C;AASD;;;;GAIG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAP9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0D;IAE/E,YACmB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,6BAA6B,EACpC,WAAW,EAAE,MAAM,EAClC;IAEJ,mGAAmG;IAC7F,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CA2D3D;IAED,yGAAyG;IACzG,OAAO,CAAC,SAAS;IAwBjB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ;CASjB"}
+{"version":3,"file":"connection-landings.d.ts","sourceRoot":"","sources":["../src/connection-landings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EAEf,KAAK,EACL,OAAO,EACP,QAAQ,EACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAM9D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IAC9H,kGAAkG;IAClG,IAAI,CACF,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,CACN,GAAG,EAAE,wBAAwB,GAAG,SAAS,EACzC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACnE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;CAC9G;AAED,MAAM,WAAW,6BAA6B;IAC5C,0GAA0G;IAC1G,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACnF,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,oEAAoE;IACpE,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,2FAA2F;IAC3F,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C;AASD;;;;GAIG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAb7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0D;IAE/E,YACmB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,6BAA6B,EACpC,WAAW,EAAE,MAAM;IACpC;;;;OAIG;IACc,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,EACpE;IAEJ,mGAAmG;IAC7F,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CA2D3D;IAED,yGAAyG;IACzG,OAAO,CAAC,SAAS;IAwBjB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ;CASjB"}

package/dist/connection-landings.js

@@ -12,13 +12,21 @@ export class LandingPass {
     actor;
     input;
     concurrency;
+    listScopes;
     targets = new Map();
     held = new Map();
-    constructor(host, actor, input, concurrency) {
+    constructor(host, actor, input, concurrency, 
+    /**
+     * How the pass reads a tenant's scopes: the sweep's own reader, so a directory row that does
+     * not read as a scope is stepped over here too and named once with the pass's others, rather
+     * than failing every landing in its tenant.
+     */
+    listScopes) {
         this.host = host;
         this.actor = actor;
         this.input = input;
         this.concurrency = concurrency;
+        this.listScopes = listScopes;
     }
     /** Grant and bind what `connection`'s installs declare for its provider, and say what happened. */
     async apply(connection) {
@@ -92,7 +100,7 @@ export class LandingPass {
         let found = this.targets.get(key);
         if (!found) {
             found = (async () => {
-                const scopes = (await this.host.admin.listScopes(this.actor, { tenantId })).filter((s) => s.vertical === vertical && s.status === 'active' && isPrimaryScope(s));
+                const scopes = (await this.listScopes({ tenantId })).filter((s) => s.vertical === vertical && s.status === 'active' && isPrimaryScope(s));
                 if (scopes.length === 0)
                     return [];
                 const running = await runningFactsOf(this.host.admin, this.actor, scopes, (slug, versionId) => this.input.read(slug, versionId), (reason) => ({ kind: 'unreadable', reason }), this.concurrency);