@zackbart/connecta 0.34.0 → 0.35.0

package/dist/providers/vercel/index.js

@@ -1,281 +1,87 @@
-import { skill } from "./skill.generated.js";
-/**
- * No `@vercel/sdk` on purpose — not a dependency and not an optional peer.
- * Direct fetch keeps the root Workers-safe and avoids shipping the SDK's
- * generated model graph. The token connector reads a pinned operation index
- * compiled from Vercel's published OpenAPI document (https://openapi.vercel.sh/,
- * unversioned, so pinned by content hash in `openapi.source.json`);
- * `pnpm run providers:check --provider vercel` reports when the live document
- * moves, and `src/providers/vercel/drift.json` also records the contract digest
- * of every endpoint a named tool is written against.
- */
-import { apiConnector } from "../../connectors/api-connector.js";
-import { reviewedCatalog } from "../../catalog-drift.js";
 import { keys, optionsOf, variants } from "../../config-schema.js";
-import { CALL_ADMISSION, defineProvider } from "../../provider.js";
-import { byAuth, hostedOAuth } from "../_shared/rest/dispatch.js";
-import { restTools } from "../_shared/rest/tools.js";
-import { VERCEL_API_BASE_URL, vercelRest } from "./rest.js";
-export { VERCEL_API_BASE_URL } from "./rest.js";
-/** Vercel's official hosted MCP endpoint. */
-export const VERCEL_MCP_ENDPOINT = "https://mcp.vercel.com";
-/**
- * Reviewed in #705's provider audit against https://vercel.com/docs/mcp/vercel-mcp/tools.
- * Retains the release-reviewed inventory, including names absent from today's
- * public reference. Live annotations were not reverified without credentials.
- * No schema digest is asserted without a captured schema to review. This
- * classifies the hosted OAuth catalog only; the REST connector annotates each
- * tool it authors.
- */
-const VERCEL_MCP_CLASSIFICATION = {
-    tools: {
-        "request_promote": {
-            verdict: "destructive",
-            reason: "The rolling-releases MCP reference promotes an existing deployment to production; replaces the authored REST promotion write.",
-        },
-        "list_project_domains": {
-            verdict: "read",
-            reason: "The projects MCP reference lists project-domain metadata; formerly the named REST read.",
-        },
-        "add_project_domain": {
-            verdict: "destructive",
-            reason: "Attaches a domain to a project; preserves the former REST write classification.",
-        },
-        "cancel_deployment": {
-            verdict: "destructive",
-            reason: "Cancels an existing deployment, even if the vendor claims read-only access.",
-        },
-        "upload_file": { verdict: "destructive", reason: "Uploads deployment file bytes and creates vendor state." },
-        "create_deployment": {
-            verdict: "destructive",
-            reason: "Creates a preview or production deployment from Git or files.",
-        },
-        "list_deployment_events": {
-            verdict: "read",
-            reason: "Reads build events using the documented deployments catalog.",
-        },
-        "search_vercel_documentation": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel vercel documentation information without changing vendor state.",
-        },
-        "list_teams": { "verdict": "read", "reason": "Retrieves Vercel teams information without changing vendor state." },
-        "list_projects": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel projects information without changing vendor state.",
-        },
-        "get_project": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel project information without changing vendor state.",
-        },
-        "list_deployments": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel deployments information without changing vendor state.",
-        },
-        "get_deployment": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel deployment information without changing vendor state.",
-        },
-        "get_deployment_build_logs": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel deployment build logs information without changing vendor state.",
-        },
-        "get_runtime_logs": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel runtime logs information without changing vendor state.",
-        },
-        "get_runtime_errors": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel runtime errors information without changing vendor state.",
-        },
-        "get_web_analytics": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel web analytics information without changing vendor state.",
-        },
-        "list_agent_run_projects": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel agent run projects information without changing vendor state.",
-        },
-        "list_agent_runs": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel agent runs information without changing vendor state.",
-        },
-        "get_agent_run": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel agent run information without changing vendor state.",
-        },
-        "get_agent_run_trace": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel agent run trace information without changing vendor state.",
-        },
-        "check_domain_availability_and_price": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel check domain availability and price information without changing vendor state.",
-        },
-        "get_purchase_quote": {
-            "verdict": "read",
-            "reason": "Reads a purchase quote; billing changes require a separate purchase tool.",
-        },
-        "get_domain_order": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel domain order information without changing vendor state.",
-        },
-        "list_toolbar_threads": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel toolbar threads information without changing vendor state.",
-        },
-        "get_toolbar_thread": {
-            "verdict": "read",
-            "reason": "Retrieves Vercel toolbar thread information without changing vendor state.",
-        },
-        "use_vercel_cli": {
-            "verdict": "read",
-            "reason": "Returns CLI guidance only; any subsequent CLI execution is outside this tool.",
-        },
-        "reply_to_toolbar_thread": {
-            "verdict": "write",
-            "reason": "reply to toolbar thread creates or appends Vercel state; it has side effects.",
-        },
-        "add_toolbar_reaction": {
-            "verdict": "write",
-            "reason": "add toolbar reaction creates or appends Vercel state; it has side effects.",
-        },
-        "deploy_to_vercel": {
-            "verdict": "destructive",
-            "reason": "Can change a live deployment and the project serving production traffic.",
-        },
-        "buy_pro": { "verdict": "destructive", "reason": "buy pro changes existing Vercel state or removes it." },
-        "buy_credits": { "verdict": "destructive", "reason": "buy credits changes existing Vercel state or removes it." },
-        "buy_addon": { "verdict": "destructive", "reason": "buy addon changes existing Vercel state or removes it." },
-        "buy_domain": { "verdict": "destructive", "reason": "buy domain changes existing Vercel state or removes it." },
-        "get_access_to_vercel_url": {
-            "verdict": "destructive",
-            "reason": "Creates an access grant; the returned access URL is a credential.",
-        },
-        "web_fetch_vercel_url": {
-            "verdict": "destructive",
-            "reason": "Invokes application code, whose side effects cannot be established from HTTP GET alone.",
-        },
-        "import-claude-design-from-url": {
-            "verdict": "destructive",
-            "reason": "Imports into a project and can change existing live project state.",
-        },
-        "change_toolbar_thread_resolve_status": {
-            "verdict": "destructive",
-            "reason": "change toolbar thread resolve status changes existing Vercel state or removes it.",
-        },
-        "edit_toolbar_message": {
-            "verdict": "destructive",
-            "reason": "edit toolbar message changes existing Vercel state or removes it.",
-        },
-        "filter_project_envs": {
-            "verdict": "write",
-            "reason": "Lists project environment variables and can return decrypted values; reviewed as a write so a read-only endpoint refuses the disclosure (#801).",
-        },
-        "get_project_env": {
-            "verdict": "write",
-            "reason": "Returns one environment variable's decrypted value; reviewed as a write so a read-only endpoint refuses the disclosure (#801).",
-        },
-        "create_project_env": {
-            "verdict": "destructive",
-            "reason": "Creates or overwrites project environment variables that future deployments embed.",
-        },
-        "edit_project_env": {
-            "verdict": "destructive",
-            "reason": "Replaces an existing environment variable's value or targets.",
-        },
-    },
-};
-function instructionsSection(instructions) {
-    const text = instructions?.trim();
-    return text ? `\n## ${skill.instructionsHeading}\n\n${text}\n` : "";
-}
-function oauthUsageGuide(purpose, instructions) {
-    const { oauth, shared } = skill.fragments;
-    return `# Vercel usage
-
-Vercel's hosted MCP server over OAuth. Account purpose: ${purpose}${oauth}${shared}${instructionsSection(instructions)}`;
-}
-function tokenUsageGuide(purpose, teamId, instructions) {
-    const { key, shared } = skill.fragments;
-    const scope = teamId
-        ? `This connection defaults to team \`${teamId}\`: operations that accept a team get it unless a call passes \`teamId\` (or \`slug\`), and \`teamId: null\` targets the token owner's personal account.`
-        : "This connection defaults to the token owner's personal account. Call `list_teams`, then pass `teamId` for team-owned resources.";
-    return `# Vercel usage
-
-Connecta's REST connector to the Vercel API with one access token. Account purpose: ${purpose}
-
-${scope}${key}${shared}${instructionsSection(instructions)}`;
-}
+import { defineApiProvider } from "../../http/provider.js";
+import { CALL_ADMISSION } from "../../provider.js";
+import { removedHostedMcp } from "../_shared/rest/dispatch.js";
+import { authenticate, MAX_RESPONSE_BYTES, READ_CAP_MS, probe, result, safety, vercelErrors, VercelApi, usageGuide, transformGuide, VERCEL_VERDICTS, VERCEL_PAGES, vercelBinding, vercelIndex, } from "./api.js";
+import { VERCEL_API_BASE_URL } from "./lib/config.js";
+import { pinOptions, PIN_WRITE_STEPS } from "./lib/pin.js";
+import { vercelTools } from "./tools.js";
+import { skill } from "./skill.generated.js";
+export { VERCEL_API_BASE_URL } from "./lib/config.js";
 const COMMON = {
-    ...keys("title", "authScope", "purpose", "instructions", "maxResultBytes"),
+    ...keys("title", "authScope", "purpose", "instructions", "maxResultBytes", "readOnly"),
     callAdmission: CALL_ADMISSION,
 };
 /** The closed options vercel() accepts, selected by `auth.type`; see `assertKnownOptions`. */
 const VERCEL_OPTIONS = variants(["auth", "type"], {
     // The never-typed keys stay out of the shape, so the walk refuses them by name.
-    oauth: optionsOf()({
-        ...COMMON,
-        auth: optionsOf()(keys("type")),
-    }).shape,
+    oauth: { ...COMMON, auth: optionsOf()(keys("type")) },
     token: optionsOf()({
         ...COMMON,
         ...keys("teamId", "baseUrl"),
+        pin: optionsOf()(keys("teamId")),
         auth: optionsOf()(keys("type")),
     }).shape,
-});
-function vercelOAuth(id, options, provider) {
-    return hostedOAuth(id, provider, {
-        url: VERCEL_MCP_ENDPOINT,
-        title: options.title ?? "Vercel (MCP)",
-        description: `Vercel's official hosted MCP surface: ${options.purpose}`,
-        usageGuide: {
-            content: oauthUsageGuide(options.purpose, options.instructions),
-            summary: "Official MCP. Live Vercel schemas, id resolution, deployment diagnosis, purchases, and access grants.",
-            required: true,
-        },
-    });
-}
-function vercelToken(id, options, provider) {
-    const teamId = typeof options.teamId === "string" ? options.teamId.trim() || undefined : undefined;
-    const baseUrl = options.baseUrl ?? VERCEL_API_BASE_URL;
-    const rest = vercelRest({ baseUrl, teamId });
-    return apiConnector(id, {
-        ...provider.connectorOptions,
-        title: options.title ?? "Vercel",
-        description: `Vercel account and deployments: ${options.purpose}`,
-        credential: {
-            label: "Vercel access token",
-            description: "Access token from Vercel Account Settings → Tokens. Choose the personal account or team scope this deployment needs and set an expiration date. The connector never sends it anywhere except api.vercel.com or the configured baseUrl proxy.",
-            placeholder: "Paste Vercel access token",
-        },
-        testCredential: rest.testCredential,
-        usageGuide: {
-            content: tokenUsageGuide(options.purpose, teamId, options.instructions),
-            summary: "One access token over REST: search operations, read details, then read or write. Value-safe env vars.",
-            required: true,
-        },
-        tools: [...restTools(rest.vendor), ...rest.tools],
-    });
-}
-/**
- * A maintained Vercel connection. `auth` selects the implementation: OAuth
- * reaches Vercel's hosted MCP server; an access token reaches Connecta's REST
- * connector to `api.vercel.com`.
- */
-export const vercel = defineProvider({
+}, undefined, ["oauth"]);
+/** Maintained API connection. Hosted MCP uses a separate generic connection. */
+export const vercel = defineApiProvider({
     name: "vercel",
     title: "Vercel",
-    kind: "dual",
     readme: "Vercel",
     bundle: {
-        "baselineGzip": 228431,
-        "maxGzip": 288431,
-        "note": "./providers/vercel remeasures at 228,431 B gzip (#801), from a 143,649 B baseline recorded before the shared entry grew (shared code grew after it was recorded, as other entries measured before #801 show): auth now selects the implementation, so the entry carries the hosted MCP client and Connecta's REST connector (the shared REST module) plus the pinned Vercel operation index (445 operations; request details to depth 2, without descriptions or enums over 50 values; 26,274 B gzip as source; the reviewed value-safety table adds about 5 KB). Details were shrunk before the cap moved: descriptions alone added 15 KB gzip. The cap uses the existing baseline + 60,000 B policy.",
+        baselineGzip: 424345,
+        note: "./providers/vercel standalone gzip after decision 0011 step 2, Node 26.12.0, gzip level 9. Re-pinned response metadata, reviewed discovery prose, signed paging and bounded logs. The shared Effect kit is paid once per deployment; provider entries are reported, not capped (#899).",
     },
     skill,
+    blocks: { keys: ["pinned", "unpinned"], select: (options) => [options.pin ? "pinned" : "unpinned"] },
     options: VERCEL_OPTIONS,
-    classify: VERCEL_MCP_CLASSIFICATION,
-    create: byAuth({ oauth: vercelOAuth, token: vercelToken }),
+    vendor: VercelApi,
+    baseUrl: (options) => {
+        if (options.auth.type !== "token")
+            removedHostedMcp();
+        pinOptions(options);
+        return options.baseUrl ?? VERCEL_API_BASE_URL;
+    },
+    description: (options) => `Vercel account and deployments: ${options.purpose}`,
+    maxResponseBytes: MAX_RESPONSE_BYTES,
+    pageSize: { default: 20, max: 100 },
+    idempotencyKey: false,
+    timeoutMs: READ_CAP_MS,
+    headers: { Accept: "application/json" },
+    credential: {
+        label: "Vercel access token",
+        description: "Access token from Vercel Account Settings → Tokens. Choose the personal account or team scope this deployment needs and set an expiration date. The connector never sends it anywhere except api.vercel.com or the configured baseUrl proxy.",
+        placeholder: "Paste Vercel access token",
+    },
+    authenticate,
+    safety,
+    errors: vercelErrors,
+    result,
+    inBandRefusals: true,
+    probe,
+    guide: usageGuide,
+    transformGuide,
+    hatch: {
+        name: "vercel",
+        title: "Vercel",
+        index: vercelIndex,
+        verdicts: VERCEL_VERDICTS,
+        pages: VERCEL_PAGES,
+        writeSteps: PIN_WRITE_STEPS,
+        pathExample: "/v13/deployments/dpl_123",
+        named: {
+            "GET /v2/teams": "list_teams",
+            "GET /v10/projects/{idOrName}/env": "list_project_env_vars",
+            "POST /v10/projects/{idOrName}/env": "upsert_project_env_var",
+            "PATCH /v9/projects/{idOrName}/env/{id}": "update_project_env_var",
+            "GET /v3/deployments/{idOrUrl}/events": "get_deployment_build_logs",
+            "GET /v1/projects/{projectId}/deployments/{deploymentId}/runtime-logs": "get_runtime_logs",
+        },
+        binding: vercelBinding,
+        notes: (options) => ({
+            read: `Pass page.nextCursor unchanged in the query parameter page.param names. ${pinOptions(options).pin ? "The deployment team pin applies to every call; personal and foreign team selectors are refused." : "Team selectors override the routing default; token permissions enforce scope."}`,
+            write: "JSON writes only. Use vercel_api_upload for explicit bytes.",
+        }),
+    },
+    tools: vercelTools,
 });
-/** @deprecated Read `vercel.definition.classify` instead. Kept for existing imports. */
-export const VERCEL_MCP_VETTED_CATALOG = reviewedCatalog(vercel.definition.classify, 'defineProvider("vercel")');

package/dist/providers/vercel/lib/config.d.ts

@@ -0,0 +1,2 @@
+/** Vercel's public REST origin. Override only for a proxy or test double. */
+export declare const VERCEL_API_BASE_URL = "https://api.vercel.com";

package/dist/providers/vercel/lib/config.js

@@ -0,0 +1,2 @@
+/** Vercel's public REST origin. Override only for a proxy or test double. */
+export const VERCEL_API_BASE_URL = "https://api.vercel.com";

package/dist/providers/vercel/lib/index.js

@@ -0,0 +1,117 @@
+const SUMMARIES = {
+    "POST /api-keys": "Create an AI Gateway API key (credential minting is refused).",
+    "GET /domains/records/{recordId}": "Read one DNS record by its observed record id.",
+    "PUT /domains/{domain}/records": "Replace a domain's DNS records.",
+    "POST /speed-insights/toggle": "Enable or disable Speed Insights for a project.",
+    "POST /web/insights/toggle": "Enable or disable Web Analytics insights for a project.",
+    "POST /v2/observability/query": "Query observability metrics without persisting changes.",
+    "GET /v2/observability/schema": "List the observability metrics and their query schema.",
+    "GET /v2/observability/schema/{metricId}": "Read the query schema for one observability metric.",
+    "GET /v3/deployments/{idOrUrl}/events": "Get deployment build logs and events without following live output.",
+    "GET /v1/projects/{projectId}/deployments/{deploymentId}/runtime-logs": "Get deployment runtime request logs through the bounded named reader.",
+    "POST /v13/deployments": "Create deployment or redeploy an existing deployment for a project.",
+    "POST /v10/projects/{idOrName}/env": "Create environment variable, add environment variable, or replace a project env var.",
+    "GET /v10/projects/{idOrName}/env": "List project environment variables (env vars); use the metadata-only named reader.",
+    "PATCH /v9/projects/{idOrName}/env/{id}": "Update environment variable by id in a project (env var).",
+    "DELETE /v9/projects/{idOrName}/env/{id}": "Delete environment variable by id in a project; remove env var.",
+};
+const PARAMETERS = {
+    teamId: "Team identifier for this call; overrides the connection's routing default. Token permissions enforce access.",
+    slug: "Human-readable team slug for this call; overrides the routing default when teamId is omitted.",
+    domain: "Domain hostname, without a scheme or URL path.",
+    tld: "Top-level domain suffix used by the registrar operation.",
+    limit: "Maximum records requested in one vendor page; obey the declared integer bounds.",
+    n: "Maximum records requested for this operation.",
+    cursor: "Opaque vendor continuation; for paged hatch reads pass the signed page.nextCursor unchanged.",
+    next: "Next-page continuation; pass the signed hatch page.nextCursor unchanged.",
+    page: "Vendor page number; use the declared paging protocol when a continuation is returned.",
+    per_page: "Vendor rows per page; obey the declared numeric bounds.",
+    since: "Lower timestamp boundary for this list; use the operation's documented time unit.",
+    startTimestamp: "Start of the requested observation interval.",
+    endTimestamp: "End of the requested observation interval.",
+    createdAfter: "Include records created after this timestamp.",
+    createdBefore: "Include records created before this timestamp.",
+    includeDisabled: "Include disabled records in the response.",
+    includeArchived: "Include archived records in the response.",
+    includeMetadata: "Include the operation's optional record metadata.",
+    "skip-metadata": "Omit optional metadata from the response.",
+    "include-guides": "Include integration guide metadata in the response.",
+    metadata: "Metadata selection for the requested record.",
+    updatedBy: "Filter by the identity that last updated the records.",
+    actingIp: "IP address associated with the acting request for this operation.",
+    actingUserAgent: "User-agent string associated with the acting request.",
+    q: "Vendor search expression for this resource.",
+    query: "Vendor search expression for this resource.",
+    search: "Search text to match against the listed resource.",
+    diff: "Select a comparison of the requested configuration versions.",
+    sort_by: "Record property used for sorting.",
+    sort_order: "Sorting direction, using the declared vendor values.",
+    sort: "Sorting choice, using the declared vendor values.",
+    connector: "Connect connector identifier, resolved from connector metadata.",
+    action: "Integration resource action to perform, using the documented action name.",
+    dryRun: "Validate or preview this operation without applying its requested change where supported.",
+    token: "Existing token selector. Credential-returning operations remain refused.",
+    edgeConfigItemKey: "Edge Config item name; stored item-value reads remain refused.",
+    view: "Response view supported by this operation.",
+    installationType: "Filter by the integration installation type.",
+    provider: "Vendor provider choice for this resource.",
+    source: "Source selection for the requested resource.",
+    entityKind: "Feature-flag entity kind whose attributes are being queried.",
+    attributeKey: "Feature-flag entity attribute name whose labels are being queried.",
+    filter: "Vendor filter expression for this collection.",
+    hosts: "Hostnames to include in the requested observations.",
+    ip: "IP address to match in the requested observations.",
+    isActive: "Select active or inactive records.",
+    actionType: "Filter events by their action type.",
+    ruleKind: "Filter rules by their documented kind.",
+    untagged: "Include or select records without a tag.",
+    tag: "Tag used to select records or image versions.",
+    attempt: "Invocation attempt number, distinct from the invocation identifier.",
+    runAttempt: "Job run attempt number.",
+    taskRunAttempt: "Task run attempt number.",
+    follow: "Live-follow choice; Connecta refuses following unbounded streams through the hatch.",
+    repository: "Repository identifier used by this Vercel CI operation.",
+    deprecated: "Include or select deprecated records.",
+    status: "Filter by the record's current status.",
+    conclusion: "Filter by the check's reported conclusion.",
+    blocks: "Select blocking checks for this operation.",
+    delimiter: "Delimiter used to group the returned resource keys.",
+    builds: "Select build-related records or include build information.",
+};
+export function discoveryIndex(data) {
+    const details = JSON.parse(data.details);
+    for (const row of details.o)
+        if (row)
+            for (const parameter of row[0]) {
+                // A record-count limit is a positive whole number even where the pin
+                // says only "number". Preserve a documented maximum; invent none.
+                if (parameter[0] === "limit") {
+                    let node = parameter[3];
+                    while (typeof node["$"] === "number")
+                        node = details.d[node["$"]];
+                    parameter[3] = { ...node, t: "integer", l: Math.max(1, typeof node["l"] === "number" ? node["l"] : 1) };
+                }
+                if (parameter[4])
+                    continue;
+                const name = parameter[0];
+                const description = PARAMETERS[name] ??
+                    (/(?:Id|ID|IdOrName|IdOrSlug|Slug)$/.test(name) || name === "id" || name === "idOrName"
+                        ? "Observed identifier (or documented name/slug) of this path's resource; resolve it from the matching collection and encode it as one URI segment."
+                        : undefined);
+                if (!description)
+                    throw new Error(`Vercel parameter ${name} needs a reviewed discovery description.`);
+                parameter[4] = description;
+            }
+    return {
+        ...data,
+        details: JSON.stringify(details),
+        ops: data.ops.map((row) => {
+            const summary = SUMMARIES[`${row[0]} ${row[1]}`] ?? row[3];
+            if (!summary)
+                throw new Error(`Vercel operation ${row[0]} ${row[1]} needs a reviewed summary.`);
+            return row[5] === undefined
+                ? [row[0], row[1], row[2], summary, row[4]]
+                : [row[0], row[1], row[2], summary, row[4], row[5]];
+        }),
+    };
+}

package/dist/providers/vercel/lib/logs.js

@@ -0,0 +1,100 @@
+/**
+ * Items of a possibly cut-off JSON array, or complete NDJSON lines: a bounded
+ * log read stops mid-body, and the rows it finished are still the answer.
+ */
+export function completeRows(body) {
+    const trimmed = body.trimStart();
+    if (!trimmed.startsWith("[")) {
+        const rows = [];
+        for (const line of body.split("\n")) {
+            if (line.trim() === "")
+                continue;
+            try {
+                rows.push(JSON.parse(line));
+            }
+            catch {
+                // A line the read cut off, or one Vercel did not finish.
+            }
+        }
+        return rows;
+    }
+    try {
+        const whole = JSON.parse(trimmed);
+        if (Array.isArray(whole))
+            return whole;
+    }
+    catch {
+        // Cut off: scan for the complete top-level items below.
+    }
+    const rows = [];
+    let depth = 0;
+    let start = -1;
+    let quoted = false;
+    let escaped = false;
+    for (let at = 1; at < trimmed.length; at += 1) {
+        const character = trimmed[at];
+        if (quoted) {
+            if (escaped)
+                escaped = false;
+            else if (character === "\\")
+                escaped = true;
+            else if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"') {
+            quoted = true;
+            if (depth === 0 && start < 0)
+                start = at;
+        }
+        else if (character === "{" || character === "[") {
+            if (depth === 0)
+                start = at;
+            depth += 1;
+        }
+        else if (character === "}" || character === "]") {
+            depth -= 1;
+            if (depth < 0)
+                break;
+            if (depth === 0 && start >= 0) {
+                try {
+                    rows.push(JSON.parse(trimmed.slice(start, at + 1)));
+                }
+                catch {
+                    // Not a complete item.
+                }
+                start = -1;
+            }
+        }
+    }
+    return rows;
+}
+/** Count completed rows only; retained text is just the unfinished line. */
+export function rowStop(limits) {
+    const decoder = new TextDecoder();
+    let pending = "";
+    let rows = 0;
+    return (chunk) => {
+        if (limits.maxRows === undefined)
+            return false;
+        pending += decoder.decode(chunk, { stream: true });
+        const lines = pending.split("\n");
+        pending = lines.pop() ?? "";
+        for (const line of lines) {
+            if (line.trim() === "")
+                continue;
+            let row;
+            try {
+                row = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (limits.accept && !limits.accept(row))
+                continue;
+            if (++rows >= limits.maxRows)
+                return true;
+        }
+        return false;
+    };
+}