emdash 1.0.1 → 1.2.0

package/dist/stage-DA0NrTRZ.mjs

@@ -1,662 +0,0 @@
-import { i as transferErrorDetailSchema, r as isTransferError, t as TransferError } from "./errors-CjXd1LgH.mjs";
-import { o as TRANSFER_LIMITS } from "./canonical-CAecl1UQ.mjs";
-import { a as isSha256Digest, i as createSha256, r as createHashingStream } from "./digest-DiYAoZpf.mjs";
-import { r as bumpRunningExportWriteEpochs } from "./fence-8MaKKWhp.mjs";
-import { n as siteImportReceiptSchema } from "./receipt-C4icyHlC.mjs";
-import { a as timestampIsOlderThan, b as transferCursorSchema, c as EXECUTING_IMPORT_STATES, f as PRE_EXECUTION_IMPORT_STATES, h as TRANSFER_RUNTIME_GENERATION, i as timestampIsLive, m as TERMINAL_IMPORT_STATES, o as timestampNow, r as timestampIsDue, s as timestampOffset, v as isTransferOperationKind, x as transferProgressSchema, y as isTransferOperationState } from "./approvals-CVvJSEBF.mjs";
-import { n as stagingAuxKey, r as stagingKey } from "./keys-DWwMxdZh.mjs";
-import { sql } from "kysely";
-import { ulid } from "ulidx";
-
-//#region src/transfer/ops/operations.ts
-/**
-* Transfer operation rows: creation, lease claims, and lease-fenced state
-* writes.
-*
-* Every step of a running operation happens under a lease: `claim` is one
-* `UPDATE … WHERE lease is free … RETURNING` statement that installs a fresh
-* ULID lease token, and every later write is fenced on that token and on the
-* lease still being live. A caller that loses its lease (expiry, another
-* caller took over) gets `TRANSFER_LEASE_LOST` and must stop without writing.
-*/
-function toPublicOperation(operation) {
-	const { stagingSecret: _secret, leaseToken: _lease, ...rest } = operation;
-	return rest;
-}
-const MAX_IDEMPOTENCY_KEY_LENGTH = 255;
-function parseJson(value) {
-	if (value === null) return null;
-	return JSON.parse(value);
-}
-function toOperation(row) {
-	const { kind, state } = row;
-	if (!isTransferOperationKind(kind) || !isTransferOperationState(state)) throw new TransferError("TRANSFER_INVALID_STATE", "Unknown transfer operation kind or state");
-	const cursor = parseJson(row.cursor);
-	const progress = parseJson(row.progress);
-	const receipt = parseJson(row.receipt);
-	const errorDetail = parseJson(row.error_detail);
-	return {
-		id: row.id,
-		kind,
-		state,
-		stage: row.stage,
-		cursor: cursor === null ? null : transferCursorSchema.parse(cursor),
-		progress: progress === null ? null : transferProgressSchema.parse(progress),
-		options: parseJson(row.options),
-		idempotencyKey: row.idempotency_key,
-		packageDigest: isSha256Digest(row.package_digest) ? row.package_digest : null,
-		planDigest: isSha256Digest(row.plan_digest) ? row.plan_digest : null,
-		originSiteId: row.origin_site_id,
-		stagingSecret: row.staging_secret,
-		receipt: receipt === null ? null : siteImportReceiptSchema.parse(receipt),
-		errorCode: row.error_code,
-		errorDetail: errorDetail === null ? null : transferErrorDetailSchema.parse(errorDetail),
-		writeEpoch: Number(row.write_epoch),
-		attemptCount: Number(row.attempt_count),
-		leaseToken: row.lease_token,
-		leaseExpiresAt: row.lease_expires_at,
-		runtimeGeneration: Number(row.runtime_generation),
-		cancelRequestedAt: row.cancel_requested_at,
-		mutationStartedAt: row.mutation_started_at,
-		createdBy: row.created_by,
-		createdAt: row.created_at,
-		updatedAt: row.updated_at,
-		completedAt: row.completed_at,
-		expiresAt: row.expires_at,
-		stagingCollectedAt: row.staging_collected_at
-	};
-}
-function createStagingSecret() {
-	const bytes = new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-var TransferOperationRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	async get(id) {
-		const row = await this.db.selectFrom("_emdash_transfer_operations").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? toOperation(row) : null;
-	}
-	async require(id) {
-		const operation = await this.get(id);
-		if (!operation) throw new TransferError("TRANSFER_OPERATION_NOT_FOUND", "Transfer operation not found");
-		return operation;
-	}
-	/**
-	* Create an operation, or return the existing one for the same
-	* `(createdBy, kind, idempotencyKey)`. Throws
-	* `TRANSFER_IDEMPOTENCY_CONFLICT` when that key was used with a different
-	* package digest, and `TRANSFER_IMPORT_IN_PROGRESS` when another import
-	* already occupies the target.
-	*/
-	async create(input) {
-		if (input.idempotencyKey !== void 0 && (input.idempotencyKey.length === 0 || input.idempotencyKey.length > MAX_IDEMPOTENCY_KEY_LENGTH)) throw new TransferError("TRANSFER_IDEMPOTENCY_CONFLICT", "Invalid idempotency key");
-		if (input.idempotencyKey !== void 0) {
-			const existing = await this.findByIdempotencyKey(input);
-			if (existing) return {
-				operation: existing,
-				created: false
-			};
-		}
-		const id = ulid();
-		const inserted = await this.db.insertInto("_emdash_transfer_operations").values({
-			id,
-			kind: input.kind,
-			state: input.kind === "export" ? "pending" : "uploading",
-			idempotency_key: input.idempotencyKey ?? null,
-			package_digest: input.packageDigest ?? null,
-			origin_site_id: input.originSiteId ?? null,
-			options: input.options === void 0 ? null : JSON.stringify(input.options),
-			staging_secret: createStagingSecret(),
-			runtime_generation: TRANSFER_RUNTIME_GENERATION,
-			created_by: input.createdBy,
-			expires_at: timestampOffset(this.db, input.ttlSeconds ?? defaultTtl(input.kind)),
-			stage: null,
-			cursor: null,
-			progress: null,
-			plan_digest: null,
-			receipt: null,
-			error_code: null,
-			error_detail: null,
-			lease_token: null,
-			lease_expires_at: null,
-			cancel_requested_at: null,
-			mutation_started_at: null,
-			completed_at: null,
-			staging_collected_at: null
-		}).onConflict((conflict) => conflict.doNothing()).returningAll().executeTakeFirst();
-		if (inserted) return {
-			operation: toOperation(inserted),
-			created: true
-		};
-		if (input.idempotencyKey !== void 0) {
-			const existing = await this.findByIdempotencyKey(input);
-			if (existing) return {
-				operation: existing,
-				created: false
-			};
-		}
-		throw new TransferError("TRANSFER_IMPORT_IN_PROGRESS", "Another import is already in progress on this site");
-	}
-	async findByIdempotencyKey(input) {
-		const row = await this.db.selectFrom("_emdash_transfer_operations").selectAll().where("created_by", "=", input.createdBy).where("kind", "=", input.kind).where("idempotency_key", "=", input.idempotencyKey ?? "").executeTakeFirst();
-		if (!row) return null;
-		if (input.packageDigest !== void 0 && row.package_digest !== null && row.package_digest !== input.packageDigest) throw new TransferError("TRANSFER_IDEMPOTENCY_CONFLICT", "Idempotency key was already used for a different package");
-		return toOperation(row);
-	}
-	/** The import that currently occupies the target, if any. */
-	async findOccupyingImport() {
-		const row = await this.db.selectFrom("_emdash_transfer_operations").selectAll().where("kind", "=", "import").where((eb) => eb.or([eb("state", "in", [...PRE_EXECUTION_IMPORT_STATES, ...EXECUTING_IMPORT_STATES]), eb.and([eb("state", "in", ["failed", "cancelled"]), eb("mutation_started_at", "is not", null)])])).executeTakeFirst();
-		return row ? toOperation(row) : null;
-	}
-	/**
-	* Take the operation's lease if it is in one of `states` and no live lease
-	* exists. Throws `TRANSFER_OPERATION_NOT_FOUND`, or
-	* `TRANSFER_RUNTIME_MISMATCH` when the row was written by an incompatible
-	* runtime generation.
-	*/
-	async claim(id, states, options = {}) {
-		const leaseToken = ulid();
-		const now = timestampNow(this.db);
-		const row = await this.db.updateTable("_emdash_transfer_operations").set({
-			lease_token: leaseToken,
-			lease_expires_at: timestampOffset(this.db, options.leaseSeconds ?? TRANSFER_LIMITS.leaseSeconds),
-			attempt_count: sql`attempt_count + 1`,
-			updated_at: now
-		}).where("id", "=", id).where("state", "in", [...states]).where("runtime_generation", "=", TRANSFER_RUNTIME_GENERATION).where((eb) => eb.or([
-			eb("lease_token", "is", null),
-			eb("lease_expires_at", "is", null),
-			timestampIsDue(this.db, "lease_expires_at")
-		])).returningAll().executeTakeFirst();
-		if (row) return {
-			outcome: "claimed",
-			operation: toOperation(row),
-			leaseToken
-		};
-		const current = await this.require(id);
-		if (current.runtimeGeneration !== TRANSFER_RUNTIME_GENERATION) throw new TransferError("TRANSFER_RUNTIME_MISMATCH", "Transfer operation was created by an incompatible EmDash version");
-		if (!states.includes(current.state)) return {
-			outcome: "invalid_state",
-			operation: current
-		};
-		return {
-			outcome: "lease_active",
-			operation: current
-		};
-	}
-	/**
-	* Write state under the lease and extend it. Throws `TRANSFER_LEASE_LOST`
-	* when the lease is gone.
-	*/
-	async advance(id, leaseToken, patch) {
-		return this.fencedUpdate(id, leaseToken, {
-			...this.patchValues(patch),
-			lease_expires_at: timestampOffset(this.db, TRANSFER_LIMITS.leaseSeconds)
-		});
-	}
-	/** Write state and give up the lease so the next step can claim it. */
-	async release(id, leaseToken, patch = {}) {
-		return this.fencedUpdate(id, leaseToken, {
-			...this.patchValues(patch),
-			lease_token: null,
-			lease_expires_at: null
-		});
-	}
-	/**
-	* Write `patch`, move to `state`, and give up the lease; when a cancel was
-	* requested while the lease was held, move to `cancelled` instead. One
-	* statement decides, so a cancel racing the release is never lost.
-	*/
-	async releaseUnlessCancelled(id, leaseToken, state, patch = {}) {
-		const now = timestampNow(this.db);
-		return this.fencedUpdate(id, leaseToken, {
-			...this.patchValues(patch),
-			state: sql`CASE WHEN cancel_requested_at IS NULL THEN ${state} ELSE 'cancelled' END`,
-			completed_at: sql`CASE WHEN cancel_requested_at IS NULL THEN completed_at ELSE ${now} END`,
-			lease_token: null,
-			lease_expires_at: null
-		});
-	}
-	async complete(id, leaseToken, result = {}) {
-		return this.fencedUpdate(id, leaseToken, {
-			state: "complete",
-			receipt: result.receipt === void 0 ? void 0 : JSON.stringify(result.receipt),
-			progress: result.progress === void 0 ? void 0 : JSON.stringify(result.progress),
-			completed_at: timestampNow(this.db),
-			expires_at: result.ttlSeconds === void 0 ? void 0 : timestampOffset(this.db, result.ttlSeconds),
-			lease_token: null,
-			lease_expires_at: null
-		});
-	}
-	async fail(id, leaseToken, error) {
-		return this.fencedUpdate(id, leaseToken, {
-			state: "failed",
-			error_code: error.code,
-			error_detail: error.detail === void 0 ? null : JSON.stringify(error.detail),
-			completed_at: timestampNow(this.db),
-			lease_token: null,
-			lease_expires_at: null
-		});
-	}
-	/** Finish a cancellation the lease holder observed via `cancelRequestedAt`. */
-	async finishCancelled(id, leaseToken) {
-		return this.fencedUpdate(id, leaseToken, {
-			state: "cancelled",
-			completed_at: timestampNow(this.db),
-			lease_token: null,
-			lease_expires_at: null
-		});
-	}
-	/**
-	* Cancel an import. Without a live lease the operation becomes `cancelled`
-	* immediately; otherwise `cancel_requested_at` is set and the lease holder
-	* stops after its current batch. Returns the updated operation.
-	*/
-	async requestCancel(id) {
-		const cancellable = [...PRE_EXECUTION_IMPORT_STATES, ...EXECUTING_IMPORT_STATES];
-		const now = timestampNow(this.db);
-		const immediate = await this.db.updateTable("_emdash_transfer_operations").set({
-			state: "cancelled",
-			cancel_requested_at: now,
-			completed_at: now,
-			updated_at: now,
-			lease_token: null,
-			lease_expires_at: null
-		}).where("id", "=", id).where("kind", "=", "import").where("state", "in", cancellable).where((eb) => eb.or([
-			eb("lease_token", "is", null),
-			eb("lease_expires_at", "is", null),
-			timestampIsDue(this.db, "lease_expires_at")
-		])).returningAll().executeTakeFirst();
-		if (immediate) return toOperation(immediate);
-		const flagged = await this.db.updateTable("_emdash_transfer_operations").set({
-			cancel_requested_at: now,
-			updated_at: now
-		}).where("id", "=", id).where("kind", "=", "import").where("state", "in", cancellable).returningAll().executeTakeFirst();
-		if (flagged) return toOperation(flagged);
-		await this.require(id);
-		throw new TransferError("TRANSFER_INVALID_STATE", "Transfer operation cannot be cancelled");
-	}
-	/**
-	* Mark a failed or cancelled import abandoned. Lifts the write fence; never
-	* deletes imported data.
-	*/
-	async abandon(id) {
-		const now = timestampNow(this.db);
-		const row = await this.db.updateTable("_emdash_transfer_operations").set({
-			state: "abandoned",
-			updated_at: now
-		}).where("id", "=", id).where("kind", "=", "import").where("state", "in", ["failed", "cancelled"]).where((eb) => eb.or([
-			eb("lease_token", "is", null),
-			eb("lease_expires_at", "is", null),
-			timestampIsDue(this.db, "lease_expires_at")
-		])).returningAll().executeTakeFirst();
-		if (row) return toOperation(row);
-		await this.require(id);
-		throw new TransferError("TRANSFER_INVALID_STATE", "Only a failed or cancelled import can be abandoned");
-	}
-	/**
-	* Move operations past their `expires_at` to `expired` (pre-execution
-	* imports and every non-expired export) when no live lease holds them.
-	* Returns the expired operations so their staging can be collected.
-	*/
-	async expireDue(limit = 50) {
-		const candidates = await this.db.selectFrom("_emdash_transfer_operations").select("id").where("expires_at", "is not", null).where(timestampIsDue(this.db, "expires_at")).where((eb) => eb.or([eb.and([
-			eb("kind", "=", "import"),
-			eb("state", "in", [...PRE_EXECUTION_IMPORT_STATES]),
-			eb("mutation_started_at", "is", null)
-		]), eb.and([eb("kind", "=", "export"), eb("state", "in", [
-			"pending",
-			"running",
-			"complete",
-			"failed"
-		])])])).where((eb) => eb.or([
-			eb("lease_token", "is", null),
-			eb("lease_expires_at", "is", null),
-			timestampIsDue(this.db, "lease_expires_at")
-		])).orderBy("expires_at").limit(limit).execute();
-		if (candidates.length === 0) return [];
-		const now = timestampNow(this.db);
-		return (await this.db.updateTable("_emdash_transfer_operations").set({
-			state: "expired",
-			updated_at: now,
-			lease_token: null,
-			lease_expires_at: null
-		}).where("id", "in", candidates.map((candidate) => candidate.id)).where(timestampIsDue(this.db, "expires_at")).where((eb) => eb.or([eb.and([
-			eb("kind", "=", "import"),
-			eb("state", "in", [...PRE_EXECUTION_IMPORT_STATES]),
-			eb("mutation_started_at", "is", null)
-		]), eb.and([eb("kind", "=", "export"), eb("state", "in", [
-			"pending",
-			"running",
-			"complete",
-			"failed"
-		])])])).returning([
-			"id",
-			"kind",
-			"staging_secret"
-		]).execute()).flatMap((row) => isTransferOperationKind(row.kind) ? [{
-			id: row.id,
-			kind: row.kind,
-			stagingSecret: row.staging_secret
-		}] : []);
-	}
-	/**
-	* Operations whose staging area can be collected and has not been yet:
-	* imports in a terminal state, and exports that failed or expired
-	* (complete exports stay downloadable until they expire). Oldest first.
-	* A collector deletes staged objects with `TransferStage.deleteSome` until
-	* it returns 0, deletes child rows with {@link deleteChildRows} until it
-	* returns 0, then calls {@link markCollected}; a crash anywhere in between
-	* leaves the operation listed here, so collection resumes.
-	*
-	* `importRetentionSeconds` keeps a finished import's staging for that long
-	* after its last state change; expired imports are listed at once.
-	*/
-	async listUncollected(limit = 20, options = {}) {
-		const retention = options.importRetentionSeconds ?? 0;
-		const retainedStates = TERMINAL_IMPORT_STATES.filter((state) => state !== "expired");
-		return (await this.db.selectFrom("_emdash_transfer_operations").select([
-			"id",
-			"kind",
-			"state",
-			"staging_secret"
-		]).where("staging_collected_at", "is", null).where((eb) => eb.or([
-			eb.and([eb("kind", "=", "import"), eb("state", "=", "expired")]),
-			eb.and([
-				eb("kind", "=", "import"),
-				eb("state", "in", retainedStates),
-				timestampIsOlderThan(this.db, "updated_at", retention)
-			]),
-			eb.and([eb("kind", "=", "export"), eb("state", "in", ["failed", "expired"])])
-		])).where((eb) => eb.or([
-			eb("lease_token", "is", null),
-			eb("lease_expires_at", "is", null),
-			timestampIsDue(this.db, "lease_expires_at")
-		])).orderBy("updated_at").orderBy("id").limit(Math.min(Math.max(limit, 1), 100)).execute()).flatMap((row) => isTransferOperationKind(row.kind) && isTransferOperationState(row.state) ? [{
-			id: row.id,
-			kind: row.kind,
-			state: row.state,
-			stagingSecret: row.staging_secret
-		}] : []);
-	}
-	/** Record that an operation's staging area and child rows are gone. */
-	async markCollected(id) {
-		await this.db.updateTable("_emdash_transfer_operations").set({ staging_collected_at: timestampNow(this.db) }).where("id", "=", id).where("staging_collected_at", "is", null).execute();
-	}
-	/**
-	* Delete up to `limit` child rows of each child table of an operation
-	* (staged files, package index, media blobs), one bounded statement per
-	* table. Returns the number deleted; call until it returns 0. Always drain
-	* children this way before deleting an operation row: an `ON DELETE
-	* CASCADE` over millions of child rows in one statement exceeds D1's
-	* limits.
-	*/
-	async deleteChildRows(operationId, limit = 500) {
-		const bounded = Math.min(Math.max(Math.trunc(limit), 1), 5e3);
-		return [
-			await sql`
-			DELETE FROM _emdash_transfer_staged_files
-			WHERE operation_id = ${operationId}
-				AND path IN (
-					SELECT path FROM _emdash_transfer_staged_files
-					WHERE operation_id = ${operationId}
-					LIMIT ${bounded}
-				)
-		`.execute(this.db),
-			await sql`
-			DELETE FROM _emdash_transfer_package_index
-			WHERE operation_id = ${operationId}
-				AND (kind, id) IN (
-					SELECT kind, id FROM _emdash_transfer_package_index
-					WHERE operation_id = ${operationId}
-					LIMIT ${bounded}
-				)
-		`.execute(this.db),
-			await sql`
-			DELETE FROM _emdash_transfer_media_blobs
-			WHERE operation_id = ${operationId}
-				AND media_id IN (
-					SELECT media_id FROM _emdash_transfer_media_blobs
-					WHERE operation_id = ${operationId}
-					LIMIT ${bounded}
-				)
-		`.execute(this.db)
-		].reduce((sum, result) => sum + Number(result.numAffectedRows ?? 0n), 0);
-	}
-	/**
-	* Delete a collected operation row once it has no child rows left.
-	* Returns false, deleting nothing, otherwise. Identity-map rows are kept.
-	*/
-	async deleteIfChildless(id) {
-		const result = await this.db.deleteFrom("_emdash_transfer_operations").where("id", "=", id).where("staging_collected_at", "is not", null).where((eb) => eb.and([
-			eb.not(eb.exists(eb.selectFrom("_emdash_transfer_staged_files").select("path").where("_emdash_transfer_staged_files.operation_id", "=", id))),
-			eb.not(eb.exists(eb.selectFrom("_emdash_transfer_package_index").select("kind").where("_emdash_transfer_package_index.operation_id", "=", id))),
-			eb.not(eb.exists(eb.selectFrom("_emdash_transfer_media_blobs").select("media_id").where("_emdash_transfer_media_blobs.operation_id", "=", id)))
-		])).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0n) > 0;
-	}
-	/**
-	* Bump `write_epoch` on every running export. Fenced write paths call this
-	* so an export's consistency fence notices writes to tables that have no
-	* `updated_at`. Returns the number of exports touched.
-	*/
-	async recordWriteForRunningExports() {
-		return bumpRunningExportWriteEpochs(this.db);
-	}
-	/** Operations newest first, `{ items, nextCursor }` over `(created_at, id)`. */
-	async list(options = {}) {
-		const limit = Math.min(Math.max(options.limit ?? 50, 1), 100);
-		let query = this.db.selectFrom("_emdash_transfer_operations").selectAll();
-		if (options.kind) query = query.where("kind", "=", options.kind);
-		if (options.createdBy) query = query.where("created_by", "=", options.createdBy);
-		const cursor = options.cursor;
-		if (cursor) query = query.where((eb) => eb.or([eb("created_at", "<", cursor.createdAt), eb.and([eb("created_at", "=", cursor.createdAt), eb("id", "<", cursor.id)])]));
-		const rows = await query.orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1).execute();
-		const items = rows.slice(0, limit).map((row) => toPublicOperation(toOperation(row)));
-		const last = items.at(-1);
-		return rows.length > limit && last ? {
-			items,
-			next: {
-				createdAt: last.createdAt,
-				id: last.id
-			}
-		} : { items };
-	}
-	patchValues(patch) {
-		const values = {};
-		if (patch.state !== void 0) values.state = patch.state;
-		if (patch.stage !== void 0) values.stage = patch.stage;
-		if (patch.cursor !== void 0) values.cursor = patch.cursor === null ? null : JSON.stringify(transferCursorSchema.parse(patch.cursor));
-		if (patch.progress !== void 0) values.progress = patch.progress === null ? null : JSON.stringify(transferProgressSchema.parse(patch.progress));
-		if (patch.packageDigest !== void 0) values.package_digest = patch.packageDigest;
-		if (patch.planDigest !== void 0) values.plan_digest = patch.planDigest;
-		if (patch.originSiteId !== void 0) values.origin_site_id = patch.originSiteId;
-		if (patch.markMutationStarted) values.mutation_started_at = sql`COALESCE(mutation_started_at, ${timestampNow(this.db)})`;
-		if (patch.ttlSeconds !== void 0) values.expires_at = timestampOffset(this.db, patch.ttlSeconds);
-		if (patch.retryError !== void 0) {
-			values.error_code = patch.retryError?.code ?? null;
-			values.error_detail = patch.retryError?.detail === void 0 ? null : JSON.stringify(patch.retryError.detail);
-		}
-		return values;
-	}
-	async fencedUpdate(id, leaseToken, values) {
-		const row = await this.db.updateTable("_emdash_transfer_operations").set({
-			...values,
-			updated_at: timestampNow(this.db)
-		}).where("id", "=", id).where("lease_token", "=", leaseToken).where("lease_expires_at", "is not", null).where(timestampIsLive(this.db, "lease_expires_at")).returningAll().executeTakeFirst();
-		if (!row) throw new TransferError("TRANSFER_LEASE_LOST", "Transfer operation lease was lost");
-		return toOperation(row);
-	}
-};
-function defaultTtl(kind) {
-	return kind === "export" ? TRANSFER_LIMITS.exportTtlSeconds : TRANSFER_LIMITS.pendingImportTtlSeconds;
-}
-
-//#endregion
-//#region src/transfer/staging/stage.ts
-const PACKAGE_CONTENT_TYPE = "application/octet-stream";
-function oversizeError() {
-	return new TransferError("TRANSFER_FILE_SIZE_MISMATCH", "File is larger than declared");
-}
-function toStream(body) {
-	if (body instanceof Uint8Array) return new ReadableStream({ start(controller) {
-		if (body.byteLength > 0) controller.enqueue(body);
-		controller.close();
-	} });
-	return body;
-}
-/**
-* Stream `body` into `key`, hashing and counting as it goes. The object is
-* kept only if exactly `expected.bytes` bytes with digest `expected.sha256`
-* were written; otherwise it is deleted and `TRANSFER_FILE_SIZE_MISMATCH` or
-* `TRANSFER_FILE_DIGEST_MISMATCH` is thrown. Where the runtime provides
-* `FixedLengthStream` (workerd), the upload is wrapped in one so R2 receives
-* a known length.
-*
-* Callers staging a package file must check its staged-files row first and
-* refuse the upload when it is already `verified` and its object still
-* matches, and must pass `keepExistingOnFailure` returning true once the row
-* is verified: a failed retry or concurrent upload of the same path must not
-* delete the object a successful upload stored. A failing upload that
-* already overwrote the object can still leave bad bytes behind a verified
-* row, so readers verify sizes and digests again when they read staged
-* files, and a later upload of that path replaces the bad object.
-*/
-async function putVerified(storage, key, body, expected, options = {}) {
-	const discard = async () => {
-		if (options.keepExistingOnFailure && await options.keepExistingOnFailure()) return;
-		await storage.delete(key).catch(() => void 0);
-	};
-	if (!Number.isSafeInteger(expected.bytes) || expected.bytes < 0) throw new TransferError("TRANSFER_FILE_SIZE_MISMATCH", "Invalid declared size");
-	const hasher = await createSha256();
-	const hashing = createHashingStream(hasher, {
-		maxBytes: expected.bytes,
-		onLimitExceeded: oversizeError
-	});
-	let stream = toStream(body).pipeThrough(hashing.stream);
-	if (typeof FixedLengthStream !== "undefined") stream = stream.pipeThrough(new FixedLengthStream(expected.bytes));
-	try {
-		await storage.upload({
-			key,
-			body: stream,
-			contentType: options.contentType ?? PACKAGE_CONTENT_TYPE
-		});
-	} catch (error) {
-		await discard();
-		if (isTransferError(error)) throw error;
-		const cause = findTransferError(error);
-		if (cause) throw cause;
-		if (hashing.bytes() !== expected.bytes) throw new TransferError("TRANSFER_FILE_SIZE_MISMATCH", "File size does not match", { cause: error });
-		throw new TransferError("TRANSFER_STORAGE_ERROR", "Failed to store file", { cause: error });
-	}
-	const digest = await hasher.digest();
-	if (hashing.bytes() !== expected.bytes) {
-		await discard();
-		throw new TransferError("TRANSFER_FILE_SIZE_MISMATCH", "File size does not match", { detail: {
-			expected: expected.bytes,
-			actual: hashing.bytes()
-		} });
-	}
-	if (digest !== expected.sha256) {
-		await discard();
-		throw new TransferError("TRANSFER_FILE_DIGEST_MISMATCH", "File digest does not match");
-	}
-}
-function findTransferError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
-		if (current instanceof TransferError) return current;
-		current = current.cause;
-	}
-	return null;
-}
-/** Read a whole stream, failing once it exceeds `maxBytes`. */
-async function readStreamBytes(stream, maxBytes) {
-	const reader = stream.getReader();
-	const parts = [];
-	let total = 0;
-	try {
-		for (;;) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			total += value.byteLength;
-			if (total > maxBytes) throw new TransferError("TRANSFER_LIMIT_EXCEEDED", "File exceeds its size limit", { detail: { limit: maxBytes } });
-			parts.push(value);
-		}
-	} catch (error) {
-		await reader.cancel().catch(() => void 0);
-		throw error;
-	} finally {
-		reader.releaseLock();
-	}
-	const bytes = new Uint8Array(total);
-	let offset = 0;
-	for (const part of parts) {
-		bytes.set(part, offset);
-		offset += part.byteLength;
-	}
-	return bytes;
-}
-/** One operation's staging area in `storage` under `prefix` (see keys.ts). */
-var TransferStage = class {
-	constructor(storage, prefix) {
-		this.storage = storage;
-		this.prefix = prefix;
-	}
-	keyFor(path) {
-		return stagingKey(this.prefix, path);
-	}
-	async putVerified(path, body, bytes, sha256, options = {}) {
-		await putVerified(this.storage, this.keyFor(path), body, {
-			bytes,
-			sha256
-		}, options);
-	}
-	async exists(path) {
-		return this.storage.exists(this.keyFor(path));
-	}
-	async open(path) {
-		try {
-			return await this.storage.download(this.keyFor(path));
-		} catch (error) {
-			throw new TransferError("TRANSFER_FILE_MISSING", "Staged file is missing", {
-				detail: { path },
-				cause: error
-			});
-		}
-	}
-	async readBytes(path, maxBytes) {
-		return readStreamBytes((await this.open(path)).body, maxBytes);
-	}
-	async putAux(file, content) {
-		await this.storage.upload({
-			key: stagingAuxKey(this.prefix, file),
-			body: new TextEncoder().encode(content),
-			contentType: "application/json"
-		});
-	}
-	async readAux(file, maxBytes) {
-		const key = stagingAuxKey(this.prefix, file);
-		if (!await this.storage.exists(key)) return null;
-		const download = await this.storage.download(key);
-		return new TextDecoder().decode(await readStreamBytes(download.body, maxBytes));
-	}
-	/**
-	* Delete up to `limit` staged objects. Returns the number deleted; call
-	* again until it returns 0.
-	*/
-	async deleteSome(limit = 100) {
-		const listing = await this.storage.list({
-			prefix: this.prefix,
-			limit
-		});
-		for (const file of listing.files) await this.storage.delete(file.key);
-		return listing.files.length;
-	}
-};
-
-//#endregion
-export { toPublicOperation as a, TransferOperationRepository as i, putVerified as n, readStreamBytes as r, TransferStage as t };
-//# sourceMappingURL=stage-DA0NrTRZ.mjs.map