firedrill-run 2.2.5 → 3.0.1

package/dist/cli/src/credentials.js

@@ -0,0 +1,331 @@
+import { mkdir, lstat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { CliError, API_ORIGIN } from './http.js';
+import { bootstrapProcessLock } from './bootstrap-process-lock.js';
+function validDevice(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const one = value;
+    if (one.schema !== 'firedrill.device-authorization.v1' || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(one.id)
+        || !['waiting', 'polling'].includes(one.state) || !/^client_[A-Za-z0-9]{1,120}$/.test(one.client_id)
+        || one.organization_hint !== null && (typeof one.organization_hint !== 'string' || !/^(?:org_[A-Za-z0-9]{1,120}|[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})$/.test(one.organization_hint))
+        || typeof one.device_code !== 'string' || !one.device_code || one.device_code.length > 16384
+        || !/^[A-Z0-9-]{4,64}$/.test(one.user_code) || typeof one.verification_url !== 'string' || one.verification_url.length > 8192
+        || !Number.isSafeInteger(one.expires_at) || one.expires_at <= 0 || !Number.isSafeInteger(one.next_poll_at) || one.next_poll_at <= 0
+        || !Number.isSafeInteger(one.interval) || one.interval < 1 || one.interval > 3600)
+        return false;
+    try {
+        const url = new URL(one.verification_url);
+        return url.protocol === 'https:' && !url.username && !url.password && !url.hash && url.pathname === '/device'
+            && [...url.searchParams.keys()].every(key => key === 'user_code')
+            && (!url.search || url.searchParams.get('user_code') === one.user_code);
+    }
+    catch {
+        return false;
+    }
+}
+function valid(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const item = value;
+    return item.schema === 'firedrill.native-credentials.v1' && ['ready', 'refresh_pending', 'organization_selection_pending'].includes(item.state)
+        && /^client_[A-Za-z0-9]{1,120}$/.test(item.client_id) && /^user_[A-Za-z0-9]{1,120}$/.test(item.subject)
+        && /^session_[A-Za-z0-9]{1,120}$/.test(item.sid) && typeof item.access_token === 'string' && item.access_token.length <= 16384
+        && typeof item.refresh_token === 'string' && item.refresh_token.length > 0 && item.refresh_token.length <= 16384
+        && Number.isSafeInteger(item.expires_at) && item.expires_at > 0;
+}
+const LINUX_STORE = { linux: { store: 'secret-service' } };
+async function entry(service = 'run.firedrill.simulation.native.v1') {
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        return new Entry(service, API_ORIGIN, process.platform === 'linux' ? LINUX_STORE : undefined);
+    }
+    catch {
+        throw new CliError('credential_store_unavailable', 'Unlock or configure your OS credential store, or use --session-only. Credentials will not be saved in a file.');
+    }
+}
+function classifyStoreError(error) {
+    // Classified from the binding's error text only. The raw text is never
+    // returned or printed because it can carry platform internals.
+    const text = error instanceof Error ? error.message : String(error);
+    if (/matched by|ambiguous/i.test(text))
+        return { ok: false, failure: 'ambiguous_entry' };
+    if (/locked|interaction is not allowed|user interaction|-25308|-128\b|cancel/i.test(text))
+        return { ok: false, failure: 'store_locked' };
+    if (/couldn.t access|no storage access|serviceunknown|org\.freedesktop|d-?bus|secret ?service|connection refused|no such file|not provided by any \.service/i.test(text))
+        return { ok: false, failure: 'store_unreachable' };
+    return { ok: false, failure: 'store_failure' };
+}
+/**
+ * Probe the OS credential store without storing any secret. The read probe looks
+ * up a fixed, normally absent entry. The write probe additionally stores a fixed
+ * non-secret marker under a separate probe service, reads it back and deletes it,
+ * so a store that can be searched but not written (for example a locked Secret
+ * Service collection) is not reported as available.
+ */
+export async function probeCredentialStore(options = {}) {
+    let Entry;
+    try {
+        ({ Entry } = await import('@napi-rs/keyring'));
+    }
+    catch {
+        return { ok: false, failure: 'binding_unavailable' };
+    }
+    options.signal?.throwIfAborted();
+    let probe;
+    try {
+        probe = new Entry('run.firedrill.simulation.probe.v1', API_ORIGIN, process.platform === 'linux' ? LINUX_STORE : undefined);
+    }
+    catch (error) {
+        return classifyStoreError(error);
+    }
+    try {
+        probe.getPassword();
+    }
+    catch (error) {
+        return classifyStoreError(error);
+    }
+    if (!options.write)
+        return { ok: true };
+    const marker = 'firedrill-credential-store-probe';
+    try {
+        options.signal?.throwIfAborted();
+        probe.setPassword(marker);
+        if (probe.getPassword() !== marker)
+            return { ok: false, failure: 'write_unconfirmed' };
+        return { ok: true };
+    }
+    catch (error) {
+        if (options.signal?.aborted)
+            throw error;
+        return classifyStoreError(error);
+    }
+    finally {
+        try {
+            probe.deleteCredential();
+        }
+        catch { /* A leftover marker is not a secret. */ }
+    }
+}
+// ---------------------------------------------------------------------------
+// Process credential mode and the volatile session store.
+let selectedMode = null;
+let companionRole = false;
+const volatile = { credentials: null, pending: null, erased: false };
+/** After erasure the volatile session is closed: an in-flight refresh or login cannot write tokens back. */
+function assertVolatileOpen() {
+    if (volatile.erased)
+        throw new CliError('companion_stopping', 'The session-only companion signed out or is stopping. No credential was kept.', 2);
+}
+/** Select the credential mode once per process, before any credential access. */
+export function setCredentialMode(mode, options = {}) {
+    if (mode !== 'persistent' && mode !== 'session')
+        throw new CliError('credential_mode_invalid', 'Use persistent or session-only credentials. No credential mode was selected.', 2);
+    const companion = options.companion === true;
+    if (selectedMode !== null) {
+        if (selectedMode === mode && companionRole === companion)
+            return;
+        throw new CliError('credential_mode_locked', 'This process already selected a credential mode. No credentials were moved between modes.', 2);
+    }
+    selectedMode = mode;
+    companionRole = companion;
+}
+/** Defaults to persistent so existing commands keep their OS-store behavior. */
+export function credentialMode() { return selectedMode ?? 'persistent'; }
+/** True only in the process that holds credentials and serves companion IPC. */
+export function isCredentialCompanion() { return companionRole; }
+function volatileHolder() {
+    if (selectedMode !== 'session')
+        return false;
+    if (!companionRole)
+        throw new CliError('session_companion_required', 'No signed-in session-only companion is running. Run `firedrill run` or `firedrill init --session-only` in another terminal, or sign in with an OS credential store.', 2);
+    return true;
+}
+/** Non-secret view of the volatile session for companion status. */
+export function volatileCredentialSummary() {
+    const value = selectedMode === 'session' && companionRole ? volatile.credentials : null;
+    return { signed_in: value?.state === 'ready', state: value?.state ?? null, subject: value?.subject ?? null, expires_at: value?.expires_at ?? null };
+}
+/**
+ * Erase the volatile credentials and pending authorization. Called on companion
+ * shutdown and process exit. JavaScript strings cannot be zeroed; dropping every
+ * reference is the strongest erasure this runtime offers.
+ */
+export function eraseVolatileCredentials() {
+    volatile.credentials = null;
+    volatile.pending = null;
+    volatile.erased = true;
+}
+const DEVICE_SERVICE = 'run.firedrill.simulation.device.v1';
+/** Separate original attempt (OS store, or memory in session mode). Never returned as a CLI/model receipt. */
+export async function loadPendingDevice() {
+    if (volatileHolder())
+        return volatile.pending ? { ...volatile.pending } : null;
+    try {
+        const encoded = (await entry(DEVICE_SERVICE)).getPassword();
+        if (encoded == null)
+            return null;
+        if (encoded.length > 30000)
+            throw new Error();
+        const value = JSON.parse(encoded);
+        if (!validDevice(value))
+            throw new Error();
+        return value;
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw new CliError('credential_store_unavailable', 'The pending authorization could not be read from the OS credential store. No replacement attempt was created.');
+    }
+}
+export async function savePendingDevice(value, signal) {
+    if (!validDevice(value))
+        throw new CliError('device_authorization_invalid', 'The pending authorization could not be confirmed.');
+    if (volatileHolder()) {
+        signal?.throwIfAborted();
+        assertVolatileOpen();
+        volatile.pending = { ...value };
+        return;
+    }
+    try {
+        const store = await entry(DEVICE_SERVICE), encoded = JSON.stringify(value);
+        signal?.throwIfAborted();
+        store.setPassword(encoded);
+        if (store.getPassword() !== encoded)
+            throw new Error();
+    }
+    catch {
+        throw new CliError('credential_store_unavailable', 'The original authorization could not be saved securely. No file fallback is used.');
+    }
+}
+export async function removePendingDevice(signal) {
+    if (volatileHolder()) {
+        signal?.throwIfAborted();
+        volatile.pending = null;
+        return;
+    }
+    try {
+        const store = await entry(DEVICE_SERVICE);
+        signal?.throwIfAborted();
+        if (store.getPassword() != null)
+            store.deleteCredential();
+        if (store.getPassword() != null)
+            throw new Error();
+    }
+    catch {
+        throw new CliError('credential_removal_unconfirmed', 'The pending authorization could not be removed from the OS credential store. No replacement attempt was created.');
+    }
+}
+export async function loadCredentials() {
+    if (volatileHolder())
+        return volatile.credentials && !volatile.erased ? { ...volatile.credentials } : null;
+    try {
+        const value = (await entry()).getPassword();
+        if (value == null)
+            return null;
+        if (value.length > 40000)
+            throw new Error();
+        const parsed = JSON.parse(value);
+        if (!valid(parsed))
+            throw new Error();
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw new CliError('credential_store_unavailable', 'The saved sign-in could not be read. Unlock your OS credential store.');
+    }
+}
+export async function saveCredentials(value, signal) {
+    if (!valid(value))
+        throw new CliError('credentials_invalid', 'The sign-in response is incomplete.');
+    if (volatileHolder()) {
+        signal?.throwIfAborted();
+        assertVolatileOpen();
+        volatile.credentials = { ...value };
+        return;
+    }
+    try {
+        const store = await entry();
+        const encoded = JSON.stringify(value);
+        signal?.throwIfAborted();
+        store.setPassword(encoded);
+        if (store.getPassword() !== encoded)
+            throw new Error();
+    }
+    catch {
+        throw new CliError('credential_store_unavailable', 'Sign-in could not be saved to the OS credential store. No file fallback is used.');
+    }
+}
+export async function removeCredentials(signal) {
+    if (volatileHolder()) {
+        signal?.throwIfAborted();
+        volatile.credentials = null;
+        return;
+    }
+    try {
+        const store = await entry();
+        signal?.throwIfAborted();
+        if (store.getPassword() != null)
+            store.deleteCredential();
+        if (store.getPassword() != null)
+            throw new Error();
+    }
+    catch {
+        throw new CliError('credential_removal_unconfirmed', 'Terminal access was revoked, but local credential removal was not confirmed. Unlock the OS credential store and run logout again.');
+    }
+}
+export async function ensurePrivateDirectory(directory) {
+    await mkdir(directory, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+        throw error; });
+    const stat = await lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (process.getuid && stat.uid !== process.getuid())
+        || process.platform !== 'win32' && (stat.mode & 0o077) !== 0) {
+        throw new CliError('credential_lock_unsafe', 'Use a private Firedrill state directory owned by this OS user, without symbolic links or shared permissions.');
+    }
+    return directory;
+}
+export async function privateDirectory() {
+    const root = await ensurePrivateDirectory(join(homedir(), '.firedrill-simulation'));
+    if (API_ORIGIN === 'https://api.firedrill.run')
+        return root;
+    // Public history is not moved or searched as a development fallback. Every
+    // request journal, local source bundle, runner and helper cache below this
+    // directory inherits the same selected non-production API namespace as the keyring.
+    const profiles = await ensurePrivateDirectory(join(root, 'profiles'));
+    return ensurePrivateDirectory(join(profiles, createHash('sha256').update(API_ORIGIN).digest('hex')));
+}
+let volatileLockTail = Promise.resolve();
+export async function credentialLock(work) {
+    if (volatileHolder()) {
+        // Session credentials live only in this process, so an in-process queue
+        // serializes login/refresh intent. refresh_pending still refuses a second
+        // exchange of an uncertain refresh credential.
+        const previous = volatileLockTail;
+        let release = () => { };
+        volatileLockTail = new Promise(resolve => { release = resolve; });
+        await previous;
+        try {
+            return await work(new AbortController().signal);
+        }
+        finally {
+            release();
+        }
+    }
+    // OS-owned coordination releases on process death. The saved refresh_pending
+    // state still refuses another exchange of an uncertain refresh credential.
+    // A retained directory lock from a prior client is never stolen or removed.
+    const directory = await privateDirectory();
+    const lock = await bootstrapProcessLock(join(directory, 'auth.lock'), { waitMs: 30000 });
+    try {
+        lock.assertHeld();
+        const value = await work(lock.signal);
+        lock.assertHeld();
+        return value;
+    }
+    finally {
+        await lock.close();
+    }
+}

package/dist/cli/src/credit-format.js

@@ -0,0 +1,8 @@
+import { CliError } from './http.js';
+export function creditAmount(units, scale) {
+    if (!Number.isSafeInteger(units) || units < 0 || !Number.isSafeInteger(scale) || scale < 1 || !/^10*$/.test(String(scale)))
+        throw new CliError('credit_amount_unconfirmed', 'The frozen credit amount could not be confirmed. No amount was estimated.');
+    const value = BigInt(units), divisor = BigInt(scale), digits = String(scale).length - 1;
+    const fraction = (value % divisor).toString().padStart(digits, '0').replace(/0+$/, '');
+    return new Intl.NumberFormat().format(value / divisor) + (fraction ? '.' + fraction : '');
+}

package/dist/cli/src/dataset-contracts.js

@@ -0,0 +1 @@
+export * from '../../contracts/dataset-contracts.js';

package/dist/cli/src/dataset-export.js

@@ -0,0 +1,154 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { link, lstat, open, realpath, unlink } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { access } from './auth.js';
+import { CliError, endpoint, responseError } from './http.js';
+import { selectOne, terminalText } from './prompts.js';
+import { identifier } from './world-contracts.js';
+import { datasetReads } from './dataset-reads.js';
+const interactive = (options) => !options.json && !!process.stdin.isTTY && !!process.stderr.isTTY;
+async function question(label, signal) {
+    const prompt = createInterface({ input: process.stdin, output: process.stderr, terminal: false });
+    try {
+        return (await prompt.question(label, { signal })).trim();
+    }
+    finally {
+        prompt.close();
+    }
+}
+async function chooseDataset(prefix, scope, signal) {
+    let page = 1, query = '';
+    while (true) {
+        const rows = await datasetReads(prefix, scope, signal).page({ page, query, state: 'retained' });
+        const choices = rows.results.filter(row => row.available).map(row => ({ value: row.id, label: row.name, detail: `Version ${row.version}` }));
+        if (page > 1)
+            choices.unshift({ value: 'previous', label: 'Previous page', detail: '' });
+        if (rows.next)
+            choices.push({ value: 'next', label: 'Next page', detail: '' });
+        choices.push({ value: 'search', label: 'Search datasets', detail: query }, { value: 'cancel', label: 'Cancel', detail: '' });
+        const choice = await selectOne('Dataset to export', choices, signal);
+        if (choice === 'next') {
+            page++;
+            continue;
+        }
+        if (choice === 'previous') {
+            page--;
+            continue;
+        }
+        if (choice === 'cancel')
+            throw new CliError('canceled', 'No dataset was downloaded.', 130);
+        if (choice === 'search') {
+            query = await question('Find a dataset (blank for all): ', signal);
+            if (query.length > 200 || /[\u0000-\u001f\u007f-\u009f]/u.test(query))
+                throw new CliError('dataset_search_invalid', 'Use search text of up to 200 characters.', 2);
+            page = 1;
+            continue;
+        }
+        return identifier(choice);
+    }
+}
+function metadata(row, id) {
+    if (!row || row.id !== id || row.available !== true || !row.file || !Number.isSafeInteger(row.file.size)
+        || row.file.size < 1 || row.file.size > 8 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(row.file.sha256))
+        throw new CliError('dataset_export_unavailable', 'The original dataset file is unavailable. Inspect its saved version before downloading.', 2);
+    return row.file;
+}
+/** Read-only export of original GCS bytes. No recipe application or target run. */
+export async function exportDataset(prefix, selected, scope, options, output) {
+    const uuid = '[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}';
+    if (!new RegExp(`^/api/workspaces/${identifier(scope.workspace)}/(?:tools|worlds/${uuid})$`).test(prefix))
+        throw new CliError('dataset_export_scope_invalid', 'Choose a dataset in the current workspace.', 2);
+    const tty = interactive(options);
+    if (!selected && !tty)
+        throw new CliError('dataset_required', 'Provide a saved dataset version ID.', 2);
+    const id = selected ? identifier(selected) : await chooseDataset(prefix, scope, options.signal);
+    const reads = datasetReads(prefix, scope, options.signal);
+    const row = await reads.detail(id), expected = metadata(row, id);
+    const into = options.into ?? (tty ? await question('Save private dataset JSON to a new file: ', options.signal) : '');
+    if (!into.trim() || /[\u0000-\u001f\u007f-\u009f]/u.test(into))
+        throw new CliError('dataset_export_path_required', 'Use --into <new-file.json>. Existing files are never replaced.', 2);
+    output('dataset_export_review', { id, name: row.name, version: row.version, file: expected }, `${terminalText(row.name)} · Version ${row.version}\n${expected.size.toLocaleString()} bytes. This private device copy will not be erased by cloud retention or withdrawal.`);
+    if (!options.approveDownload) {
+        if (!tty)
+            throw new CliError('dataset_export_consent_required', 'Use --approve-download to save this private dataset on the device.', 2);
+        if (!await selectOne('Save this private dataset?', [{ value: false, label: 'Cancel' }, { value: true, label: 'Export JSON' }], options.signal))
+            return;
+    }
+    const chosen = resolve(into), parent = await realpath(dirname(chosen)), folder = await lstat(parent), destination = join(parent, basename(chosen));
+    if (!folder.isDirectory() || process.platform !== 'win32' && (process.getuid && folder.uid !== process.getuid() || !!(folder.mode & 0o022)))
+        throw new CliError('dataset_export_directory_invalid', 'Choose a directory owned by this OS user without shared write permission.', 2);
+    try {
+        await lstat(destination);
+        throw new CliError('dataset_export_file_exists', 'The chosen file already exists. Choose a new path.', 2);
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
+            throw error;
+    }
+    const partial = join(parent, `.firedrill-dataset-${randomUUID()}.partial`), file = await open(partial, 'wx', 0o600), held = await file.stat();
+    try {
+        await access(async (token) => {
+            const response = await fetch(endpoint(`${prefix}/datasets/${id}/file`), { redirect: 'error', credentials: 'omit',
+                headers: { Authorization: `Bearer ${token}`, 'X-Firedrill-Actor': scope.owner, 'X-Firedrill-Workspace': scope.workspace, 'Accept-Encoding': 'identity' },
+                signal: AbortSignal.any([options.signal, AbortSignal.timeout(120000)]) });
+            if (response.status !== 200) {
+                await response.body?.cancel();
+                throw responseError(null, response.status);
+            }
+            const length = response.headers.get('content-length');
+            if (!response.body || length !== null && length !== String(expected.size) || response.headers.get('x-content-sha256') !== expected.sha256) {
+                await response.body?.cancel();
+                throw new CliError('dataset_export_integrity', 'The response did not match the original dataset file. Nothing was published.');
+            }
+            const reader = response.body.getReader(), digest = createHash('sha256');
+            let size = 0;
+            try {
+                while (true) {
+                    options.signal.throwIfAborted();
+                    const part = await reader.read();
+                    if (part.done)
+                        break;
+                    size += part.value.byteLength;
+                    if (size > expected.size)
+                        throw new CliError('dataset_export_integrity', 'The file exceeded its recorded size. Nothing was published.');
+                    digest.update(part.value);
+                    let offset = 0;
+                    while (offset < part.value.byteLength) {
+                        const written = await file.write(part.value, offset, part.value.byteLength - offset);
+                        if (!written.bytesWritten)
+                            throw new Error();
+                        offset += written.bytesWritten;
+                    }
+                }
+            }
+            finally {
+                await reader.cancel().catch(() => undefined);
+                reader.releaseLock();
+            }
+            if (size !== expected.size || digest.digest('hex') !== expected.sha256)
+                throw new CliError('dataset_export_integrity', 'The dataset was incomplete or changed. Nothing was published.');
+        });
+        const fresh = metadata(await reads.detail(id, { digest: row.request_digest }), id);
+        if (fresh.size !== expected.size || fresh.sha256 !== expected.sha256)
+            throw new CliError('dataset_export_integrity', 'The original dataset changed. Nothing was published.');
+        await file.sync();
+        options.signal.throwIfAborted();
+        const current = await lstat(partial);
+        if (!current.isFile() || current.dev !== held.dev || current.ino !== held.ino || current.size !== expected.size)
+            throw new Error();
+        await link(partial, destination);
+        output('dataset_exported', { id, path: destination, ...expected }, `Dataset exported to ${terminalText(destination)}\n${expected.size.toLocaleString()} bytes · SHA-256 ${expected.sha256}`);
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw new CliError('dataset_export_unconfirmed', 'The export did not finish. Inspect the chosen path before retrying; no existing file was replaced.');
+    }
+    finally {
+        await file.close().catch(() => undefined);
+        const current = await lstat(partial).catch(() => null);
+        if (current?.isFile() && current.dev === held.dev && current.ino === held.ino)
+            await unlink(partial).catch(() => undefined);
+    }
+}

package/dist/cli/src/dataset-reads.js

@@ -0,0 +1,37 @@
+import { api } from './auth.js';
+import { identifier } from './world-contracts.js';
+import { datasetScope, datasetRead, datasetMatches, datasetPageMatches, datasetDocumentMatches } from './dataset-contracts.js';
+export function datasetReads(prefix, owner, signal) {
+    const scope = datasetScope(prefix, owner.owner);
+    if (!scope || scope.workspace !== owner.workspace)
+        throw new Error('Choose a dataset in the current workspace.');
+    const auth = { actor: owner.owner, workspace: owner.workspace, signal };
+    const detail = async (id, selected = {}) => {
+        const value = await api(`${prefix}/datasets/${identifier(id)}`, auth);
+        return datasetRead(value, datasetMatches(value, scope, { ...selected, id }));
+    };
+    return {
+        async page(filters = {}) {
+            const params = new URLSearchParams({ page: String(filters.page ?? 1), q: filters.query ?? '', state: filters.state ?? 'all' });
+            if (filters.source)
+                params.set(scope.kind === 'tool' ? 'checkpoint_id' : 'observation_id', identifier(filters.source));
+            if (filters.implementation && scope.kind === 'tool')
+                params.set('implementation_id', identifier(filters.implementation));
+            if (filters.series)
+                params.set('series_id', identifier(filters.series));
+            if (scope.kind === 'world')
+                params.set('startable', String(filters.startable ?? false));
+            const value = await api(`${prefix}/datasets?${params}`, auth);
+            return datasetRead(value, datasetPageMatches(value, scope, { ...filters, page: filters.page ?? 1 }));
+        },
+        detail,
+        async original(key, selected = {}) {
+            const value = await api(`${prefix}/dataset-requests/${identifier(key)}`, auth);
+            return datasetRead(value, datasetMatches(value, scope, { ...selected, key }));
+        },
+        async document(row) {
+            const value = await api(`${prefix}/datasets/${identifier(row.id)}/document`, { ...auth, maximumResponseBytes: 16 * 1024 ** 2 });
+            return datasetRead(value, datasetDocumentMatches(value, scope, row));
+        },
+    };
+}