@chaos-overlords/worker 0.7.1 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaos-overlords/worker",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "Cloudflare Workers runtime facade: the shared Hono app over D1, with one Durable Object per match for SSE fan-out and turn-deadline alarms.",
   "keywords": [
     "chaos-overlords",
@@ -47,17 +47,17 @@
     "provenance": true
   },
   "dependencies": {
-    "@chaos-overlords/bug-reports": "0.7.1",
-    "@chaos-overlords/contracts": "0.7.1",
-    "@chaos-overlords/kernel": "0.7.1",
-    "@chaos-overlords/server": "0.7.1",
-    "@chaos-overlords/storage": "0.7.1",
+    "@chaos-overlords/bug-reports": "0.8.0",
+    "@chaos-overlords/contracts": "0.8.0",
+    "@chaos-overlords/kernel": "0.8.0",
+    "@chaos-overlords/server": "0.8.0",
+    "@chaos-overlords/storage": "0.8.0",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.13.7"
   },
   "devDependencies": {
-    "@chaos-overlords/client": "0.7.1",
-    "@chaos-overlords/conformance": "0.7.1",
+    "@chaos-overlords/client": "0.8.0",
+    "@chaos-overlords/conformance": "0.8.0",
     "@cloudflare/vitest-pool-workers": "^0.22.0",
     "@cloudflare/workers-types": "^5.20260910.1",
     "typescript": "^5.9.3",

package/src/MatchHub.ts

@@ -57,7 +57,10 @@ export class MatchHub {
           // reach. A bare status crosses back instead and the Worker rethrows it as the domain
           // error, so the envelope still has exactly one producer.
           if (!isDomainError(error)) throw error
-          return new Response(null, { status: 429, headers: { 'X-Stream-Refusal': error.code } })
+          return new Response(null, {
+            status: 429,
+            headers: { 'X-Stream-Refusal': String(error.details?.scope ?? 'match') },
+          })
         }
       }
       case HUB_PATHS.disconnect: {
@@ -89,5 +92,28 @@ export class MatchHub {
     })
     const sealed = await kernel.turns.trySeal(pending.matchId, pending.turn, 'deadline')
     workerLogger.info('deadline alarm handled', { ...pending, sealed })
+    await this.forgetSpentDeadline(pending)
+  }
+
+  /**
+   * Drop the pending deadline once nothing is left to fire for. A seal on readiness, a finished
+   * match and a match retention deleted all leave the alarm armed for a turn that is no longer
+   * open; each such alarm builds a kernel and reads the match for nothing, and the key kept every
+   * timed match's object in storage forever. A seal that just ran has already replaced the key
+   * with the next turn's deadline, which is why the key is re-read rather than deleted outright.
+   */
+  private async forgetSpentDeadline(fired: PendingDeadline): Promise<void> {
+    const current = await this.state.storage.get<PendingDeadline>(DEADLINE_KEY)
+    if (!current || current.matchId !== fired.matchId || current.turn !== fired.turn) return
+    const storage = createSqliteStorage(drizzle(this.env.DB, { schema: sqliteSchema }))
+    const [match, turn] = await Promise.all([
+      storage.matches.get(fired.matchId),
+      storage.turns.get(fired.matchId, fired.turn),
+    ])
+    const stillDue =
+      match?.status === 'running' && turn?.status === 'open' && turn.deadlineAt !== null
+    if (stillDue) return
+    await this.state.storage.delete(DEADLINE_KEY)
+    await this.state.storage.deleteAlarm()
   }
 }

package/src/env.ts

@@ -21,6 +21,7 @@ export interface Env {
    * `BUG_REPORT_LIMITS.inlineStateBytes` are kept.
    */
   BUG_BLOBS?: R2Bucket
+  /** `"false"` stops serving `GET /api/v1/matches`; anything else (unset included) serves it. */
   PUBLIC_LISTING?: string
   RATE_LIMIT_PER_MINUTE?: string
   MEMBER_RATE_LIMIT_PER_MINUTE?: string

package/src/index.ts

@@ -65,9 +65,13 @@ export function buildContainer(env: Env): ServerContainer {
         // The object refuses an over-cap stream with a bare 429; turning it back into the domain
         // error here is what gets the caller the same envelope every other refusal has.
         if (response.status === 429) {
-          throw new RateLimitedError('This match is holding as many event streams as it can', {
-            reason: 'too_many_streams',
-          })
+          const scope = response.headers.get('X-Stream-Refusal') === 'process' ? 'process' : 'match'
+          throw new RateLimitedError(
+            scope === 'process'
+              ? 'This server is holding as many event streams as it can'
+              : 'This match is holding as many event streams as it can',
+            { reason: 'too_many_streams', scope },
+          )
         }
         return new Response(response.body as ReadableStream<Uint8Array> | null, {
           status: response.status,
@@ -84,7 +88,9 @@ export function buildContainer(env: Env): ServerContainer {
         DEFAULT_RATE_LIMITS.bugReportPerMinute,
       ),
     },
-    config: { ...DEFAULT_SERVER_CONFIG, publicListing: env.PUBLIC_LISTING === 'true' },
+    // Listing is on unless a deployment turns it off: an unset var means the Browse screen works,
+    // rather than every client being told the server lists nothing.
+    config: { ...DEFAULT_SERVER_CONFIG, publicListing: env.PUBLIC_LISTING !== 'false' },
     // `CF-Connecting-IP` is authoritative here and only here: Cloudflare sets it on every request
     // that reaches a Worker and a client cannot forge it through the edge. Off Cloudflare it is a
     // header anyone can write, which is why the default resolver ignores it unless told otherwise.