@coderook/cli 0.19.0 → 0.21.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -167,11 +167,15 @@ async function reconcile(folder, options = {}) {
       folder that has never been reconciled — or was linked before versions
       were recorded — adopts the newest as its starting point.
     */
-    const known = link?.versionId && link.manifest ? link : null;
-    const behind = known && known.versionId !== latest.id
+    const known = link?.baseVersionId && link.manifest ? link : null;
+    const behind = known && known.baseVersionId !== latest.id
         ? { sequence: latest.sequence, id: latest.id }
         : null;
     if (known) {
+        if (known.observedHeadVersionId !== latest.id) {
+            known.observedHeadVersionId = latest.id;
+            await (0, config_js_1.writeLink)(folder, known);
+        }
         if (behind && !options.quiet) {
             console.log(dim(`The account is on v${behind.sequence}; this folder is based on v${known.sequence}.`));
         }
@@ -196,6 +200,8 @@ async function reconcile(folder, options = {}) {
         slug: project.slug,
         sequence: latest.sequence,
         versionId: latest.id,
+        baseVersionId: latest.id,
+        observedHeadVersionId: latest.id,
         // Adopted whole, so the folder is taken to hold what the version holds.
         local: Object.fromEntries(baseline),
         manifest: Object.fromEntries(baseline),
@@ -479,9 +485,14 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
         result = await uploader.run({
             localPath: folder,
             include: files.map((file) => file.path),
+            deletions: files.filter((file) => file.deleted).map((file) => file.path),
             message,
             projectName: link?.slug ?? node_path_1.default.basename(folder),
             repositoryId: link?.repositoryId ?? null,
+            // Every current CLI publish states its ancestry. A brand-new project
+            // is explicitly based on an empty Track; a linked folder names the
+            // immutable Version it was last reconciled with.
+            baseVersionId: link?.baseVersionId ?? null,
             /*
               The line this save belongs on: named on the command, or whichever one
               the folder is set to. Sent by name rather than resolved here, because
@@ -495,7 +506,9 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
               known version. A folder linked before versions were recorded says
               nothing rather than guessing, and publishes as it always did.
             */
-            ...(link?.versionId ? { expectedHeadVersionId: link.versionId } : {}),
+            ...(link?.baseVersionId
+                ? { expectedHeadVersionId: link.baseVersionId }
+                : {}),
             /*
               What this folder believed the project held. It is how the service
               tells a file this person deleted from one they never had, and
@@ -570,6 +583,8 @@ The connection failed: ${text}`));
         sequence: result.sequence,
         // What this folder is now working from, so the next submit can say so.
         versionId: result.versionId,
+        baseVersionId: result.versionId,
+        observedHeadVersionId: result.versionId,
         local: result.local,
         manifest: result.manifest,
     });
@@ -795,6 +810,8 @@ held, mode = "replace") {
         slug,
         sequence: latest.sequence,
         versionId: latest.id,
+        baseVersionId: latest.id,
+        observedHeadVersionId: latest.id,
         // Fetching writes every file, so the folder now holds what the
         // version holds and the two agree again.
         local: result.manifest,

package/dist/cli/src/config.js

@@ -143,13 +143,23 @@ async function readLinks() {
 }
 async function readLink(localPath) {
     const links = await readLinks();
-    return links[keyFor(localPath)] ?? links[legacyKeyFor(localPath)] ?? null;
+    const link = links[keyFor(localPath)] ?? links[legacyKeyFor(localPath)] ?? null;
+    if (!link)
+        return null;
+    return {
+        ...link,
+        baseVersionId: link.baseVersionId ?? link.versionId,
+    };
 }
 async function writeLink(localPath, link) {
     const links = await readLinks();
     // A folder recorded under the old key moves to the new one rather than
     // being left behind as a second connection to the same place.
     delete links[legacyKeyFor(localPath)];
-    links[keyFor(localPath)] = link;
+    const baseVersionId = link.baseVersionId ?? link.versionId;
+    links[keyFor(localPath)] = {
+        ...link,
+        ...(baseVersionId ? { baseVersionId, versionId: baseVersionId } : {}),
+    };
     await writePrivate(linksFile(), JSON.stringify(links, null, 2));
 }

package/dist/desktop-app/src/main/cbx.js

@@ -3,8 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FOOTER_MAGIC = exports.MANIFEST_MAGIC = exports.CHUNK_MAGIC = exports.HEADER_MAGIC = void 0;
-exports.cutPoints = cutPoints;
+exports.FOOTER_MAGIC = exports.MANIFEST_MAGIC = exports.CHUNK_MAGIC = exports.HEADER_MAGIC = exports.cutPoints = void 0;
 exports.packBundle = packBundle;
 exports.readManifest = readManifest;
 exports.unpackBundle = unpackBundle;
@@ -32,6 +31,9 @@ const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const node_zlib_1 = require("node:zlib");
 const download_js_1 = require("./download.js");
+const chunking_js_1 = require("../shared/chunking.js");
+var chunking_js_2 = require("../shared/chunking.js");
+Object.defineProperty(exports, "cutPoints", { enumerable: true, get: function () { return chunking_js_2.cutPoints; } });
 exports.HEADER_MAGIC = "CBX1";
 exports.CHUNK_MAGIC = "CHNK";
 exports.MANIFEST_MAGIC = "MANF";
@@ -48,9 +50,6 @@ const CODEC_ZSTD = 1;
 const ZSTD_LEVEL = 3;
 const MIN_COMPRESSION_SAVING = 0.02;
 const READ_SIZE = 8 * 1024 * 1024;
-const MIN_CHUNK_SIZE = 2 * 1024 * 1024;
-const AVG_CHUNK_SIZE = 8 * 1024 * 1024;
-const MAX_CHUNK_SIZE = 32 * 1024 * 1024;
 const zstd = (raw) => (0, node_zlib_1.zstdCompressSync)(raw, {
     params: { [node_zlib_1.constants.ZSTD_c_compressionLevel]: ZSTD_LEVEL },
 });
@@ -64,36 +63,6 @@ function sha256(data) {
  * the `fastcdc` package; cut positions do not have to agree between writers
  * for an archive to be readable, because the manifest records the chunk list.
  */
-const GEAR = (() => {
-    const table = new Uint32Array(256);
-    let seed = 0x9e3779b9;
-    for (let index = 0; index < 256; index += 1) {
-        seed = (Math.imul(seed, 1103515245) + 12345) >>> 0;
-        table[index] = seed;
-    }
-    return table;
-})();
-const NORMAL_MASK = 0x0003_5000;
-const SMALL_MASK = 0x0003_5403;
-/** Cut positions inside `buffer`; the tail is left for the next read. */
-function cutPoints(buffer) {
-    const cuts = [];
-    let from = 0;
-    let hash = 0;
-    for (let at = 0; at < buffer.length; at += 1) {
-        hash = ((hash << 1) + GEAR[buffer[at]]) >>> 0;
-        const length = at - from + 1;
-        if (length < MIN_CHUNK_SIZE)
-            continue;
-        const mask = length < AVG_CHUNK_SIZE ? SMALL_MASK : NORMAL_MASK;
-        if (length >= MAX_CHUNK_SIZE || (hash & mask) === 0) {
-            cuts.push(at + 1);
-            from = at + 1;
-            hash = 0;
-        }
-    }
-    return cuts;
-}
 function chunkFrame(raw) {
     const rawDigest = (0, node_crypto_1.createHash)("sha256").update(raw).digest();
     let codec = CODEC_NONE;
@@ -199,7 +168,7 @@ async function packBundle(request, report) {
                 whole.update(block);
                 pending = pending.length ? Buffer.concat([pending, block]) : block;
                 let from = 0;
-                for (const cut of cutPoints(pending)) {
+                for (const cut of (0, chunking_js_1.cutPoints)(pending)) {
                     await emit(pending.subarray(from, cut));
                     from = cut;
                 }
@@ -225,10 +194,7 @@ async function packBundle(request, report) {
             source_kind: request.sourceKind ?? "directory",
             created_unix_ns: Date.now() * 1e6,
             chunking: {
-                algorithm: "gear-streaming",
-                min_size: MIN_CHUNK_SIZE,
-                avg_size: AVG_CHUNK_SIZE,
-                max_size: MAX_CHUNK_SIZE,
+                ...(0, chunking_js_1.manifestChunking)(chunking_js_1.DEFAULT_CHUNK_PROFILE),
                 read_size: READ_SIZE,
                 small_file_packing: { enabled: false },
             },

package/dist/desktop-app/src/main/staging.js

@@ -37,8 +37,39 @@ exports.describePlan = describePlan;
  * session. Naming them here means the plan can be inspected before a byte
  * moves.
  */
-exports.PACKABLE_LIMIT = 64 * 1024;
-exports.CHUNK_THRESHOLD = 16 * 1024 * 1024;
+/*
+  Below this a file travels with others in one request rather than alone.
+
+  Measured rather than guessed, twice. The first number was sixty-four
+  kilobytes, taken from a source folder where ninety-six percent of files were
+  under it. A four and a half gigabyte game then showed the opposite shape:
+  eight hundred files of three hundred kilobytes per section, each just above
+  that line and so each paying its own round trip.
+
+  What the game measured is the reason for the number. Every request costs
+  about six hundred and thirty milliseconds before any bytes move, and the
+  lane carries roughly 0.79 MB/s. So a three hundred kilobyte file spends
+  sixty percent of its time on overhead and a seven megabyte file spends
+  seven. The line belongs where the overhead stops dominating, which is a few
+  megabytes and not a few kilobytes.
+
+  Four megabytes was the first attempt and it overshot. Measured on the same
+  game twice: four hundred kilobyte files went from 1.80 to 3.24 MB/s when
+  batched, while 1.3 megabyte files went from 4.43 down to 3.88 — because
+  three concurrent batches move less than six concurrent requests once a file
+  is large enough that transfer, not overhead, dominates. The crossover is
+  around a megabyte.
+
+  It lives here, and the uploader imports it, because for a while it did not:
+  the uploader had measured its way to a megabyte while this file still said
+  sixty-four kilobytes, and sections were therefore planned by one definition
+  of "small" and then sent by another. Nothing broke, which is why it lasted —
+  the planner simply grouped files it called ordinary and the uploader batched
+  them anyway, and a second filter downstream existed to paper over the
+  disagreement.
+*/
+exports.PACKABLE_LIMIT = 1024 * 1024;
+exports.CHUNK_THRESHOLD = 8 * 1024 * 1024;
 exports.DIRECT_LIMIT = 95 * 1024 * 1024;
 function bandOf(size) {
     if (size <= exports.PACKABLE_LIMIT)

package/dist/desktop-app/src/main/upload.js

@@ -21,7 +21,8 @@ const identify_js_1 = require("./identify.js");
 const worktree_js_1 = require("./worktree.js");
 const publish_name_js_1 = require("./publish_name.js");
 const compress_js_1 = require("./compress.js");
-const cbx_js_1 = require("./cbx.js");
+const chunking_js_1 = require("../shared/chunking.js");
+const publication_js_1 = require("../shared/publication.js");
 const profile_js_1 = require("./profile.js");
 const solid_js_1 = require("./solid.js");
 const retry_js_1 = require("./retry.js");
@@ -34,7 +35,7 @@ const DIRECT_LIMIT = 95 * 1024 * 1024;
   chunker's own average chunk is eight megabytes, so a smaller file would
   usually come out as one chunk anyway.
 */
-const CHUNK_THRESHOLD = 16 * 1024 * 1024;
+const CHUNK_THRESHOLD = 8 * 1024 * 1024;
 /*
   How many files are sent at once. Six is the limit browsers settled on per
   host for the same reason: enough to keep the link busy through the latency
@@ -42,29 +43,12 @@ const CHUNK_THRESHOLD = 16 * 1024 * 1024;
 */
 const UPLOAD_LANES = 6;
 /*
-  Below this a file travels with others in one request rather than alone.
-
-  Measured rather than guessed, twice. The first number came from a source
-  folder where ninety-six percent of files were under sixty-four kilobytes.
-  A four and a half gigabyte game then showed the opposite shape: eight
-  hundred files of three hundred kilobytes per section, each just above that
-  line and so each paying its own round trip.
-
-  What the game measured is the reason for the number. Every request costs
-  about six hundred and thirty milliseconds before any bytes move, and the
-  lane carries roughly 0.79 MB/s. So a three hundred kilobyte file spends
-  sixty percent of its time on overhead and a seven megabyte file spends
-  seven. The line belongs where the overhead stops dominating, which is a few
-  megabytes and not a few kilobytes.
-
-  Four megabytes was the first attempt and it overshot. Measured on the same
-  game twice: four hundred kilobyte files went from 1.80 to 3.24 MB/s when
-  batched, while 1.3 megabyte files went from 4.43 down to 3.88 — because
-  three concurrent batches move less than six concurrent requests once a file
-  is large enough that transfer, not overhead, dominates. The crossover is
-  around a megabyte.
+  What counts as small enough to travel with others, defined once in
+  staging.ts and imported here. The planner groups sections by the same line
+  the sender batches on, which for a while they did not — see the note beside
+  PACKABLE_LIMIT for what that cost.
 */
-const BATCH_FILE_LIMIT = 1024 * 1024;
+const BATCH_FILE_LIMIT = staging_js_1.PACKABLE_LIMIT;
 /** How much one batch may carry, and how many objects it may name. */
 const BATCH_BYTES = 24 * 1024 * 1024;
 const BATCH_COUNT = 256;
@@ -266,12 +250,11 @@ class Uploader {
         if (!ticked.size)
             throw new Error("Nothing is selected to upload");
         const prior = request.repositoryId
-            ? await this.latestVersionFiles(request.repositoryId)
+            ? await this.versionFiles(request.repositoryId, request.baseVersionId)
             : new Map();
         // Ticked files are sent; everything else the project still has keeps the
         // copy already stored, and a file that is new but unticked is left out.
         const sending = everything.filter((file) => ticked.has(file.path));
-        const onDiskNow = new Set(everything.map((file) => file.path));
         /*
           Everything the version already holds is kept, except what this
           workspace deliberately removed.
@@ -282,28 +265,21 @@ class Uploader {
           next save. Reading this from the disk scan alone is what silently lost
           other people's files.
         */
-        const knew = request.known ? new Set(Object.keys(request.known)) : null;
-        const reused = [...prior.entries()]
-            .filter(([path]) => {
-            if (ticked.has(path))
-                return false;
-            if (onDiskNow.has(path))
-                return true;
-            // Missing here. Only a deletion if this workspace ever had it.
-            return knew ? !knew.has(path) : true;
-        })
-            .map(([path, held]) => ({
-            path,
-            sourceSize: held.sourceSize,
-            storedSize: held.storedSize,
-            mediaType: held.mediaType,
-            added: 0,
-            removed: 0,
-            included: true,
-            deleted: false,
-            binary: false,
-            lines: 0,
-        }));
+        const reused = (0, publication_js_1.retainedBasePaths)(prior.keys(), ticked).map((path) => {
+            const held = prior.get(path);
+            return {
+                path,
+                sourceSize: held.sourceSize,
+                storedSize: held.storedSize,
+                mediaType: held.mediaType,
+                added: 0,
+                removed: 0,
+                included: true,
+                deleted: false,
+                binary: false,
+                lines: 0,
+            };
+        });
         /*
           A ticked path that the rescan cannot see is either a deletion or a file
           that has gone since the changes list was drawn. Deletions are meant to
@@ -311,7 +287,8 @@ class Uploader {
           so it is collected and reported rather than quietly skipped.
         */
         const onDisk = new Set(everything.map((file) => file.path));
-        const vanished = [...ticked].filter((chosen) => !onDisk.has(chosen) && !prior.has(chosen));
+        const deletions = new Set(request.deletions ?? []);
+        const vanished = [...ticked].filter((chosen) => !onDisk.has(chosen) && !deletions.has(chosen));
         // 1. Measure and hash. This is what makes an unchanged file free.
         const declarations = [];
         let totalBytes = 0;
@@ -722,8 +699,11 @@ class Uploader {
                       whole: cutting it up would trade one request for several and save
                       nothing.
                     */
-                    if (declaration.size > CHUNK_THRESHOLD && (await this.chunkingAllowed())) {
-                        const pieces = await this.putChunked(repositoryId, declaration, (offset) => {
+                    const chunkProfile = (0, chunking_js_1.profileForFileSize)(declaration.size);
+                    if (chunkProfile &&
+                        declaration.size >= CHUNK_THRESHOLD &&
+                        (await this.chunkingAllowed())) {
+                        const pieces = await this.putChunked(repositoryId, declaration, chunkProfile, (offset) => {
                             inFlight.set(index, offset);
                             report({
                                 stage: "upload",
@@ -889,7 +869,12 @@ class Uploader {
           tool must never have.
         */
         const named = new Set(contents.map((item) => item.path));
-        const dropped = [...new Set([...vanished, ...[...ticked].filter((chosen) => !named.has(chosen))])];
+        const dropped = [
+            ...new Set([
+                ...vanished,
+                ...[...ticked].filter((chosen) => !named.has(chosen) && !deletions.has(chosen)),
+            ]),
+        ];
         if (dropped.length) {
             const shown = dropped.slice(0, 5).join(", ");
             const rest = dropped.length > 5 ? ` and ${dropped.length - 5} more` : "";
@@ -919,6 +904,12 @@ class Uploader {
             contentType: "application/json",
             body: JSON.stringify({
                 message: request.message.trim() || "Saved from the CodeRook desktop app",
+                ...(request.baseVersionId === undefined
+                    ? {}
+                    : {
+                        ancestryMode: "required",
+                        baseVersionId: request.baseVersionId,
+                    }),
                 ...(request.expectedHeadVersionId === undefined
                     ? {}
                     : { expectedHeadVersionId: request.expectedHeadVersionId }),
@@ -968,6 +959,17 @@ class Uploader {
                 })),
             }),
         });
+        /*
+          A clean stale-base save may contain a server-side merge. The candidate
+          manifest built above is then not the Version that landed: it lacks the
+          other publisher's safe changes. Persist the service's accepted snapshot
+          instead. A repeated attempt predates manifest echoing, so read that
+          Version once rather than guessing.
+        */
+        let acceptedManifest = (0, publication_js_1.acceptedManifestDigests)(completed.manifest?.files);
+        if (!completed.mergeTrack && !Object.keys(acceptedManifest).length) {
+            acceptedManifest = Object.fromEntries([...(await this.versionFiles(repositoryId, completed.version.id))].map(([file, descriptor]) => [file, descriptor.sha256]));
+        }
         report({
             stage: "done",
             files: declarations.length,
@@ -984,8 +986,8 @@ class Uploader {
             sequence: completed.version.sequence,
             ...(completed.mergeTrack ? { mergeTrack: completed.mergeTrack } : {}),
             ...(completed.repeated ? { repeated: true } : {}),
-            sourceBytes,
-            storedBytes,
+            sourceBytes: completed.version.sourceSize ?? sourceBytes,
+            storedBytes: completed.version.storedSize ?? storedBytes,
             sentBytes,
             sentFiles: uploaded.length - alreadyOnAccount,
             reusedFiles: reused.length,
@@ -1008,22 +1010,30 @@ class Uploader {
                 const before = request.known?.[file.path] ?? prior.get(file.path)?.sha256;
                 return before ? [[file.path, before]] : [];
             })),
-            manifest: {
-                ...Object.fromEntries(reused.map((file) => [file.path, prior.get(file.path).sha256])),
-                ...Object.fromEntries(declarations.map((declaration) => [declaration.path, declaration.sha256])),
-            },
+            manifest: Object.keys(acceptedManifest).length
+                ? acceptedManifest
+                : {
+                    ...Object.fromEntries(reused.map((file) => [file.path, prior.get(file.path).sha256])),
+                    ...Object.fromEntries(declarations.map((declaration) => [declaration.path, declaration.sha256])),
+                },
         };
     }
     /** What the newest version holds, so unchanged files can point at it. */
-    async latestVersionFiles(repositoryId) {
+    async versionFiles(repositoryId, versionId) {
         const held = new Map();
         try {
-            const versions = await this.call(`/v1/repositories/${repositoryId}/versions`, { method: "GET" });
-            // The API returns them newest first.
-            const latest = (versions.versions ?? [])[0];
-            if (!latest?.id)
+            // Explicit null is a genuinely empty base. Undefined belongs only to
+            // legacy callers, which retain their historical newest-Version lookup.
+            if (versionId === null)
+                return held;
+            let wanted = versionId;
+            if (wanted === undefined) {
+                const versions = await this.call(`/v1/repositories/${repositoryId}/versions`, { method: "GET" });
+                wanted = (versions.versions ?? [])[0]?.id;
+            }
+            if (!wanted)
                 return held;
-            const body = await this.call(`/v1/repositories/${repositoryId}/versions/${latest.id}/files`, {
+            const body = await this.call(`/v1/repositories/${repositoryId}/versions/${wanted}/files`, {
                 method: "GET",
             });
             for (const row of body.files ?? []) {
@@ -1254,7 +1264,7 @@ class Uploader {
      * content-addressed object, which is what makes "the service already has
      * this one" a question the existing protocol can already answer.
      */
-    async putChunked(repositoryId, declaration, onOffset) {
+    async putChunked(repositoryId, declaration, profile, onOffset) {
         /*
           Read in windows, not all at once.
     
@@ -1310,7 +1320,7 @@ class Uploader {
             const incoming = Buffer.from(block);
             pending = pending.length ? Buffer.concat([pending, incoming]) : incoming;
             let from = 0;
-            for (const cut of (0, cbx_js_1.cutPoints)(pending)) {
+            for (const cut of (0, chunking_js_1.cutPoints)(pending, profile)) {
                 await dispatch(Buffer.from(pending.subarray(from, cut)), ordinal++);
                 from = cut;
             }

package/dist/desktop-app/src/shared/chunking.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * CodeRook's portable content-defined chunking contract.
+ *
+ * This file deliberately depends on no Node, Electron or browser APIs. The
+ * CLI, Desktop app and website can therefore cut the same bytes at the same
+ * positions. Storage manifests record the profile id; changing a profile
+ * means adding a new id, never changing the meaning of an existing one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CHUNK_PROFILE = exports.HUGE_CHUNK_PROFILE = exports.LARGE_CHUNK_PROFILE = exports.MEDIUM_CHUNK_PROFILE = exports.LEGACY_CHUNK_PROFILE = void 0;
+exports.profileForFileSize = profileForFileSize;
+exports.cutPoints = cutPoints;
+exports.chunkBoundaries = chunkBoundaries;
+exports.manifestChunking = manifestChunking;
+const KIB = 1024;
+const MIB = 1024 * KIB;
+/*
+ * Kept byte-for-byte for compatibility tests and for diagnosing old bundles.
+ * The seven-bit pre-target mask is why this profile cut shortly after its
+ * minimum instead of averaging eight MiB.
+ */
+exports.LEGACY_CHUNK_PROFILE = Object.freeze({
+    id: "gear-legacy-v1",
+    algorithm: "gear-streaming",
+    minSize: 2 * MIB,
+    targetSize: 8 * MIB,
+    maxSize: 32 * MIB,
+    strictMask: 0x0003_5403,
+    looseMask: 0x0003_5000,
+});
+/*
+ * FastCDC normalisation uses a boundary that is half as likely before the
+ * target and twice as likely afterwards. Contiguous low-bit masks contain
+ * exactly the documented number of bits; the rolling gear hash mixes the
+ * current byte into those bits on every step.
+ */
+exports.MEDIUM_CHUNK_PROFILE = Object.freeze({
+    id: "fastcdc-v2-medium",
+    algorithm: "fastcdc-v2",
+    minSize: 256 * KIB,
+    targetSize: 1 * MIB,
+    maxSize: 4 * MIB,
+    strictMask: 0x001f_ffff,
+    looseMask: 0x0007_ffff,
+});
+exports.LARGE_CHUNK_PROFILE = Object.freeze({
+    id: "fastcdc-v2-large",
+    algorithm: "fastcdc-v2",
+    minSize: 1 * MIB,
+    targetSize: 4 * MIB,
+    maxSize: 16 * MIB,
+    strictMask: 0x007f_ffff,
+    looseMask: 0x001f_ffff,
+});
+exports.HUGE_CHUNK_PROFILE = Object.freeze({
+    id: "fastcdc-v2-huge",
+    algorithm: "fastcdc-v2",
+    minSize: 2 * MIB,
+    targetSize: 8 * MIB,
+    maxSize: 32 * MIB,
+    strictMask: 0x00ff_ffff,
+    looseMask: 0x003f_ffff,
+});
+exports.DEFAULT_CHUNK_PROFILE = exports.HUGE_CHUNK_PROFILE;
+/** The profile repository uploads use for a file of `size` bytes. */
+function profileForFileSize(size) {
+    if (!Number.isFinite(size) || size < 0) {
+        throw new RangeError("File size must be a finite non-negative number");
+    }
+    if (size < 8 * MIB)
+        return null;
+    if (size < 128 * MIB)
+        return exports.MEDIUM_CHUNK_PROFILE;
+    if (size < 2 * 1024 * MIB)
+        return exports.LARGE_CHUNK_PROFILE;
+    return exports.HUGE_CHUNK_PROFILE;
+}
+const GEAR = (() => {
+    const table = new Uint32Array(256);
+    let seed = 0x9e3779b9;
+    for (let index = 0; index < 256; index += 1) {
+        seed = (Math.imul(seed, 1103515245) + 12345) >>> 0;
+        table[index] = seed;
+    }
+    return table;
+})();
+/**
+ * Cut positions inside `bytes`; the final tail is deliberately left to the
+ * streaming caller. Supplying the same bytes and profile on any platform
+ * must always return the same positions.
+ */
+function cutPoints(bytes, profile = exports.DEFAULT_CHUNK_PROFILE) {
+    const cuts = [];
+    let from = 0;
+    let hash = 0;
+    for (let at = 0; at < bytes.length; at += 1) {
+        hash = ((hash << 1) + GEAR[bytes[at]]) >>> 0;
+        const length = at - from + 1;
+        if (length < profile.minSize)
+            continue;
+        const mask = length < profile.targetSize
+            ? profile.strictMask
+            : profile.looseMask;
+        if (length >= profile.maxSize || (hash & mask) === 0) {
+            cuts.push(at + 1);
+            from = at + 1;
+            hash = 0;
+        }
+    }
+    return cuts;
+}
+/** Full piece boundaries, including the final tail. */
+function chunkBoundaries(bytes, profile = exports.DEFAULT_CHUNK_PROFILE) {
+    const bounds = cutPoints(bytes, profile);
+    if (bounds[bounds.length - 1] !== bytes.length)
+        bounds.push(bytes.length);
+    return bounds;
+}
+function manifestChunking(profile) {
+    return {
+        algorithm: profile.algorithm,
+        profile: profile.id,
+        min_size: profile.minSize,
+        avg_size: profile.targetSize,
+        max_size: profile.maxSize,
+    };
+}

package/dist/desktop-app/src/shared/publication.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.retainedBasePaths = retainedBasePaths;
+exports.acceptedManifestDigests = acceptedManifestDigests;
+/**
+ * Paths from the base Version that remain in a candidate snapshot.
+ *
+ * A Version is a complete immutable view, never a list of changed files.
+ * Selected paths are replaced by freshly read declarations, or removed when
+ * explicitly marked as deletions. Everything unselected retains the exact
+ * object, chunk list, or pack slice from the base.
+ */
+function retainedBasePaths(basePaths, selectedPaths) {
+    return [...basePaths]
+        .filter((path) => !selectedPaths.has(path))
+        .sort((left, right) => left.localeCompare(right));
+}
+/** Digest map returned by the accepted server manifest after an auto-merge. */
+function acceptedManifestDigests(files) {
+    return Object.fromEntries([...(files ?? [])].flatMap((file) => file.path && file.sha256 ? [[file.path, file.sha256]] : []));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",