@coderook/cli 0.20.0 → 0.22.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -167,11 +167,15 @@ async function reconcile(folder, options = {}) {
       folder that has never been reconciled — or was linked before versions
       were recorded — adopts the newest as its starting point.
     */
-    const known = link?.versionId && link.manifest ? link : null;
-    const behind = known && known.versionId !== latest.id
+    const known = link?.baseVersionId && link.manifest ? link : null;
+    const behind = known && known.baseVersionId !== latest.id
         ? { sequence: latest.sequence, id: latest.id }
         : null;
     if (known) {
+        if (known.observedHeadVersionId !== latest.id) {
+            known.observedHeadVersionId = latest.id;
+            await (0, config_js_1.writeLink)(folder, known);
+        }
         if (behind && !options.quiet) {
             console.log(dim(`The account is on v${behind.sequence}; this folder is based on v${known.sequence}.`));
         }
@@ -196,6 +200,8 @@ async function reconcile(folder, options = {}) {
         slug: project.slug,
         sequence: latest.sequence,
         versionId: latest.id,
+        baseVersionId: latest.id,
+        observedHeadVersionId: latest.id,
         // Adopted whole, so the folder is taken to hold what the version holds.
         local: Object.fromEntries(baseline),
         manifest: Object.fromEntries(baseline),
@@ -479,9 +485,14 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
         result = await uploader.run({
             localPath: folder,
             include: files.map((file) => file.path),
+            deletions: files.filter((file) => file.deleted).map((file) => file.path),
             message,
             projectName: link?.slug ?? node_path_1.default.basename(folder),
             repositoryId: link?.repositoryId ?? null,
+            // Every current CLI publish states its ancestry. A brand-new project
+            // is explicitly based on an empty Track; a linked folder names the
+            // immutable Version it was last reconciled with.
+            baseVersionId: link?.baseVersionId ?? null,
             /*
               The line this save belongs on: named on the command, or whichever one
               the folder is set to. Sent by name rather than resolved here, because
@@ -495,7 +506,9 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
               known version. A folder linked before versions were recorded says
               nothing rather than guessing, and publishes as it always did.
             */
-            ...(link?.versionId ? { expectedHeadVersionId: link.versionId } : {}),
+            ...(link?.baseVersionId
+                ? { expectedHeadVersionId: link.baseVersionId }
+                : {}),
             /*
               What this folder believed the project held. It is how the service
               tells a file this person deleted from one they never had, and
@@ -570,6 +583,8 @@ The connection failed: ${text}`));
         sequence: result.sequence,
         // What this folder is now working from, so the next submit can say so.
         versionId: result.versionId,
+        baseVersionId: result.versionId,
+        observedHeadVersionId: result.versionId,
         local: result.local,
         manifest: result.manifest,
     });
@@ -795,6 +810,8 @@ held, mode = "replace") {
         slug,
         sequence: latest.sequence,
         versionId: latest.id,
+        baseVersionId: latest.id,
+        observedHeadVersionId: latest.id,
         // Fetching writes every file, so the folder now holds what the
         // version holds and the two agree again.
         local: result.manifest,

package/dist/cli/src/config.js

@@ -143,13 +143,23 @@ async function readLinks() {
 }
 async function readLink(localPath) {
     const links = await readLinks();
-    return links[keyFor(localPath)] ?? links[legacyKeyFor(localPath)] ?? null;
+    const link = links[keyFor(localPath)] ?? links[legacyKeyFor(localPath)] ?? null;
+    if (!link)
+        return null;
+    return {
+        ...link,
+        baseVersionId: link.baseVersionId ?? link.versionId,
+    };
 }
 async function writeLink(localPath, link) {
     const links = await readLinks();
     // A folder recorded under the old key moves to the new one rather than
     // being left behind as a second connection to the same place.
     delete links[legacyKeyFor(localPath)];
-    links[keyFor(localPath)] = link;
+    const baseVersionId = link.baseVersionId ?? link.versionId;
+    links[keyFor(localPath)] = {
+        ...link,
+        ...(baseVersionId ? { baseVersionId, versionId: baseVersionId } : {}),
+    };
     await writePrivate(linksFile(), JSON.stringify(links, null, 2));
 }

package/dist/desktop-app/src/main/cbx.js

@@ -3,8 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FOOTER_MAGIC = exports.MANIFEST_MAGIC = exports.CHUNK_MAGIC = exports.HEADER_MAGIC = void 0;
-exports.cutPoints = cutPoints;
+exports.FOOTER_MAGIC = exports.MANIFEST_MAGIC = exports.CHUNK_MAGIC = exports.HEADER_MAGIC = exports.cutPoints = void 0;
 exports.packBundle = packBundle;
 exports.readManifest = readManifest;
 exports.unpackBundle = unpackBundle;
@@ -32,6 +31,9 @@ const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const node_zlib_1 = require("node:zlib");
 const download_js_1 = require("./download.js");
+const chunking_js_1 = require("../shared/chunking.js");
+var chunking_js_2 = require("../shared/chunking.js");
+Object.defineProperty(exports, "cutPoints", { enumerable: true, get: function () { return chunking_js_2.cutPoints; } });
 exports.HEADER_MAGIC = "CBX1";
 exports.CHUNK_MAGIC = "CHNK";
 exports.MANIFEST_MAGIC = "MANF";
@@ -48,9 +50,6 @@ const CODEC_ZSTD = 1;
 const ZSTD_LEVEL = 3;
 const MIN_COMPRESSION_SAVING = 0.02;
 const READ_SIZE = 8 * 1024 * 1024;
-const MIN_CHUNK_SIZE = 2 * 1024 * 1024;
-const AVG_CHUNK_SIZE = 8 * 1024 * 1024;
-const MAX_CHUNK_SIZE = 32 * 1024 * 1024;
 const zstd = (raw) => (0, node_zlib_1.zstdCompressSync)(raw, {
     params: { [node_zlib_1.constants.ZSTD_c_compressionLevel]: ZSTD_LEVEL },
 });
@@ -64,36 +63,6 @@ function sha256(data) {
  * the `fastcdc` package; cut positions do not have to agree between writers
  * for an archive to be readable, because the manifest records the chunk list.
  */
-const GEAR = (() => {
-    const table = new Uint32Array(256);
-    let seed = 0x9e3779b9;
-    for (let index = 0; index < 256; index += 1) {
-        seed = (Math.imul(seed, 1103515245) + 12345) >>> 0;
-        table[index] = seed;
-    }
-    return table;
-})();
-const NORMAL_MASK = 0x0003_5000;
-const SMALL_MASK = 0x0003_5403;
-/** Cut positions inside `buffer`; the tail is left for the next read. */
-function cutPoints(buffer) {
-    const cuts = [];
-    let from = 0;
-    let hash = 0;
-    for (let at = 0; at < buffer.length; at += 1) {
-        hash = ((hash << 1) + GEAR[buffer[at]]) >>> 0;
-        const length = at - from + 1;
-        if (length < MIN_CHUNK_SIZE)
-            continue;
-        const mask = length < AVG_CHUNK_SIZE ? SMALL_MASK : NORMAL_MASK;
-        if (length >= MAX_CHUNK_SIZE || (hash & mask) === 0) {
-            cuts.push(at + 1);
-            from = at + 1;
-            hash = 0;
-        }
-    }
-    return cuts;
-}
 function chunkFrame(raw) {
     const rawDigest = (0, node_crypto_1.createHash)("sha256").update(raw).digest();
     let codec = CODEC_NONE;
@@ -199,7 +168,7 @@ async function packBundle(request, report) {
                 whole.update(block);
                 pending = pending.length ? Buffer.concat([pending, block]) : block;
                 let from = 0;
-                for (const cut of cutPoints(pending)) {
+                for (const cut of (0, chunking_js_1.cutPoints)(pending)) {
                     await emit(pending.subarray(from, cut));
                     from = cut;
                 }
@@ -225,10 +194,7 @@ async function packBundle(request, report) {
             source_kind: request.sourceKind ?? "directory",
             created_unix_ns: Date.now() * 1e6,
             chunking: {
-                algorithm: "gear-streaming",
-                min_size: MIN_CHUNK_SIZE,
-                avg_size: AVG_CHUNK_SIZE,
-                max_size: MAX_CHUNK_SIZE,
+                ...(0, chunking_js_1.manifestChunking)(chunking_js_1.DEFAULT_CHUNK_PROFILE),
                 read_size: READ_SIZE,
                 small_file_packing: { enabled: false },
             },

package/dist/desktop-app/src/main/staging.js

@@ -69,7 +69,7 @@ exports.describePlan = describePlan;
   disagreement.
 */
 exports.PACKABLE_LIMIT = 1024 * 1024;
-exports.CHUNK_THRESHOLD = 16 * 1024 * 1024;
+exports.CHUNK_THRESHOLD = 8 * 1024 * 1024;
 exports.DIRECT_LIMIT = 95 * 1024 * 1024;
 function bandOf(size) {
     if (size <= exports.PACKABLE_LIMIT)

package/dist/desktop-app/src/main/upload.js

@@ -21,7 +21,8 @@ const identify_js_1 = require("./identify.js");
 const worktree_js_1 = require("./worktree.js");
 const publish_name_js_1 = require("./publish_name.js");
 const compress_js_1 = require("./compress.js");
-const cbx_js_1 = require("./cbx.js");
+const chunking_js_1 = require("../shared/chunking.js");
+const publication_js_1 = require("../shared/publication.js");
 const profile_js_1 = require("./profile.js");
 const solid_js_1 = require("./solid.js");
 const retry_js_1 = require("./retry.js");
@@ -34,7 +35,7 @@ const DIRECT_LIMIT = 95 * 1024 * 1024;
   chunker's own average chunk is eight megabytes, so a smaller file would
   usually come out as one chunk anyway.
 */
-const CHUNK_THRESHOLD = 16 * 1024 * 1024;
+const CHUNK_THRESHOLD = 8 * 1024 * 1024;
 /*
   How many files are sent at once. Six is the limit browsers settled on per
   host for the same reason: enough to keep the link busy through the latency
@@ -249,12 +250,11 @@ class Uploader {
         if (!ticked.size)
             throw new Error("Nothing is selected to upload");
         const prior = request.repositoryId
-            ? await this.latestVersionFiles(request.repositoryId)
+            ? await this.versionFiles(request.repositoryId, request.baseVersionId)
             : new Map();
         // Ticked files are sent; everything else the project still has keeps the
         // copy already stored, and a file that is new but unticked is left out.
         const sending = everything.filter((file) => ticked.has(file.path));
-        const onDiskNow = new Set(everything.map((file) => file.path));
         /*
           Everything the version already holds is kept, except what this
           workspace deliberately removed.
@@ -265,28 +265,21 @@ class Uploader {
           next save. Reading this from the disk scan alone is what silently lost
           other people's files.
         */
-        const knew = request.known ? new Set(Object.keys(request.known)) : null;
-        const reused = [...prior.entries()]
-            .filter(([path]) => {
-            if (ticked.has(path))
-                return false;
-            if (onDiskNow.has(path))
-                return true;
-            // Missing here. Only a deletion if this workspace ever had it.
-            return knew ? !knew.has(path) : true;
-        })
-            .map(([path, held]) => ({
-            path,
-            sourceSize: held.sourceSize,
-            storedSize: held.storedSize,
-            mediaType: held.mediaType,
-            added: 0,
-            removed: 0,
-            included: true,
-            deleted: false,
-            binary: false,
-            lines: 0,
-        }));
+        const reused = (0, publication_js_1.retainedBasePaths)(prior.keys(), ticked).map((path) => {
+            const held = prior.get(path);
+            return {
+                path,
+                sourceSize: held.sourceSize,
+                storedSize: held.storedSize,
+                mediaType: held.mediaType,
+                added: 0,
+                removed: 0,
+                included: true,
+                deleted: false,
+                binary: false,
+                lines: 0,
+            };
+        });
         /*
           A ticked path that the rescan cannot see is either a deletion or a file
           that has gone since the changes list was drawn. Deletions are meant to
@@ -294,7 +287,8 @@ class Uploader {
           so it is collected and reported rather than quietly skipped.
         */
         const onDisk = new Set(everything.map((file) => file.path));
-        const vanished = [...ticked].filter((chosen) => !onDisk.has(chosen) && !prior.has(chosen));
+        const deletions = new Set(request.deletions ?? []);
+        const vanished = [...ticked].filter((chosen) => !onDisk.has(chosen) && !deletions.has(chosen));
         // 1. Measure and hash. This is what makes an unchanged file free.
         const declarations = [];
         let totalBytes = 0;
@@ -705,8 +699,11 @@ class Uploader {
                       whole: cutting it up would trade one request for several and save
                       nothing.
                     */
-                    if (declaration.size > CHUNK_THRESHOLD && (await this.chunkingAllowed())) {
-                        const pieces = await this.putChunked(repositoryId, declaration, (offset) => {
+                    const chunkProfile = (0, chunking_js_1.profileForFileSize)(declaration.size);
+                    if (chunkProfile &&
+                        declaration.size >= CHUNK_THRESHOLD &&
+                        (await this.chunkingAllowed())) {
+                        const pieces = await this.putChunked(repositoryId, declaration, chunkProfile, (offset) => {
                             inFlight.set(index, offset);
                             report({
                                 stage: "upload",
@@ -721,7 +718,14 @@ class Uploader {
                             });
                         });
                         inFlight.delete(index);
-                        alreadyOnAccount += pieces.reused;
+                        /*
+                          A chunk is not a file. Counting every reused piece here made a
+                          one-file save report a negative number of sent files. The selected
+                          file counts as already stored only when every one of its pieces was
+                          reused and no payload crossed the wire.
+                        */
+                        if (pieces.sentBytes === 0)
+                            alreadyOnAccount += 1;
                         uploaded.push({
                             path: declaration.path,
                             sha256: declaration.sha256,
@@ -872,7 +876,12 @@ class Uploader {
           tool must never have.
         */
         const named = new Set(contents.map((item) => item.path));
-        const dropped = [...new Set([...vanished, ...[...ticked].filter((chosen) => !named.has(chosen))])];
+        const dropped = [
+            ...new Set([
+                ...vanished,
+                ...[...ticked].filter((chosen) => !named.has(chosen) && !deletions.has(chosen)),
+            ]),
+        ];
         if (dropped.length) {
             const shown = dropped.slice(0, 5).join(", ");
             const rest = dropped.length > 5 ? ` and ${dropped.length - 5} more` : "";
@@ -902,6 +911,12 @@ class Uploader {
             contentType: "application/json",
             body: JSON.stringify({
                 message: request.message.trim() || "Saved from the CodeRook desktop app",
+                ...(request.baseVersionId === undefined
+                    ? {}
+                    : {
+                        ancestryMode: "required",
+                        baseVersionId: request.baseVersionId,
+                    }),
                 ...(request.expectedHeadVersionId === undefined
                     ? {}
                     : { expectedHeadVersionId: request.expectedHeadVersionId }),
@@ -951,6 +966,17 @@ class Uploader {
                 })),
             }),
         });
+        /*
+          A clean stale-base save may contain a server-side merge. The candidate
+          manifest built above is then not the Version that landed: it lacks the
+          other publisher's safe changes. Persist the service's accepted snapshot
+          instead. A repeated attempt predates manifest echoing, so read that
+          Version once rather than guessing.
+        */
+        let acceptedManifest = (0, publication_js_1.acceptedManifestDigests)(completed.manifest?.files);
+        if (!completed.mergeTrack && !Object.keys(acceptedManifest).length) {
+            acceptedManifest = Object.fromEntries([...(await this.versionFiles(repositoryId, completed.version.id))].map(([file, descriptor]) => [file, descriptor.sha256]));
+        }
         report({
             stage: "done",
             files: declarations.length,
@@ -967,9 +993,9 @@ class Uploader {
             sequence: completed.version.sequence,
             ...(completed.mergeTrack ? { mergeTrack: completed.mergeTrack } : {}),
             ...(completed.repeated ? { repeated: true } : {}),
-            sourceBytes,
-            storedBytes,
-            sentBytes,
+            sourceBytes: completed.version.sourceSize ?? sourceBytes,
+            storedBytes: completed.version.storedSize ?? storedBytes,
+            sentBytes: transferred,
             sentFiles: uploaded.length - alreadyOnAccount,
             reusedFiles: reused.length,
             /** Selected, but the service already held the content. */
@@ -991,22 +1017,30 @@ class Uploader {
                 const before = request.known?.[file.path] ?? prior.get(file.path)?.sha256;
                 return before ? [[file.path, before]] : [];
             })),
-            manifest: {
-                ...Object.fromEntries(reused.map((file) => [file.path, prior.get(file.path).sha256])),
-                ...Object.fromEntries(declarations.map((declaration) => [declaration.path, declaration.sha256])),
-            },
+            manifest: Object.keys(acceptedManifest).length
+                ? acceptedManifest
+                : {
+                    ...Object.fromEntries(reused.map((file) => [file.path, prior.get(file.path).sha256])),
+                    ...Object.fromEntries(declarations.map((declaration) => [declaration.path, declaration.sha256])),
+                },
         };
     }
     /** What the newest version holds, so unchanged files can point at it. */
-    async latestVersionFiles(repositoryId) {
+    async versionFiles(repositoryId, versionId) {
         const held = new Map();
         try {
-            const versions = await this.call(`/v1/repositories/${repositoryId}/versions`, { method: "GET" });
-            // The API returns them newest first.
-            const latest = (versions.versions ?? [])[0];
-            if (!latest?.id)
+            // Explicit null is a genuinely empty base. Undefined belongs only to
+            // legacy callers, which retain their historical newest-Version lookup.
+            if (versionId === null)
+                return held;
+            let wanted = versionId;
+            if (wanted === undefined) {
+                const versions = await this.call(`/v1/repositories/${repositoryId}/versions`, { method: "GET" });
+                wanted = (versions.versions ?? [])[0]?.id;
+            }
+            if (!wanted)
                 return held;
-            const body = await this.call(`/v1/repositories/${repositoryId}/versions/${latest.id}/files`, {
+            const body = await this.call(`/v1/repositories/${repositoryId}/versions/${wanted}/files`, {
                 method: "GET",
             });
             for (const row of body.files ?? []) {
@@ -1237,7 +1271,7 @@ class Uploader {
      * content-addressed object, which is what makes "the service already has
      * this one" a question the existing protocol can already answer.
      */
-    async putChunked(repositoryId, declaration, onOffset) {
+    async putChunked(repositoryId, declaration, profile, onOffset) {
         /*
           Read in windows, not all at once.
     
@@ -1274,8 +1308,8 @@ class Uploader {
         */
         const CHUNK_LANES = 4;
         const active = new Set();
-        const dispatch = async (piece, at) => {
-            const task = this.sendChunk(repositoryId, declaration, piece, chunks, at, note).finally(() => {
+        const dispatch = async (piece, at, digest) => {
+            const task = this.sendChunk(repositoryId, declaration, piece, digest, chunks, at, note).finally(() => {
                 active.delete(task);
                 done += piece.length;
                 onOffset(done);
@@ -1284,6 +1318,51 @@ class Uploader {
             if (active.size >= CHUNK_LANES)
                 await Promise.race(active);
         };
+        /*
+          Ask about a bounded group of chunks before sending any of them.
+    
+          The old path asked once per chunk, with four GETs in flight. Besides
+          spending one network round trip per piece, an unavailable lookup was
+          deliberately treated as a miss, so a transient failure retransmitted
+          every otherwise reusable chunk. The website already uses the bulk
+          endpoint. Reusing it here gives Desktop and CLI the same wire behaviour
+          while retaining the safe "send it if unsure" fallback.
+    
+          A batch is no larger than the existing chunk lane count, so this does
+          not increase the memory ceiling: at most four bounded pieces are held.
+        */
+        const batch = [];
+        const flush = async () => {
+            if (!batch.length)
+                return;
+            const ready = batch.splice(0, batch.length);
+            const held = await this.storedInBulk(repositoryId, ready.map((item) => item.digest));
+            for (const item of ready) {
+                const stored = held.get(item.digest);
+                if (stored) {
+                    note("reused", 0);
+                    chunks[item.at] = {
+                        objectId: stored.objectId,
+                        sourceSize: item.piece.length,
+                        storedSize: stored.size,
+                    };
+                    done += item.piece.length;
+                    onOffset(done);
+                    continue;
+                }
+                await dispatch(item.piece, item.at, item.digest);
+            }
+            await Promise.all(active);
+        };
+        const queue = async (piece) => {
+            batch.push({
+                piece,
+                at: ordinal++,
+                digest: (0, node_crypto_1.createHash)("sha256").update(piece).digest("hex"),
+            });
+            if (batch.length >= CHUNK_LANES)
+                await flush();
+        };
         let ordinal = 0;
         let pending = Buffer.alloc(0);
         for await (const block of (0, node_fs_1.createReadStream)(declaration.full, {
@@ -1293,8 +1372,8 @@ class Uploader {
             const incoming = Buffer.from(block);
             pending = pending.length ? Buffer.concat([pending, incoming]) : incoming;
             let from = 0;
-            for (const cut of (0, cbx_js_1.cutPoints)(pending)) {
-                await dispatch(Buffer.from(pending.subarray(from, cut)), ordinal++);
+            for (const cut of (0, chunking_js_1.cutPoints)(pending, profile)) {
+                await queue(Buffer.from(pending.subarray(from, cut)));
                 from = cut;
             }
             pending = Buffer.from(pending.subarray(from));
@@ -1306,8 +1385,8 @@ class Uploader {
           Dropping it truncates every chunked file by exactly its last piece.
         */
         if (pending.length)
-            await dispatch(pending, ordinal++);
-        await Promise.all(active);
+            await queue(pending);
+        await flush();
         /*
           Order is the file. Every position must be filled: a hole would mean a
           chunk that never landed, and publishing around it would produce a version
@@ -1324,7 +1403,7 @@ class Uploader {
         };
     }
     /** Send one chunk, reusing it if the account already holds those bytes. */
-    async sendChunk(repositoryId, declaration, piece, 
+    async sendChunk(repositoryId, declaration, piece, digest, 
     /*
       Written at a known position rather than appended. The chunks are sent
       several at a time and finish in whatever order the network decides, but
@@ -1335,48 +1414,27 @@ class Uploader {
     chunks, at, note) {
         {
             this.check();
-            const digest = (0, node_crypto_1.createHash)("sha256").update(piece).digest("hex");
-            /*
-              Asked per chunk rather than per file. This is the whole saving: the
-              parts of a large file that did not change answer "already held" and
-              never travel.
-            */
-            const held = await this.findStored(repositoryId, {
-                ...declaration,
-                sha256: digest,
-                size: piece.length,
+            const encoded = await (0, compress_js_1.encodeForUpload)(new Uint8Array(piece), declaration.path, await this.gzipAllowed());
+            const query = encoded.encoding === "gzip"
+                ? `?kind=chunk&role=chunk&encoding=gzip` +
+                    `&logicalSize=${piece.length}` +
+                    `&storedSha256=${encoded.storedSha256}`
+                : `?kind=chunk&role=chunk`;
+            const stored = await this.call(`/v1/repositories/${repositoryId}/objects/${digest}${query}`, {
+                method: "PUT",
+                contentType: "application/octet-stream",
+                body: encoded.body,
+            }).catch((error) => {
+                const reason = error instanceof Error ? error.message : String(error);
+                throw new Error(`${declaration.path}: ${reason}`);
             });
-            if (held) {
-                note("reused", 0);
-                chunks[at] = {
-                    objectId: held.objectId,
-                    sourceSize: piece.length,
-                    storedSize: held.size,
-                };
-            }
-            else {
-                const encoded = await (0, compress_js_1.encodeForUpload)(new Uint8Array(piece), declaration.path, await this.gzipAllowed());
-                const query = encoded.encoding === "gzip"
-                    ? `?kind=chunk&role=chunk&encoding=gzip` +
-                        `&logicalSize=${piece.length}` +
-                        `&storedSha256=${encoded.storedSha256}`
-                    : `?kind=chunk&role=chunk`;
-                const stored = await this.call(`/v1/repositories/${repositoryId}/objects/${digest}${query}`, {
-                    method: "PUT",
-                    contentType: "application/octet-stream",
-                    body: encoded.body,
-                }).catch((error) => {
-                    const reason = error instanceof Error ? error.message : String(error);
-                    throw new Error(`${declaration.path}: ${reason}`);
-                });
-                note("sent", encoded.body.byteLength);
-                chunks[at] = {
-                    objectId: stored.objectId,
-                    sourceSize: piece.length,
-                    /* What the service keeps, which is smaller when the piece gzipped. */
-                    storedSize: stored.storedSize ?? stored.size,
-                };
-            }
+            note("sent", encoded.body.byteLength);
+            chunks[at] = {
+                objectId: stored.objectId,
+                sourceSize: piece.length,
+                /* What the service keeps, which is smaller when the piece gzipped. */
+                storedSize: stored.storedSize ?? stored.size,
+            };
         }
     }
     async putDirect(repositoryId, declaration) {

package/dist/desktop-app/src/shared/chunking.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * CodeRook's portable content-defined chunking contract.
+ *
+ * This file deliberately depends on no Node, Electron or browser APIs. The
+ * CLI, Desktop app and website can therefore cut the same bytes at the same
+ * positions. Storage manifests record the profile id; changing a profile
+ * means adding a new id, never changing the meaning of an existing one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CHUNK_PROFILE = exports.HUGE_CHUNK_PROFILE = exports.LARGE_CHUNK_PROFILE = exports.MEDIUM_CHUNK_PROFILE = exports.LEGACY_CHUNK_PROFILE = void 0;
+exports.profileForFileSize = profileForFileSize;
+exports.cutPoints = cutPoints;
+exports.chunkBoundaries = chunkBoundaries;
+exports.manifestChunking = manifestChunking;
+const KIB = 1024;
+const MIB = 1024 * KIB;
+/*
+ * Kept byte-for-byte for compatibility tests and for diagnosing old bundles.
+ * The seven-bit pre-target mask is why this profile cut shortly after its
+ * minimum instead of averaging eight MiB.
+ */
+exports.LEGACY_CHUNK_PROFILE = Object.freeze({
+    id: "gear-legacy-v1",
+    algorithm: "gear-streaming",
+    minSize: 2 * MIB,
+    targetSize: 8 * MIB,
+    maxSize: 32 * MIB,
+    strictMask: 0x0003_5403,
+    looseMask: 0x0003_5000,
+});
+/*
+ * FastCDC normalisation uses a boundary that is half as likely before the
+ * target and twice as likely afterwards. Contiguous low-bit masks contain
+ * exactly the documented number of bits; the rolling gear hash mixes the
+ * current byte into those bits on every step.
+ */
+exports.MEDIUM_CHUNK_PROFILE = Object.freeze({
+    id: "fastcdc-v2-medium",
+    algorithm: "fastcdc-v2",
+    minSize: 256 * KIB,
+    targetSize: 1 * MIB,
+    maxSize: 4 * MIB,
+    strictMask: 0x001f_ffff,
+    looseMask: 0x0007_ffff,
+});
+exports.LARGE_CHUNK_PROFILE = Object.freeze({
+    id: "fastcdc-v2-large",
+    algorithm: "fastcdc-v2",
+    minSize: 1 * MIB,
+    targetSize: 4 * MIB,
+    maxSize: 16 * MIB,
+    strictMask: 0x007f_ffff,
+    looseMask: 0x001f_ffff,
+});
+exports.HUGE_CHUNK_PROFILE = Object.freeze({
+    id: "fastcdc-v2-huge",
+    algorithm: "fastcdc-v2",
+    minSize: 2 * MIB,
+    targetSize: 8 * MIB,
+    maxSize: 32 * MIB,
+    strictMask: 0x00ff_ffff,
+    looseMask: 0x003f_ffff,
+});
+exports.DEFAULT_CHUNK_PROFILE = exports.HUGE_CHUNK_PROFILE;
+/** The profile repository uploads use for a file of `size` bytes. */
+function profileForFileSize(size) {
+    if (!Number.isFinite(size) || size < 0) {
+        throw new RangeError("File size must be a finite non-negative number");
+    }
+    if (size < 8 * MIB)
+        return null;
+    if (size < 128 * MIB)
+        return exports.MEDIUM_CHUNK_PROFILE;
+    if (size < 2 * 1024 * MIB)
+        return exports.LARGE_CHUNK_PROFILE;
+    return exports.HUGE_CHUNK_PROFILE;
+}
+const GEAR = (() => {
+    const table = new Uint32Array(256);
+    let seed = 0x9e3779b9;
+    for (let index = 0; index < 256; index += 1) {
+        seed = (Math.imul(seed, 1103515245) + 12345) >>> 0;
+        table[index] = seed;
+    }
+    return table;
+})();
+/**
+ * Cut positions inside `bytes`; the final tail is deliberately left to the
+ * streaming caller. Supplying the same bytes and profile on any platform
+ * must always return the same positions.
+ */
+function cutPoints(bytes, profile = exports.DEFAULT_CHUNK_PROFILE) {
+    const cuts = [];
+    let from = 0;
+    let hash = 0;
+    for (let at = 0; at < bytes.length; at += 1) {
+        hash = ((hash << 1) + GEAR[bytes[at]]) >>> 0;
+        const length = at - from + 1;
+        if (length < profile.minSize)
+            continue;
+        const mask = length < profile.targetSize
+            ? profile.strictMask
+            : profile.looseMask;
+        if (length >= profile.maxSize || (hash & mask) === 0) {
+            cuts.push(at + 1);
+            from = at + 1;
+            hash = 0;
+        }
+    }
+    return cuts;
+}
+/** Full piece boundaries, including the final tail. */
+function chunkBoundaries(bytes, profile = exports.DEFAULT_CHUNK_PROFILE) {
+    const bounds = cutPoints(bytes, profile);
+    if (bounds[bounds.length - 1] !== bytes.length)
+        bounds.push(bytes.length);
+    return bounds;
+}
+function manifestChunking(profile) {
+    return {
+        algorithm: profile.algorithm,
+        profile: profile.id,
+        min_size: profile.minSize,
+        avg_size: profile.targetSize,
+        max_size: profile.maxSize,
+    };
+}

package/dist/desktop-app/src/shared/publication.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.retainedBasePaths = retainedBasePaths;
+exports.acceptedManifestDigests = acceptedManifestDigests;
+/**
+ * Paths from the base Version that remain in a candidate snapshot.
+ *
+ * A Version is a complete immutable view, never a list of changed files.
+ * Selected paths are replaced by freshly read declarations, or removed when
+ * explicitly marked as deletions. Everything unselected retains the exact
+ * object, chunk list, or pack slice from the base.
+ */
+function retainedBasePaths(basePaths, selectedPaths) {
+    return [...basePaths]
+        .filter((path) => !selectedPaths.has(path))
+        .sort((left, right) => left.localeCompare(right));
+}
+/** Digest map returned by the accepted server manifest after an auto-merge. */
+function acceptedManifestDigests(files) {
+    return Object.fromEntries([...(files ?? [])].flatMap((file) => file.path && file.sha256 ? [[file.path, file.sha256]] : []));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",