@hraness/sponge 0.3.4 → 0.4.0

package/dist/src/errors.js

@@ -32,6 +32,7 @@ const parents = {
     'no-capture': 'invalid-input',
     'draft-rejected': 'unavailable',
     'model-unavailable': 'unavailable',
+    'model-busy': 'unavailable',
     'parent-missing': 'invalid-input',
     'target-exists': 'invalid-input',
 };
@@ -83,6 +84,7 @@ export const hints = {
 export const detailHints = {
     'draft-rejected': 'The model draft failed the digest checks listed above, even after one repair. Drafting is deterministic, so the same capture and model fail again; refresh the item or use another model.',
     'model-unavailable': 'The model server did not answer or returned an error. Check that it is still running and has free GPU memory (another loaded model can exhaust it), then retry.',
+    'model-busy': 'Another llama-server is running, and two loaded models can exhaust GPU memory. Wait for it to exit, then retry.',
 };
 /** The one error type. `message` is the code, so bare `String(error)` never carries detail, paths or causes. */
 export class SpongeError extends Error {

package/dist/src/importers/custody.d.ts

@@ -1,6 +1,3 @@
-import { supervisedRunner } from '../worker/supervisor.js';
+import { type TransientAttempt } from '../worker/transient.js';
 /** Read-only verification still owns subprocesses, including during an import preview. */
-export declare function withImportVerification<T>(libraryRoot: string, verify: (context: {
-    scratchRoot: string;
-    runProcess: ReturnType<typeof supervisedRunner>;
-}) => Promise<T>): Promise<T>;
+export declare function withImportVerification<T>(libraryRoot: string, verify: (context: Pick<TransientAttempt, 'scratchRoot' | 'runProcess'>) => Promise<T>): Promise<T>;

package/dist/src/importers/custody.js

@@ -1,53 +1,5 @@
-import { randomUUID } from 'node:crypto';
-import { join } from 'node:path';
-import { rm } from 'node:fs/promises';
-import { acquireWorkerCustody, proveAttemptCleanup } from '../worker/custody.js';
-import { directory, writeJournal, readJournal } from '../worker/journal.js';
-import { syncDirectoryAsync } from '../util/fsync.js';
-import { supervisedRunner } from '../worker/supervisor.js';
-import { SpongeError, codeOf } from '../errors.js';
-const pending = () => new SpongeError('cleanup-required');
+import { withTransientAttempt } from '../worker/transient.js';
 /** Read-only verification still owns subprocesses, including during an import preview. */
-export async function withImportVerification(libraryRoot, verify) {
-    const custody = await acquireWorkerCustody(libraryRoot), attemptId = randomUUID();
-    let scratchRoot, unknown = false;
-    try {
-        const attempt = await directory(join(custody.directory, 'attempts', attemptId));
-        await writeJournal(join(attempt, 'import-verification.json'), {
-            schemaVersion: 1,
-            kind: 'import-verification',
-            attemptId,
-            ownerIncarnation: custody.incarnation,
-        });
-        scratchRoot = await directory(join(libraryRoot, 'staging', 'import-verification-' + attemptId));
-        await writeJournal(join(scratchRoot, 'ownership.json'), {
-            schemaVersion: 1,
-            kind: 'import-verification',
-            requestId: attemptId,
-            ownerIncarnation: custody.incarnation,
-        });
-        return await verify({
-            scratchRoot,
-            runProcess: supervisedRunner(custody.directory, custody.incarnation, attemptId),
-        });
-    }
-    catch (error) {
-        unknown = codeOf(error) === 'cleanup-required';
-        throw error;
-    }
-    finally {
-        if (unknown || !(await proveAttemptCleanup(custody.directory, custody.incarnation, attemptId)))
-            throw pending();
-        if (scratchRoot) {
-            const marker = await readJournal(join(scratchRoot, 'ownership.json'));
-            if (marker.schemaVersion !== 1 ||
-                marker.kind !== 'import-verification' ||
-                marker.requestId !== attemptId ||
-                marker.ownerIncarnation !== custody.incarnation)
-                throw pending();
-            await rm(scratchRoot, { recursive: true });
-            await syncDirectoryAsync(join(libraryRoot, 'staging'));
-        }
-        await custody.release();
-    }
+export function withImportVerification(libraryRoot, verify) {
+    return withTransientAttempt(libraryRoot, 'import-verification', ({ scratchRoot, runProcess }) => verify({ scratchRoot, runProcess }));
 }

package/dist/src/models/artifacts.d.ts

@@ -9,6 +9,8 @@ export interface ModelPackage {
     id: string;
     license: string;
     artifacts: readonly ModelArtifact[];
+    /** Per-artifact and per-package byte limit; 2 GiB unless a package that needs more (a local LLM) says so. */
+    maximumBytes?: number;
 }
 export declare function modelSetupPlan(manifest: ModelPackage): {
     id: string;
@@ -28,6 +30,9 @@ export declare function provisionModelPackage(cacheRoot: string, manifest: Model
     signal?: AbortSignal;
     fetch?: typeof fetch;
     reuseOnly?: boolean;
+    /** Local files to adopt by artifact name instead of downloading; cloned or copied, verified, never modified. */
+    adopt?: Readonly<Record<string, string>>;
+    idleMs?: number;
 }): Promise<Record<string, string>>;
 /** The installed package for this manifest, by content, or null when none is. A package installed under an earlier
  * URL-bound fingerprint is adopted once: its verified artifacts are hard-linked into the content-named directory under

package/dist/src/models/artifacts.js

@@ -1,5 +1,5 @@
 import { constants } from 'node:fs';
-import { chmod, lstat, mkdir, open, rename, rm, statfs, link, unlink, readdir, realpath } from 'node:fs/promises';
+import { chmod, copyFile, lstat, mkdir, open, rename, rm, statfs, link, unlink, readdir, realpath, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { processIdentity, identityAlive } from '../worker/identity.js';
@@ -8,9 +8,15 @@ import { acquireIdentityLock } from '../worker/lock.js';
 import { syncDirectoryAsync } from '../util/fsync.js';
 import { privateRoot } from '../acquisition/files.js';
 import { SpongeError, codeOf } from '../errors.js';
-const maximumBytes = 2 * 1024 ** 3;
+const defaultMaximumBytes = 2 * 1024 ** 3, packageCeiling = 64 * 1024 ** 3;
+/** A download fails after this long without a byte, and after its size at 1 MB/s (at least 10 minutes) in all. */
+const idleMs = 120000, downloadDeadline = (bytes) => Math.max(600000, bytes / 1000);
 function validate(manifest) {
-    if (!/^[a-z0-9][a-z0-9.-]{0,127}$/.test(manifest.id) ||
+    const maximumBytes = manifest.maximumBytes ?? defaultMaximumBytes;
+    if (!Number.isSafeInteger(maximumBytes) ||
+        maximumBytes < 1 ||
+        maximumBytes > packageCeiling ||
+        !/^[a-z0-9][a-z0-9.-]{0,127}$/.test(manifest.id) ||
         !manifest.license ||
         manifest.license.length > 256 ||
         !manifest.artifacts.length ||
@@ -125,10 +131,14 @@ async function linksAccounted(root, stat) {
     }
     return count === stat.nlink;
 }
+/** Files this process already hashed, by inode and change time (which user space cannot set back): a worker
+ * re-verifies a 17 GB model by stat after the first time. Any change to the file, its links or its mode misses. */
+const verified = new Map();
+const statKey = (s) => [s.dev, s.ino, s.size, s.mtimeNs, s.ctimeNs, s.nlink, s.mode].join(':');
 async function verifyArtifact(path, artifact, root) {
     const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
-        const before = await file.stat();
+        const before = await file.stat(), key = statKey(await file.stat({ bigint: true }));
         if (!before.isFile() ||
             before.nlink < 1 ||
             (before.nlink !== 1 && !(root && (await linksAccounted(root, before)))) ||
@@ -136,6 +146,9 @@ async function verifyArtifact(path, artifact, root) {
             (before.mode & 0o077) !== 0 ||
             (artifact.executable && (before.mode & 0o100) === 0))
             throw new SpongeError('integrity');
+        if (verified.get(path) === `${key}:${artifact.sha256}`)
+            return;
+        verified.delete(path);
         const hash = createHash('sha256'), buffer = Buffer.alloc(65536);
         let bytes = 0;
         for (;;) {
@@ -153,13 +166,14 @@ async function verifyArtifact(path, artifact, root) {
             before.mtimeMs !== after.mtimeMs ||
             before.nlink !== after.nlink)
             throw new SpongeError('integrity');
+        verified.set(path, `${key}:${artifact.sha256}`);
     }
     finally {
         await file.close();
     }
 }
 /** Write one stream into a fresh staged file while hashing; the caller verifies against the manifest. */
-async function writeStaged(path, artifact, chunks, signal) {
+async function writeStaged(path, artifact, chunks, signal, onChunk) {
     const file = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
     const hash = createHash('sha256');
     let bytes = 0;
@@ -167,6 +181,7 @@ async function writeStaged(path, artifact, chunks, signal) {
         for await (const chunk of chunks) {
             if (signal?.aborted)
                 throw new SpongeError('cancelled');
+            onChunk?.();
             bytes += chunk.length;
             if (bytes > artifact.bytes)
                 throw new SpongeError('integrity');
@@ -410,6 +425,44 @@ export async function recoverModelPackage(cacheRoot, manifest) {
         }
     }
 }
+/** Adopt a local file the user named (a model they already downloaded): an APFS clone when the volume allows, else a
+ * copy, then verified against the manifest. The source is only read; a mismatch fails without downloading. */
+async function adoptArtifact(root, stage, artifact, source, signal) {
+    if (signal?.aborted)
+        throw new SpongeError('cancelled');
+    const target = join(stage, artifact.name);
+    let real;
+    try {
+        real = await realpath(source);
+    }
+    catch {
+        throw new SpongeError('invalid-input');
+    }
+    const s = await lstat(real);
+    if (!s.isFile() || real.startsWith(root + '/'))
+        throw new SpongeError('invalid-input');
+    if (s.size !== artifact.bytes)
+        throw new SpongeError('integrity');
+    try {
+        try {
+            await copyFile(real, target, constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE_FORCE);
+        }
+        catch (error) {
+            if (!['ENOTSUP', 'EXDEV', 'ENOSYS', 'EINVAL'].includes(error.code ?? ''))
+                throw error;
+            const disk = await statfs(root);
+            if (disk.bavail * disk.bsize < artifact.bytes + 512 * 1024 ** 2)
+                throw new SpongeError('limit-exceeded');
+            await copyFile(real, target, constants.COPYFILE_EXCL);
+        }
+        await chmod(target, artifact.executable ? 0o700 : 0o600);
+        await verifyArtifact(target, artifact, root);
+    }
+    catch (error) {
+        await rm(target, { force: true });
+        throw error;
+    }
+}
 /** Explicit setup only. Never called by install hooks or by inference fallback, except `reuseOnly`: that adopts an
  * installed package from verified local artifacts under the same setup lock and never reaches the network. */
 export async function provisionModelPackage(cacheRoot, manifest, options = {}) {
@@ -461,7 +514,7 @@ export async function provisionModelPackage(cacheRoot, manifest, options = {}) {
         // Reusable artifacts need no download space; a copy fallback rechecks space for itself.
         let needed = 512 * 1024 ** 2;
         for (const artifact of manifest.artifacts)
-            if (!(await reuseCandidates(root, artifact, plan.fingerprint)).length)
+            if (!options.adopt?.[artifact.name] && !(await reuseCandidates(root, artifact, plan.fingerprint)).length)
                 needed += artifact.bytes;
         const disk = await statfs(root);
         if (disk.bavail * disk.bsize < needed)
@@ -475,20 +528,42 @@ export async function provisionModelPackage(cacheRoot, manifest, options = {}) {
         for (const artifact of manifest.artifacts) {
             if (await reuseArtifact(root, stage, artifact, plan.fingerprint, options.signal))
                 continue;
+            const local = options.adopt?.[artifact.name];
+            if (local) {
+                await adoptArtifact(root, stage, artifact, local, options.signal);
+                continue;
+            }
             if (options.reuseOnly)
                 throw new SpongeError('unavailable');
-            const signal = options.signal
-                ? AbortSignal.any([options.signal, AbortSignal.timeout(600000)])
-                : AbortSignal.timeout(600000);
-            const response = await (options.fetch ?? fetch)(artifact.url, { signal });
-            if (!response.ok || !response.body || (response.url && new URL(response.url).protocol !== 'https:'))
-                throw new SpongeError('unavailable');
-            const declared = response.headers.get('content-length');
-            if (declared !== null && Number(declared) !== artifact.bytes) {
-                await response.body.cancel();
-                throw new SpongeError('integrity');
+            const idle = new AbortController(), wait = options.idleMs ?? idleMs;
+            let timer = setTimeout(() => idle.abort(), wait);
+            const signal = AbortSignal.any([
+                idle.signal,
+                AbortSignal.timeout(downloadDeadline(artifact.bytes)),
+                ...(options.signal ? [options.signal] : []),
+            ]);
+            try {
+                const response = await (options.fetch ?? fetch)(artifact.url, { signal });
+                if (!response.ok || !response.body || (response.url && new URL(response.url).protocol !== 'https:'))
+                    throw new SpongeError('unavailable');
+                const declared = response.headers.get('content-length');
+                if (declared !== null && Number(declared) !== artifact.bytes) {
+                    await response.body.cancel();
+                    throw new SpongeError('integrity');
+                }
+                await writeStaged(join(stage, artifact.name), artifact, response.body, signal, () => {
+                    clearTimeout(timer);
+                    timer = setTimeout(() => idle.abort(), wait);
+                });
+            }
+            catch (error) {
+                if (idle.signal.aborted && !options.signal?.aborted)
+                    throw new SpongeError('limit-exceeded', { cause: error });
+                throw error;
+            }
+            finally {
+                clearTimeout(timer);
             }
-            await writeStaged(join(stage, artifact.name), artifact, response.body, signal);
         }
         if (options.signal?.aborted)
             throw new SpongeError('cancelled');

package/dist/src/models/digest.d.ts

@@ -0,0 +1,64 @@
+import { type ModelPackage } from './artifacts.js';
+/**
+ * The local digest runtime: upstream llama.cpp's macOS arm64 release build and one pinned GGUF, installed together as
+ * one model package (one fingerprint per model, so the shared archive hard-links across them). Pins live in source,
+ * not the per-release native catalog: they are third-party bytes that do not change with Sponge releases.
+ */
+export interface DigestModelPin {
+    readonly alias: string;
+    readonly file: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly repo: string;
+    readonly revision: string;
+    readonly base: string;
+    /** The smallest physical memory this model is chosen for by default. */
+    readonly minimumMemoryBytes: number;
+}
+/** llama.cpp b11669 (0.7.0, commit 620d2225c): self-contained, `@loader_path` dylibs, ad hoc signed. */
+export declare const llamaRuntimePin: {
+    readonly name: "llama-b11669-bin-macos-arm64.tar.gz";
+    readonly url: "https://github.com/ggml-org/llama.cpp/releases/download/b11669/llama-b11669-bin-macos-arm64.tar.gz";
+    readonly bytes: 12191582;
+    readonly sha256: "dbed55493d72bc1ba2babc8770d669c2289b5bc4ee9fb2a4dfc158d45b7d13fd";
+    readonly directory: "llama-b11669";
+    readonly build: 11669;
+    readonly commit: "620d2225c";
+};
+/**
+ * Gemma 4 26B-A4B (Apache 2.0) at Unsloth's dynamic Q4_K_M is the default: on the 40-item Jungle eval it matched the
+ * 9B's idea coverage with no failures, a tenth of its copied details and about 60% of its time per item (see
+ * src/digest/README.md). Qwen3.5-9B is the pin for machines with 16-32 GiB.
+ */
+export declare const digestModels: readonly DigestModelPin[];
+export declare const modelUrl: (m: Pick<DigestModelPin, "repo" | "revision" | "file">) => string;
+/** An explicit alias, or the largest pin this machine's memory allows; `unsupported` below every pin. */
+export declare function digestModel(alias?: string, memory?: number): DigestModelPin;
+export declare function digestModelPackage(pin: DigestModelPin): ModelPackage;
+/** Every pin's fingerprint, so runtime GC keeps any installed digest package. */
+export declare const digestFingerprints: () => string[];
+export interface DigestRuntime {
+    /** The verified llama.cpp release archive; extracted per run into owned scratch space. */
+    archive: string;
+    model: string;
+    pin: DigestModelPin;
+}
+export declare function digestSetupPlan(pin: DigestModelPin): {
+    id: string;
+    license: string;
+    fingerprint: string;
+    downloadBytes: number;
+    requiredFreeBytes: number;
+    artifacts: readonly import("./artifacts.js").ModelArtifact[];
+    model: string;
+    memoryBytes: number;
+    supported: boolean;
+};
+/** Explicit setup: download (or adopt `modelFile`, a copy of the pinned GGUF the user already has) and verify. */
+export declare function provisionDigest(cacheRoot: string, pin: DigestModelPin, options?: {
+    signal?: AbortSignal;
+    modelFile?: string;
+    fetch?: typeof fetch;
+}): Promise<DigestRuntime>;
+/** The installed runtime for `alias`, or for this machine's default pin, else the first installed pin. */
+export declare function inspectDigest(cacheRoot: string, alias?: string): Promise<DigestRuntime>;

package/dist/src/models/digest.js

@@ -0,0 +1,122 @@
+import { totalmem } from 'node:os';
+import { mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { privateRoot } from '../acquisition/files.js';
+import { inspectInstalledModelPackage, modelSetupPlan, provisionModelPackage, recoverModelPackage, } from './artifacts.js';
+import { nativePlatformSupported } from './catalog.js';
+import { SpongeError } from '../errors.js';
+const GiB = 1024 ** 3;
+/** llama.cpp b11669 (0.7.0, commit 620d2225c): self-contained, `@loader_path` dylibs, ad hoc signed. */
+export const llamaRuntimePin = {
+    name: 'llama-b11669-bin-macos-arm64.tar.gz',
+    url: 'https://github.com/ggml-org/llama.cpp/releases/download/b11669/llama-b11669-bin-macos-arm64.tar.gz',
+    bytes: 12_191_582,
+    sha256: 'dbed55493d72bc1ba2babc8770d669c2289b5bc4ee9fb2a4dfc158d45b7d13fd',
+    directory: 'llama-b11669',
+    build: 11669,
+    commit: '620d2225c',
+};
+/**
+ * Gemma 4 26B-A4B (Apache 2.0) at Unsloth's dynamic Q4_K_M is the default: on the 40-item Jungle eval it matched the
+ * 9B's idea coverage with no failures, a tenth of its copied details and about 60% of its time per item (see
+ * src/digest/README.md). Qwen3.5-9B is the pin for machines with 16-32 GiB.
+ */
+export const digestModels = [
+    {
+        alias: 'gemma-4-26b-a4b',
+        file: 'gemma-4-26B-A4B-it-UD-Q4_K_M.gguf',
+        bytes: 16_947_541_728,
+        sha256: 'f2c28b3dc4776931ac6f879e11f203dec637ea0f14267a86ec8f6165f63f293f',
+        repo: 'unsloth/gemma-4-26B-A4B-it-GGUF',
+        revision: 'c099eb48e663fd284577b04978a94ffccb261841',
+        base: 'google/gemma-4-26B-A4B-it',
+        minimumMemoryBytes: 32 * GiB,
+    },
+    {
+        alias: 'qwen3.5-9b',
+        file: 'Qwen3.5-9B-Q4_K_M.gguf',
+        bytes: 5_627_044_256,
+        sha256: 'cd76ec205963b3b33350093e6904d9de16c4e666fd104e1f632d25c7f15f2a13',
+        repo: 'lmstudio-community/Qwen3.5-9B-GGUF',
+        revision: '1379f25c6b505a3fc737bd7818cb09389cf807c1',
+        base: 'Qwen/Qwen3.5-9B',
+        minimumMemoryBytes: 16 * GiB,
+    },
+];
+export const modelUrl = (m) => `https://huggingface.co/${m.repo}/resolve/${m.revision}/${m.file}`;
+/** An explicit alias, or the largest pin this machine's memory allows; `unsupported` below every pin. */
+export function digestModel(alias, memory = totalmem()) {
+    if (alias !== undefined) {
+        const pin = digestModels.find((m) => m.alias === alias);
+        if (!pin)
+            throw new SpongeError('invalid-input');
+        return pin;
+    }
+    const pin = digestModels.find((m) => memory >= m.minimumMemoryBytes);
+    if (!pin)
+        throw new SpongeError('unsupported');
+    return pin;
+}
+export function digestModelPackage(pin) {
+    return {
+        id: `sponge-digest-b${llamaRuntimePin.build}-${pin.alias}`,
+        license: 'llama.cpp: MIT; model: see its repository license (Gemma 4 and Qwen3.5 are Apache-2.0)',
+        maximumBytes: 20 * GiB,
+        artifacts: [
+            {
+                name: llamaRuntimePin.name,
+                url: llamaRuntimePin.url,
+                sha256: llamaRuntimePin.sha256,
+                bytes: llamaRuntimePin.bytes,
+            },
+            { name: pin.file, url: modelUrl(pin), sha256: pin.sha256, bytes: pin.bytes },
+        ],
+    };
+}
+/** Every pin's fingerprint, so runtime GC keeps any installed digest package. */
+export const digestFingerprints = () => digestModels.map((pin) => modelSetupPlan(digestModelPackage(pin)).fingerprint);
+export function digestSetupPlan(pin) {
+    return {
+        model: pin.alias,
+        memoryBytes: totalmem(),
+        supported: nativePlatformSupported(),
+        ...modelSetupPlan(digestModelPackage(pin)),
+    };
+}
+/** Explicit setup: download (or adopt `modelFile`, a copy of the pinned GGUF the user already has) and verify. */
+export async function provisionDigest(cacheRoot, pin, options = {}) {
+    if (!nativePlatformSupported())
+        throw new SpongeError('unsupported');
+    const manifest = digestModelPackage(pin);
+    await privateRoot(dirname(cacheRoot));
+    await mkdir(cacheRoot, { recursive: true, mode: 0o700 });
+    await privateRoot(cacheRoot);
+    await recoverModelPackage(cacheRoot, manifest);
+    const paths = await provisionModelPackage(cacheRoot, manifest, {
+        signal: options.signal,
+        fetch: options.fetch,
+        ...(options.modelFile ? { adopt: { [pin.file]: options.modelFile } } : {}),
+    });
+    return { archive: paths[llamaRuntimePin.name], model: paths[pin.file], pin };
+}
+/** The installed runtime for `alias`, or for this machine's default pin, else the first installed pin. */
+export async function inspectDigest(cacheRoot, alias) {
+    if (!nativePlatformSupported())
+        throw new SpongeError('unsupported');
+    let preferred;
+    try {
+        preferred = digestModel(alias);
+    }
+    catch (error) {
+        if (alias !== undefined)
+            throw error;
+    }
+    for (const pin of preferred
+        ? [preferred, ...(alias ? [] : digestModels.filter((m) => m !== preferred))]
+        : digestModels) {
+        const paths = await inspectInstalledModelPackage(cacheRoot, digestModelPackage(pin));
+        if (paths)
+            return { archive: paths[llamaRuntimePin.name], model: paths[pin.file], pin };
+    }
+    throw new SpongeError('runtime-missing');
+}

package/dist/src/portability/database.js

@@ -96,6 +96,8 @@ export function neutralizeRestoredDatabase(path) {
             db.exec("UPDATE index_jobs SET state='failed',reason='restore-reconciliation-required' WHERE state NOT IN ('succeeded','failed','cancelled')");
             db.prepare("UPDATE index_attempts SET stage='restored-unexecuted',cleanup='settled',finished_at=COALESCE(finished_at,?) WHERE cleanup='pending' OR finished_at IS NULL").run(new Date().toISOString());
         }
+        if (inspected.schemaVersion >= 11)
+            db.exec("UPDATE digest_jobs SET state='queued',owner_incarnation=NULL,fence=NULL WHERE state='running'; UPDATE digest_jobs SET state='cancelled' WHERE state='queued' AND cancel_requested=1");
         // A restored copy is a new device of the same library: a fresh device id keeps its HLCs distinct; clock_ms only moves forward.
         if (inspected.schemaVersion >= 5)
             db.exec('UPDATE device SET device_id=lower(hex(randomblob(16))) WHERE id=1');

package/dist/src/search/query.js

@@ -1,66 +1,19 @@
-import { randomUUID } from 'node:crypto';
-import { join } from 'node:path';
-import { rm } from 'node:fs/promises';
-import { acquireWorkerCustody, proveAttemptCleanup } from '../worker/custody.js';
-import { directory, writeJournal, readJournal } from '../worker/journal.js';
-import { syncDirectoryAsync } from '../util/fsync.js';
-import { supervisedRunner } from '../worker/supervisor.js';
+import { withTransientAttempt } from '../worker/transient.js';
 import { embedBatch, embeddingFingerprint, embeddingTextBytes, resolveIndexSpace, projectVector, encodeEmbeddingRequest, } from '../inference/embedding/index.js';
-import { SpongeError, codeOf } from '../errors.js';
+import { SpongeError } from '../errors.js';
 /** One custody-held helper run. Mutates coordination journals only, never library content or job tables. */
-async function custodyEmbed(store, runtime, inputs, signal, options) {
-    const custody = await acquireWorkerCustody(store.root), attemptId = randomUUID();
-    let scratchRoot, cleanupUnknown = false;
-    try {
-        const attempts = await directory(join(custody.directory, 'attempts', attemptId));
-        await writeJournal(join(attempts, 'query.json'), {
-            schemaVersion: 1,
-            kind: 'query',
-            attemptId,
-            ownerIncarnation: custody.incarnation,
-        });
-        scratchRoot = await directory(join(store.root, 'staging', 'query-' + attemptId));
-        await writeJournal(join(scratchRoot, 'ownership.json'), {
-            schemaVersion: 1,
-            kind: 'query',
-            requestId: attemptId,
-            ownerIncarnation: custody.incarnation,
-        });
-        await options.onReady?.({ attemptId, ownerDirectory: custody.directory, scratchRoot });
+function custodyEmbed(store, runtime, inputs, signal, options) {
+    return withTransientAttempt(store.root, 'query', async ({ attemptId, ownerDirectory, scratchRoot, runProcess }) => {
+        await options.onReady?.({ attemptId, ownerDirectory, scratchRoot });
         const expected = encodeEmbeddingRequest(inputs).inputHashes;
-        const result = await (options.embed ?? embedBatch)(inputs, {
-            runtime,
-            scratchRoot,
-            signal,
-            runProcess: supervisedRunner(custody.directory, custody.incarnation, attemptId),
-        });
+        const result = await (options.embed ?? embedBatch)(inputs, { runtime, scratchRoot, signal, runProcess });
         if (result.fingerprint !== embeddingFingerprint(runtime.helperSha256) ||
             result.inputHashes.length !== expected.length ||
             result.inputHashes.some((h, i) => h !== expected[i]) ||
             result.vectors.length !== expected.length)
             throw new SpongeError('integrity');
         return result.vectors;
-    }
-    catch (error) {
-        cleanupUnknown = codeOf(error) === 'cleanup-required';
-        throw error;
-    }
-    finally {
-        const proved = !cleanupUnknown && (await proveAttemptCleanup(custody.directory, custody.incarnation, attemptId));
-        if (!proved)
-            throw new SpongeError('cleanup-required');
-        if (scratchRoot) {
-            const marker = await readJournal(join(scratchRoot, 'ownership.json'));
-            if (marker.schemaVersion !== 1 ||
-                marker.kind !== 'query' ||
-                marker.requestId !== attemptId ||
-                marker.ownerIncarnation !== custody.incarnation)
-                throw new SpongeError('cleanup-required');
-            await rm(scratchRoot, { recursive: true });
-            await syncDirectoryAsync(join(store.root, 'staging'));
-        }
-        await custody.release();
-    }
+    });
 }
 /** Queries mutate coordination journals only, never library content or job tables. */
 export function createQueryEmbedder(store, runtime, options = {}) {

package/dist/src/store/digest-jobs.d.ts

@@ -0,0 +1,55 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { type Context } from './context.js';
+import type { JobKind } from './queue.js';
+import type { OwnerToken } from './types.js';
+export interface DigestSettings {
+    auto: boolean;
+    /** The model alias `sponge setup --digest` installed, or null for the memory-based default. */
+    model: string | null;
+}
+export interface DigestClaim extends OwnerToken {
+    jobId: string;
+    itemId: string;
+    revisionId: string;
+}
+export type DigestOutcome = {
+    derivationId: string;
+} | {
+    reason: string;
+    retryable?: boolean;
+    notBefore?: string;
+    countAttempt?: boolean;
+};
+/** Queue a digest of a newly captured revision when auto-digest is on. Runs inside the capture commit's transaction. */
+export declare function enqueueDigest(db: DatabaseSync, itemId: string, revisionId: string): void;
+/**
+ * Digest jobs under the shared worker lease. A job names one revision; when its item moves on or is deleted before the
+ * worker reaches it, the job is cancelled as `superseded`, since the newer revision has a job of its own. The drafting
+ * server's process custody is the worker's filesystem journal (`withDigestServer`), so the database holds no attempt
+ * rows or staging, and owner recovery returns a crashed owner's running job to the queue.
+ */
+export declare class DigestJobs {
+    private readonly c;
+    readonly jobs: JobKind;
+    constructor(c: Context);
+    settings(): DigestSettings;
+    /** Turn auto-digest on or off. Turning it on queues nothing already captured; turning it off leaves queued jobs. */
+    configure(settings: Partial<DigestSettings>): DigestSettings;
+    /** Whether a job is ready for `claim` now. */
+    due(): boolean;
+    /**
+     * Delay every ready job to `notBefore` with `reason`, without counting an attempt: the drafting runtime is missing or
+     * could not start, so no job reached the model. Running jobs are untouched. Returns how many were delayed.
+     */
+    postpone(reason: string, notBefore: string): number;
+    /** The oldest ready job whose revision is still its item's current one; jobs passed over on the way are superseded. */
+    claim(owner: OwnerToken): DigestClaim | null;
+    /**
+     * Settle a claimed job. A retryable failure under the attempt limit is delayed until `notBefore` (default: a backoff
+     * from the attempt count); `countAttempt: false` gives the attempt back, for a refusal that never reached the model.
+     */
+    finish(claim: DigestClaim, outcome: DigestOutcome): void;
+    /** Whether the user asked to cancel the claimed job while it ran. */
+    cancelRequested(claim: DigestClaim): boolean;
+    private row;
+}