@inkandswitch/patchwork-bootloader 0.3.0 → 0.3.1

package/dist/site.d.ts

@@ -11,7 +11,7 @@
  * site's `main.ts`. Non-UI consumers should import the package default (which
  * only does SW registration and the automerge-worker handoff).
  */
-import { type DocHandle, Repo, type AutomergeUrl, type StorageId } from "@automerge/vanillajs/slim";
+import { type DocHandle, Repo, type AutomergeUrl } from "@automerge/vanillajs/slim";
 import { type AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
 import { type AccountDoc } from "@inkandswitch/patchwork-plugins";
@@ -82,11 +82,6 @@ export interface SiteConfig {
      * Defaults to `"root"`.
      */
     rootElementId?: string;
-    /**
-     * Storage IDs to subscribe to for remote-heads gossiping. Defaults to
-     * Ink & Switch's production Subduction storage.
-     */
-    remoteStorageIds?: StorageId[];
     /**
      * When true, initialize keyhive for access control.
      * The Repo will use keyhive's network adapter, peerId, and idFactory

package/dist/site.js

@@ -11,7 +11,8 @@
  * site's `main.ts`. Non-UI consumers should import the package default (which
  * only does SW registration and the automerge-worker handoff).
  */
-import { IndexedDBStorageAdapter, initializeWasm, isValidAutomergeUrl, isValidDocumentId, MessageChannelNetworkAdapter, parseAutomergeUrl, Repo, stringifyAutomergeUrl, } from "@automerge/vanillajs/slim";
+import { initializeWasm, isValidAutomergeUrl, isValidDocumentId, MessageChannelNetworkAdapter, parseAutomergeUrl, Repo, stringifyAutomergeUrl, } from "@automerge/vanillajs/slim";
+import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
 import * as Automerge from "@automerge/automerge/slim";
 import * as AutomergeRepo from "@automerge/automerge-repo/slim";
 import { initKeyhiveWasm, initializeAutomergeRepoKeyhiveWithRepo, } from "@automerge/automerge-repo-keyhive";
@@ -21,14 +22,14 @@ import { initSync as initSubductionSync } from "@automerge/automerge-subduction/
 const siteName = typeof __SITE_NAME__ !== "undefined" ? __SITE_NAME__ : "tiny-patchwork";
 const useKeyhiveSyncServer = typeof __KEYHIVE_SYNC_SERVER__ !== "undefined" && __KEYHIVE_SYNC_SERVER__;
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
+import { importAutomergeModuleViaWorker } from "./module-loader.js";
 import { openDocument, registerPatchworkViewElement, } from "@inkandswitch/patchwork-elements";
 import { registerRepoProviderElement } from "@inkandswitch/patchwork-providers";
 import { getRegistry, registerPlugins, resolveAccountHandle, unregisterPlugins, } from "@inkandswitch/patchwork-plugins";
 import * as plugins from "@inkandswitch/patchwork-plugins";
-import setupServiceWorker from "./setup.js";
+import setupServiceWorker, { lifecycleLoggingEnabled, } from "./setup.js";
 import debug from "debug";
 const log = debug("patchwork:bootloader:site");
-const DEFAULT_REMOTE_STORAGE_ID = "3760df37-a4c6-4f66-9ecd-732039a9385d";
 // Legacy big-patchwork hash shape: `slug--<documentId>[?=type]`.
 const BIG_PATCHWORK_HASH_REGEX = /(?<title>[A-Za-z0-9-]+)--(?<docId>[1-9A-HJ-NP-Za-km-z]+)(?<type>\?=[^&?]+)?/;
 const [automergeWasm, subductionWasm] = await Promise.all([
@@ -48,53 +49,76 @@ export async function bootPatchworkSite(config) {
     const defaultModuleSources = resolveDefaultModules(config);
     showLoadingAnimation();
     log(`booting`, config);
+    installLifecycleLogging();
     await initializeWasm(automergeWasm);
     initSubductionSync(subductionWasm);
+    log("enabling workers");
     const sw = await setupServiceWorker();
     if (!sw)
         throw new Error("Failed to set up service worker");
+    log("workers ready");
     let hive;
-    // Get the initial automerge-worker port via subscribeToRepoChannel,
-    // then pass it to keyhive init which wraps it in its own network adapter.
-    let resolvePort;
-    const portPromise = new Promise((r) => {
-        resolvePort = r;
-    });
-    await sw.subscribeToRepoChannel(resolvePort);
-    const workerPort = await portPromise;
     let repo;
-    if (config.keyhive) {
-        initKeyhiveWasm();
-        ({ hive, repo } = await initializeAutomergeRepoKeyhiveWithRepo({
-            createRepo: (config) => new Repo(config),
-            storage: new IndexedDBStorageAdapter(`${siteName}-keyhive`),
-            peerIdSuffix: siteName + Math.random().toString(36).slice(2),
-            networkAdapter: new MessageChannelNetworkAdapter(workerPort),
-            automaticArchiveIngestion: true,
-            cachingMode: "periodic",
-            onlyShareWithHardcodedServerPeerId: false,
-            // ARK selects the relay via `syncServer` ("keyhive" | "subduction").
-            // Defaults to "subduction".
-            ...(useKeyhiveSyncServer ? { syncServer: "keyhive" } : {}),
-            repo: {
-                storage: new IndexedDBStorageAdapter(),
-                enableRemoteHeadsGossiping: true,
-            },
-        }));
+    // If a Repo is already on `window` — an embedding context provided one before
+    // this entry ran — reuse it and its keyhive instead of standing up a fresh
+    // realm-local Repo, so we share the same documents and sync/keyhive context.
+    // Otherwise create our own below.
+    if (window.repo) {
+        log("using existing Repo from window");
+        repo = window.repo;
+        hive = window.hive;
     }
     else {
-        repo = new Repo({
-            network: [new MessageChannelNetworkAdapter(workerPort)],
-            storage: new IndexedDBStorageAdapter(),
-            async sharePolicy(peerId) {
-                return peerId.includes("automerge-worker");
-            },
-            enableRemoteHeadsGossiping: true,
-            peerId: `${config.titleSuffix}-tab-${crypto.randomUUID()}`,
+        // Get the initial automerge-worker port via subscribeToRepoChannel,
+        // then pass it to keyhive init which wraps it in its own network adapter.
+        let resolvePort;
+        const portPromise = new Promise((r) => {
+            resolvePort = r;
         });
+        log("subscribing to repo channel");
+        await sw.subscribeToRepoChannel(resolvePort);
+        log("repo channel subscribed");
+        const workerPort = await portPromise;
+        if (config.keyhive) {
+            log("setting up keyhive");
+            initKeyhiveWasm();
+            ({ hive, repo } = await initializeAutomergeRepoKeyhiveWithRepo({
+                createRepo: (config) => new Repo(config),
+                storage: new IndexedDBWorkerStorageAdapter(`${siteName}-keyhive`),
+                peerIdSuffix: siteName + Math.random().toString(36).slice(2),
+                networkAdapter: new MessageChannelNetworkAdapter(workerPort),
+                automaticArchiveIngestion: true,
+                cachingMode: "periodic",
+                onlyShareWithHardcodedServerPeerId: false,
+                // ARK selects the relay via `syncServer` ("keyhive" | "subduction").
+                // Defaults to "subduction".
+                ...(useKeyhiveSyncServer ? { syncServer: "keyhive" } : {}),
+                repo: {
+                    storage: new IndexedDBWorkerStorageAdapter(),
+                    enableRemoteHeadsGossiping: true,
+                },
+            }));
+            log("keyhive setup complete");
+        }
+        else {
+            log("creating repo");
+            repo = new Repo({
+                network: [new MessageChannelNetworkAdapter(workerPort)],
+                storage: new IndexedDBWorkerStorageAdapter(),
+                async sharePolicy(peerId) {
+                    return peerId.includes("automerge-worker");
+                },
+                enableRemoteHeadsGossiping: true,
+                peerId: `${config.titleSuffix}-tab-${crypto.randomUUID()}`,
+            });
+            log("repo created");
+        }
     }
-    repo.subscribeToRemotes(config.remoteStorageIds ?? [DEFAULT_REMOTE_STORAGE_ID]);
+    log("popping repo on window");
+    window.repo = repo;
+    log("await repo.networkSubsystem.whenReady()");
     await repo.networkSubsystem.whenReady();
+    log("networkSubsystem ready");
     if (hive) {
         hive.networkAdapter.syncKeyhive?.();
     }
@@ -114,7 +138,10 @@ export async function bootPatchworkSite(config) {
     // `resolveAccountHandle` below has something to await on (the `account`
     // datatype lives in that bundle today). The user's own module-settings URL
     // is added lazily once it appears on the account doc — see below.
-    const moduleWatcher = new ModuleWatcher(repo, buildSystemSources(defaultModuleSources), onModuleLoaded, unregisterPlugins);
+    const moduleWatcher = new ModuleWatcher(repo, buildSystemSources(defaultModuleSources), onModuleLoaded, unregisterPlugins, 
+    // Discover an Automerge package's plugin descriptors off the main thread;
+    // each plugin's load() re-imports the package (at heads) on this thread.
+    importAutomergeModuleViaWorker);
     const accountDocHandle = (await resolveAccountHandle(repo, {
         storageKey: config.accountStorageKey,
         hive,
@@ -164,9 +191,7 @@ function isValidModuleSource(source) {
  * built-in default bundle).
  */
 function resolveDefaultModules(config) {
-    const builtin = config.defaultModules ??
-        config.defaultModulesUrl ??
-        [];
+    const builtin = config.defaultModules ?? config.defaultModulesUrl ?? [];
     const builtinList = (Array.isArray(builtin) ? builtin : [builtin]).filter(Boolean);
     const override = globalThis.localStorage?.getItem("defaultToolsUrl");
     if (override) {
@@ -206,6 +231,33 @@ function installDevConsoleGlobals(repo, hive, getRepoChannel) {
     }
     window.getRepoChannel = getRepoChannel;
 }
+/**
+ * Log this tab's Page Lifecycle + connectivity transitions (visibility,
+ * freeze, bfcache, online/offline) so they line up against the SharedWorker's
+ * sync-socket reaps. [lifecycle]-tagged, on by default.
+ */
+function installLifecycleLogging() {
+    if (typeof document === "undefined")
+        return;
+    const opts = { capture: true };
+    const note = (label, extra) => {
+        if (!lifecycleLoggingEnabled())
+            return;
+        const msg = `[lifecycle] ${new Date().toISOString()} ${label}`;
+        if (extra === undefined)
+            console.info(msg);
+        else
+            console.info(msg, extra);
+    };
+    document.addEventListener("visibilitychange", () => note(`visibilitychange → ${document.visibilityState}`), opts);
+    document.addEventListener("freeze", () => note("freeze (tab suspended)"), opts);
+    document.addEventListener("resume", () => note("resume (tab unsuspended)"), opts);
+    window.addEventListener("pageshow", e => note("pageshow", { persisted: e.persisted }), opts);
+    window.addEventListener("pagehide", e => note("pagehide", { persisted: e.persisted }), opts);
+    window.addEventListener("online", () => note("online"), opts);
+    window.addEventListener("offline", () => note("offline"), opts);
+    note(`lifecycle logging installed (visibilityState=${document.visibilityState}, hasFocus=${document.hasFocus()})`);
+}
 function onModuleLoaded(name, mod) {
     if (Array.isArray(mod.plugins)) {
         log(`registering ${mod.plugins.length} plugin(s) from ${name.slice(0, 30)}...`, mod.plugins.map((p) => `${p.type}:${p.id}`));

package/dist/types.d.ts

@@ -5,6 +5,12 @@
  * reintroduced when either of them restarts — and so tabs can listen in.
  */
 export declare const HANDOFF_CHANNEL = "@patchwork/handoff";
+/**
+ * BroadcastChannel on which the automerge shared worker announces remote
+ * heads it learns about from the sync server. Any tab can listen to stay
+ * informed of sync progress without repo-to-repo gossiping.
+ */
+export declare const SYNCSTATE_CHANNEL = "@patchwork/syncstate";
 /**
  * The special URL to resolve, plus enough of the {@link Request} the service
  * worker is holding that the automerge worker can construct one that
@@ -93,6 +99,8 @@ export type SetupServiceWorkerOptions = {
 };
 export type ServiceWorkerRepoChannelListener = (port: MessagePort) => void | Promise<void>;
 export type SetupServiceWorkerResult = {
+    shared?: SharedWorker;
+    kill?: () => void;
     /** Open a classic Automerge sync WebSocket from the automerge worker. */
     connectClassicSync: (server?: string) => Promise<void>;
     subscribeToRepoChannel: (listener: ServiceWorkerRepoChannelListener) => Promise<() => void>;

package/dist/types.js

@@ -5,3 +5,9 @@
  * reintroduced when either of them restarts — and so tabs can listen in.
  */
 export const HANDOFF_CHANNEL = "@patchwork/handoff";
+/**
+ * BroadcastChannel on which the automerge shared worker announces remote
+ * heads it learns about from the sync server. Any tab can listen to stay
+ * informed of sync progress without repo-to-repo gossiping.
+ */
+export const SYNCSTATE_CHANNEL = "@patchwork/syncstate";

package/dist/vite/service-worker-plugin.js

@@ -12,6 +12,10 @@ const workers = [
         specifier: "@inkandswitch/patchwork-bootloader/automerge-worker",
         fileName: "automerge-worker.js",
     },
+    {
+        specifier: "@inkandswitch/patchwork-bootloader/module-loader-worker",
+        fileName: "module-loader-worker.js",
+    },
 ];
 export function serviceworker() {
     const entryIds = new Set();

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@inkandswitch/patchwork-bootloader",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "author": "chee",
   "type": "module",
   "license": "MIT",
   "devDependencies": {
-    "@automerge/automerge-repo-keyhive": "0.3.0-alpha.sub.6c",
+    "@automerge/automerge-repo-keyhive": "0.3.0-alpha.sub.8b",
     "esbuild": "^0.23.1",
     "rollup": "^4.61.1"
   },
@@ -30,6 +30,10 @@
       "import": "./dist/automerge-worker.js",
       "types": "./dist/automerge-worker.d.ts"
     },
+    "./module-loader-worker": {
+      "import": "./dist/module-loader-worker.js",
+      "types": "./dist/module-loader-worker.d.ts"
+    },
     "./site": {
       "import": "./dist/site.js",
       "types": "./dist/site.d.ts"
@@ -41,28 +45,28 @@
   },
   "dependencies": {
     "@automerge/automerge": "3.3.0-fragments.1",
-    "@automerge/automerge-repo": "2.6.0-subduction.34",
-    "@automerge/automerge-repo-network-messagechannel": "2.6.0-subduction.34",
-    "@automerge/automerge-repo-network-websocket": "2.6.0-subduction.34",
-    "@automerge/automerge-repo-storage-indexeddb": "2.6.0-subduction.34",
+    "@automerge/automerge-repo": "2.6.0-subduction.39",
+    "@automerge/automerge-repo-network-messagechannel": "2.6.0-subduction.39",
+    "@automerge/automerge-repo-network-websocket": "2.6.0-subduction.39",
+    "@automerge/automerge-repo-storage-indexeddb": "2.6.0-subduction.39",
     "@automerge/automerge-subduction": "0.16.0",
-    "@automerge/vanillajs": "2.6.0-subduction.34",
-    "@keyhive/keyhive": "0.1.0-alpha.3",
+    "@automerge/vanillajs": "2.6.0-subduction.39",
+    "@keyhive/keyhive": "0.1.0-alpha.5",
     "@types/debug": "^4.1.13",
     "debug": "^4.4.3",
     "resolve.exports": "^2.0.3",
     "service-worker-types": "npm:@types/serviceworker@^0.0.153",
     "tinyargs": "^0.1.4",
-    "@inkandswitch/patchwork-filesystem": "^0.1.0",
-    "@inkandswitch/patchwork-plugins": "^0.0.11",
+    "@inkandswitch/patchwork-filesystem": "^0.1.1",
+    "@inkandswitch/patchwork-elements": "^2.0.0",
     "@inkandswitch/patchwork-providers": "^0.3.0",
-    "@inkandswitch/patchwork-elements": "^2.0.0"
+    "@inkandswitch/patchwork-plugins": "^0.0.11"
   },
   "peerDependencies": {
     "@automerge/automerge": "3.3.0-fragments.1",
-    "@automerge/automerge-repo": "2.6.0-subduction.34",
-    "@automerge/automerge-repo-keyhive": "0.3.0-alpha.sub.6c",
-    "@automerge/vanillajs": "2.6.0-subduction.34"
+    "@automerge/automerge-repo": "2.6.0-subduction.39",
+    "@automerge/automerge-repo-keyhive": "0.3.0-alpha.sub.8b",
+    "@automerge/vanillajs": "2.6.0-subduction.39"
   },
   "scripts": {
     "build": "tsc",

package/src/automerge-worker.ts

@@ -30,9 +30,9 @@ import {
 import { resolvePath } from "@inkandswitch/patchwork-filesystem";
 
 // Small adapters — bundled directly into the worker
-import { IndexedDBStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb";
+import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
 import { MessageChannelNetworkAdapter } from "@automerge/automerge-repo-network-messagechannel";
-import { WebSocketClientAdapter } from "@automerge/automerge-repo-network-websocket";
+import { WebSocketWorkerClientAdapter } from "@automerge/automerge-repo-network-websocket";
 import {
   initializeAutomergeRepoKeyhiveRustWithRepo,
   initKeyhiveWasm,
@@ -54,6 +54,103 @@ declare const __KEYHIVE_SYNC_SERVER__: boolean;
 
 let debugging = false;
 
+// Per-boot identity so a tab can detect a worker *restart*: a fresh instance
+// means a new repo peerId + cold in-memory state, so the tab's docs must be
+// re-subscribed. Sent in `hello` (on connect) and every `pong`.
+const WORKER_INSTANCE_ID = Math.random().toString(36).slice(2);
+const WORKER_BOOT_TIME = Date.now();
+
+// ── Forward console output + uncaught errors to the main thread ─────────
+// The SharedWorker has its own console that's a pain to find (chrome://inspect
+// → shared workers). Patch console.* and the global error handlers to also
+// post back over every connected tab's control port, tagged [automerge-worker].
+
+const controlPorts = new Set<MessagePort>();
+// Logs emitted before any tab has connected (e.g. during wasm boot) would
+// otherwise be lost — buffer a bounded number and flush on first connect.
+const preConnectBuffer: Array<{ level: string; args: string[] }> = [];
+const MAX_BUFFER = 200;
+
+function serializeArg(arg: any): string {
+  if (typeof arg === "string") return arg;
+  if (arg instanceof Error) return arg.stack || `${arg.name}: ${arg.message}`;
+  try {
+    return JSON.stringify(arg);
+  } catch {
+    return String(arg);
+  }
+}
+
+function forwardToMainThread(level: string, rawArgs: any[]) {
+  const args = rawArgs.map(serializeArg);
+  if (!controlPorts.size) {
+    if (preConnectBuffer.length < MAX_BUFFER) {
+      preConnectBuffer.push({ level, args });
+    }
+    return;
+  }
+  for (const port of controlPorts) {
+    try {
+      port.postMessage({ type: "console", level, args });
+    } catch {
+      // Port may be closing — ignore.
+    }
+  }
+}
+
+for (const level of ["log", "info", "warn", "error", "debug"] as const) {
+  const original = console[level].bind(console);
+  console[level] = (...args: any[]) => {
+    original(...args);
+    forwardToMainThread(level, args);
+  };
+}
+
+self.addEventListener("error", (event) => {
+  const e = event as ErrorEvent;
+  forwardToMainThread("error", [
+    `uncaught error: ${e.message}`,
+    e.error instanceof Error ? e.error.stack : undefined,
+  ]);
+});
+
+self.addEventListener("unhandledrejection", (event) => {
+  const reason = (event as PromiseRejectionEvent).reason;
+  forwardToMainThread("error", [
+    "unhandled rejection:",
+    reason instanceof Error ? reason.stack || reason.message : reason,
+  ]);
+});
+
+// Boot marker, buffered until the first tab connects. A new instance id means
+// the worker restarted (fresh peerId + cold state).
+console.warn(
+  `[lifecycle] ${new Date(WORKER_BOOT_TIME).toISOString()} automerge ` +
+    `SharedWorker started (instance ${WORKER_INSTANCE_ID})`
+);
+
+// ── Suspension watchdog ─────────────────────────────────────────────────
+// A SharedWorker gets no lifecycle events, so infer freeze/suspend from timer
+// drift. A large gap means keepalive pongs stalled and the server may have
+// reaped us.
+const WATCHDOG_TICK_MS = 5_000;
+const WATCHDOG_GAP_FACTOR = 2;
+let watchdogLast = Date.now();
+setInterval(() => {
+  const now = Date.now();
+  const gap = now - watchdogLast;
+  watchdogLast = now;
+  if (gap > WATCHDOG_TICK_MS * WATCHDOG_GAP_FACTOR) {
+    console.warn(
+      `[lifecycle] worker resumed after ~${Math.round(gap / 1000)}s gap ` +
+        `(timer expected every ${WATCHDOG_TICK_MS / 1000}s) — likely ` +
+        `suspended/frozen/throttled; WebSocket keepalive pongs were not sent ` +
+        `during this window, so the sync server may have reaped us. at ` +
+        `${new Date(now).toISOString()}`
+    );
+  }
+}, WATCHDOG_TICK_MS);
+
 // Sync server selection. Sub is the default. Build with KEYHIVE_SYNC_SERVER=true
 // to target keyhive.sync.automerge.org.
 const useKeyhiveSyncServer =
@@ -78,7 +175,7 @@ const RESOLVE_TIMEOUT_MS = 30_000;
 const DEFAULT_CLASSIC_SYNC_SERVER = "wss://sync3.automerge.org";
 
 let classicSyncServer = DEFAULT_CLASSIC_SYNC_SERVER;
-let classicSyncAdapter: WebSocketClientAdapter | null = null;
+let classicSyncAdapter: WebSocketWorkerClientAdapter | null = null;
 let classicSyncConnectPromise: Promise<void> | null = null;
 
 async function connectClassicSyncNetwork(server: string): Promise<void> {
@@ -97,7 +194,7 @@ async function connectClassicSyncNetwork(server: string): Promise<void> {
   classicSyncConnectPromise = (async () => {
     const { repo } = await getRepoHive();
     if (!classicSyncAdapter) {
-      classicSyncAdapter = new WebSocketClientAdapter(url);
+      classicSyncAdapter = new WebSocketWorkerClientAdapter(url);
       repo.networkSubsystem.addNetworkAdapter(classicSyncAdapter);
     }
     await classicSyncAdapter.whenReady();
@@ -153,7 +250,7 @@ function getRepoHive() {
         const signer = await WebCryptoSigner.setup();
 
         const repo = new Repo({
-          storage: new IndexedDBStorageAdapter(),
+          storage: new IndexedDBWorkerStorageAdapter(),
           signer,
           peerId: ("automerge-worker-" +
             Math.random()
@@ -181,7 +278,7 @@ function getRepoHive() {
       // ARK variant for talking to the keyhive-enabled subduction sync server.
       const { hive, repo } = await initializeAutomergeRepoKeyhiveRustWithRepo({
         createRepo: (config) => new Repo(config),
-        storage: new IndexedDBStorageAdapter(`${siteName}-keyhive`),
+        storage: new IndexedDBWorkerStorageAdapter(`${siteName}-keyhive`),
         peerIdSuffix:
           `${siteName}-worker` + Math.random().toString(36).slice(2),
         automaticArchiveIngestion: true,
@@ -191,7 +288,7 @@ function getRepoHive() {
         // defaults to "subduction".
         ...(useKeyhiveSyncServer ? { syncServer: "keyhive" as const } : {}),
         repo: {
-          storage: new IndexedDBStorageAdapter(),
+          storage: new IndexedDBWorkerStorageAdapter(),
           subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
           enableRemoteHeadsGossiping: true,
         },
@@ -362,6 +459,13 @@ function handleControlMessage(
         });
         replyPort?.close();
       });
+  } else if (data?.type === "ping") {
+    // Heartbeat: reply so the tab can detect our death or restart.
+    controlPort.postMessage({
+      type: "pong",
+      id: data.id,
+      instanceId: WORKER_INSTANCE_ID,
+    });
   }
 }
 
@@ -376,10 +480,32 @@ self.addEventListener("connect", (event) => {
   // Fires when the owning page is destroyed. Browsers without the close
   // event fall back to the adapters' lazy useWeakRef cleanup.
   controlPort.addEventListener("close", () => {
+    controlPorts.delete(controlPort);
     void dropConnection(connection);
   });
 
   controlPort.start();
+
+  // Greet the tab with our per-boot instance id so it can detect a restart
+  // (a different id than last seen) even if no port "close" fired.
+  controlPort.postMessage({
+    type: "hello",
+    instanceId: WORKER_INSTANCE_ID,
+    bootTime: WORKER_BOOT_TIME,
+  });
+
+  // Start forwarding console output to this tab, and flush anything buffered
+  // while no tab was connected (e.g. boot-time logs) to the first arrival.
+  controlPorts.add(controlPort);
+  if (preConnectBuffer.length) {
+    for (const { level, args } of preConnectBuffer.splice(0)) {
+      try {
+        controlPort.postMessage({ type: "console", level, args });
+      } catch {
+        // Port may already be gone — ignore.
+      }
+    }
+  }
 });
 
 // ── Automerge URL resolution ───────────────────────────────────────────
@@ -555,7 +681,7 @@ async function handleHandoffRequest(message: HandoffRequestMessage) {
       id,
       type: "response",
       response: {
-        status: 500,
+        status: 557,
         body,
         headers: { "content-type": "text/plain" },
       },
@@ -601,7 +727,7 @@ async function handleHandoffRequest(message: HandoffRequestMessage) {
       id,
       type: "response",
       response: {
-        status: 500,
+        status: 558,
         body: String(error),
         headers: { "content-type": "text/plain" },
       },

package/src/externals.ts

@@ -7,10 +7,9 @@ const externals = [
   "@automerge/automerge-repo",
   "@automerge/automerge-repo/slim",
   "@automerge/automerge-repo-network-messagechannel",
+  "@automerge/automerge-repo-network-websocket",
   "@automerge/automerge-repo-storage-indexeddb",
   "@automerge/automerge-repo-keyhive",
-  "@automerge/automerge-repo-network-messagechannel",
-  "@automerge/automerge-repo-storage-indexeddb",
   "@automerge/automerge-subduction",
   "@automerge/automerge-subduction/slim",
   "@keyhive/keyhive",

package/src/module-loader-worker.ts

@@ -0,0 +1,68 @@
+// Dedicated module worker for plugin-descriptor discovery.
+//
+// A module-settings doc lists Automerge folder-doc packages. To register the
+// plugins a package provides we only need their *descriptions* (id, type,
+// name, icon…), not their implementations. This worker imports a package's
+// entry point off the main thread purely to read its exported `plugins` array,
+// strips the non-cloneable `load()` / `import` machinery, and posts the plain
+// descriptors back. The main thread re-imports the package (at the same heads)
+// only when a plugin is actually loaded — see `importPluginFromFolderDocUrl`.
+//
+// Created with type:"module"; its dynamic `import()` of `/<automergeUrl>/…`
+// entry points is served by the service worker that controls this worker.
+
+import { importModuleFromFolderDocUrl } from "@inkandswitch/patchwork-filesystem";
+import type { AutomergeUrl } from "@automerge/automerge-repo/slim";
+
+type DiscoverRequest = {
+  type: "discover";
+  id: number;
+  url: AutomergeUrl;
+};
+
+// Keep only the structured-cloneable description fields. `load` is a closure
+// and `module` is the (possibly already-loaded) implementation — neither can
+// cross the worker boundary. `import` is droppable too: the main thread
+// rebuilds loading by re-importing the package and calling the live plugin.
+function toDescriptor(plugin: any): Record<string, unknown> {
+  if (!plugin || typeof plugin !== "object") return {};
+  const { load, import: _import, module, ...description } = plugin;
+  return description;
+}
+
+function isDiscoverRequest(data: unknown): data is DiscoverRequest {
+  return (
+    typeof data === "object" &&
+    data !== null &&
+    (data as any).type === "discover" &&
+    typeof (data as any).id === "number" &&
+    typeof (data as any).url === "string"
+  );
+}
+
+self.addEventListener("message", (event: MessageEvent) => {
+  const data = event.data;
+  if (!isDiscoverRequest(data)) return;
+  const { id, url } = data;
+
+  importModuleFromFolderDocUrl(url)
+    .then((mod) => {
+      const plugins: any[] = Array.isArray(mod?.plugins) ? mod.plugins : [];
+      const descriptors = plugins.map(toDescriptor);
+      (self as unknown as Worker).postMessage({
+        type: "descriptors",
+        id,
+        descriptors,
+      });
+    })
+    .catch((error) => {
+      (self as unknown as Worker).postMessage({
+        type: "error",
+        id,
+        error:
+          error instanceof Error
+            ? (error.stack ?? error.message)
+            : String(error),
+      });
+    });
+});