@inkandswitch/patchwork-bootloader 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @inkandswitch/patchwork-bootloader
 
+## 0.3.2
+
+### Patch Changes
+
+- 0e1eb95: add syncstate info shape
+
+## 0.3.1
+
+### Patch Changes
+
+- 099e931: Discover a package's plugin descriptors in a dedicated module worker off the
+  main thread, then re-import the package (pinned to the same heads) on the main
+  thread to run each plugin's real loader. Adds
+  `importPluginFromFolderDocUrl(folderDocUrl, pluginType, pluginId)`, which selects
+  the plugin by both its `type` and `id` — a plugin `id` is only unique within a
+  plugin type, so a package may export e.g. a `patchwork:datatype` and a
+  `patchwork:tool` that share the same id.
+- Updated dependencies [099e931]
+  - @inkandswitch/patchwork-filesystem@0.1.1
+
 ## 0.2.8
 
 ### Patch Changes

package/dist/automerge-worker.js

@@ -20,12 +20,135 @@ import { WebCryptoSigner } from "@automerge/automerge-subduction/slim";
 import { Repo, isValidAutomergeUrl, parseAutomergeUrl, stringifyAutomergeUrl, } from "@automerge/automerge-repo/slim";
 import { resolvePath } from "@inkandswitch/patchwork-filesystem";
 // Small adapters — bundled directly into the worker
-import { IndexedDBStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb";
+import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
 import { MessageChannelNetworkAdapter } from "@automerge/automerge-repo-network-messagechannel";
-import { WebSocketClientAdapter } from "@automerge/automerge-repo-network-websocket";
+import { WebSocketWorkerClientAdapter } from "@automerge/automerge-repo-network-websocket";
 import { initializeAutomergeRepoKeyhiveRustWithRepo, initKeyhiveWasm, } from "@automerge/automerge-repo-keyhive";
-import { HANDOFF_CHANNEL, } from "./types.js";
+import { HANDOFF_CHANNEL, SYNCSTATE_CHANNEL, } from "./types.js";
 let debugging = false;
+// Per-boot identity so a tab can detect a worker *restart*: a fresh instance
+// means a new repo peerId + cold in-memory state, so the tab's docs must be
+// re-subscribed. Sent in `hello` (on connect) and every `pong`.
+const WORKER_INSTANCE_ID = Math.random().toString(36).slice(2);
+const WORKER_BOOT_TIME = Date.now();
+// ── Forward console output + uncaught errors to the main thread ─────────
+// The SharedWorker has its own console that's a pain to find (chrome://inspect
+// → shared workers). Patch console.* and the global error handlers to also
+// post back over every connected tab's control port, tagged [automerge-worker].
+const controlPorts = new Set();
+// ── Per-tab sync-state subscriptions ────────────────────────────────────
+// Each tab's control port subscribes to the documents it cares about; we push
+// only those docs' heads back down that port (addressed — tab A never sees tab
+// B's docs), and drop a port's whole subscription set when it closes (the tab
+// went away), so there's nothing to reference-count or time out. The global
+// connection/whoami signals still go over SYNCSTATE_CHANNEL.
+const syncWatchers = new Map();
+// Installed by setupSyncStateBroadcast once the repo's snapshot exists, so a
+// fresh `sync-sub` can be replayed the doc's current heads immediately. Null
+// until then; subscriptions taken during boot are replayed when it installs.
+let replaySyncForPort = null;
+function syncSubscribe(port, documentId) {
+    let docs = syncWatchers.get(port);
+    if (!docs)
+        syncWatchers.set(port, (docs = new Set()));
+    if (docs.has(documentId))
+        return;
+    docs.add(documentId);
+    replaySyncForPort?.(documentId, port);
+}
+function syncUnsubscribe(port, documentId) {
+    syncWatchers.get(port)?.delete(documentId);
+}
+// Push one document's heads to every control port currently watching it.
+function pushSyncState(message) {
+    for (const [port, docs] of syncWatchers) {
+        if (!docs.has(message.documentId))
+            continue;
+        try {
+            port.postMessage(message);
+        }
+        catch {
+            // Port already gone; its close handler will reap the entry.
+        }
+    }
+}
+// Logs emitted before any tab has connected (e.g. during wasm boot) would
+// otherwise be lost — buffer a bounded number and flush on first connect.
+const preConnectBuffer = [];
+const MAX_BUFFER = 200;
+function serializeArg(arg) {
+    if (typeof arg === "string")
+        return arg;
+    if (arg instanceof Error)
+        return arg.stack || `${arg.name}: ${arg.message}`;
+    try {
+        return JSON.stringify(arg);
+    }
+    catch {
+        return String(arg);
+    }
+}
+function forwardToMainThread(level, rawArgs) {
+    const args = rawArgs.map(serializeArg);
+    if (!controlPorts.size) {
+        if (preConnectBuffer.length < MAX_BUFFER) {
+            preConnectBuffer.push({ level, args });
+        }
+        return;
+    }
+    for (const port of controlPorts) {
+        try {
+            port.postMessage({ type: "console", level, args });
+        }
+        catch {
+            // Port may be closing — ignore.
+        }
+    }
+}
+for (const level of ["log", "info", "warn", "error", "debug"]) {
+    const original = console[level].bind(console);
+    console[level] = (...args) => {
+        original(...args);
+        forwardToMainThread(level, args);
+    };
+}
+self.addEventListener("error", (event) => {
+    const e = event;
+    forwardToMainThread("error", [
+        `uncaught error: ${e.message}`,
+        e.error instanceof Error ? e.error.stack : undefined,
+    ]);
+});
+self.addEventListener("unhandledrejection", (event) => {
+    const reason = event.reason;
+    forwardToMainThread("error", [
+        "unhandled rejection:",
+        reason instanceof Error ? reason.stack || reason.message : reason,
+    ]);
+});
+// Boot marker, buffered until the first tab connects. A new instance id means
+// the worker restarted (fresh peerId + cold state).
+console.warn(`[lifecycle] ${new Date(WORKER_BOOT_TIME).toISOString()} automerge ` +
+    `SharedWorker started (instance ${WORKER_INSTANCE_ID})`);
+// ── Suspension watchdog ─────────────────────────────────────────────────
+// A SharedWorker gets no lifecycle events, so infer freeze/suspend from timer
+// drift. A large gap means keepalive pongs stalled and the server may have
+// reaped us.
+const WATCHDOG_TICK_MS = 5_000;
+const WATCHDOG_GAP_FACTOR = 2;
+let watchdogLast = Date.now();
+setInterval(() => {
+    const now = Date.now();
+    const gap = now - watchdogLast;
+    watchdogLast = now;
+    if (gap > WATCHDOG_TICK_MS * WATCHDOG_GAP_FACTOR) {
+        console.warn(`[lifecycle] worker resumed after ~${Math.round(gap / 1000)}s gap ` +
+            `(timer expected every ${WATCHDOG_TICK_MS / 1000}s) — likely ` +
+            `suspended/frozen/throttled; WebSocket keepalive pongs were not sent ` +
+            `during this window, so the sync server may have reaped us. at ` +
+            `${new Date(now).toISOString()}`);
+    }
+}, WATCHDOG_TICK_MS);
 // Sync server selection. Sub is the default. Build with KEYHIVE_SYNC_SERVER=true
 // to target keyhive.sync.automerge.org.
 const useKeyhiveSyncServer = typeof __KEYHIVE_SYNC_SERVER__ !== "undefined" && __KEYHIVE_SYNC_SERVER__;
@@ -43,6 +166,13 @@ const SUBDUCTION_ENDPOINTS = [
         : "wss://subduction.sync.inkandswitch.com",
 ];
 const RESOLVE_TIMEOUT_MS = 30_000;
+// Backoff re-sync of stuck/diverged docs. Only this worker is connected to the
+// sync server, so it's the only place that can notice a doc whose heads have
+// settled out of sync with the server and re-arm a sync round for it.
+const RESYNC_GRACE_MS = 8_000; // must be *stably* diverged this long first
+const RESYNC_INITIAL_DELAY_MS = 5_000; // first backoff cooldown after a resync
+const RESYNC_MAX_DELAY_MS = 60_000; // backoff cap
+const RESYNC_REVIEW_INTERVAL_MS = 5_000; // how often stuck docs are re-checked
 const DEFAULT_CLASSIC_SYNC_SERVER = "wss://sync3.automerge.org";
 let classicSyncServer = DEFAULT_CLASSIC_SYNC_SERVER;
 let classicSyncAdapter = null;
@@ -61,7 +191,7 @@ async function connectClassicSyncNetwork(server) {
     classicSyncConnectPromise = (async () => {
         const { repo } = await getRepoHive();
         if (!classicSyncAdapter) {
-            classicSyncAdapter = new WebSocketClientAdapter(url);
+            classicSyncAdapter = new WebSocketWorkerClientAdapter(url);
             repo.networkSubsystem.addNetworkAdapter(classicSyncAdapter);
         }
         await classicSyncAdapter.whenReady();
@@ -98,8 +228,13 @@ function getRepoHive() {
             log("wasm initialized");
             if (!useKeyhive) {
                 const signer = await WebCryptoSigner.setup();
+                const identity = {
+                    peerId: signer.peerId().toString(),
+                    verifyingKey: signer.verifyingKey().toHex(),
+                };
+                console.log("[patchwork] shared-worker subduction identity:", identity);
                 const repo = new Repo({
-                    storage: new IndexedDBStorageAdapter(),
+                    storage: new IndexedDBWorkerStorageAdapter(),
                     signer,
                     peerId: ("automerge-worker-" +
                         Math.random()
@@ -112,6 +247,8 @@ function getRepoHive() {
                     subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
                 });
                 self.repo = repo;
+                self.syncIdentity = identity;
+                setupSyncStateBroadcast(repo, identity);
                 log("repo constructed (no keyhive), waiting for network subsystem");
                 repo.networkSubsystem.whenReady().then(() => {
                     log("repo network subsystem ready");
@@ -122,7 +259,7 @@ function getRepoHive() {
             // ARK variant for talking to the keyhive-enabled subduction sync server.
             const { hive, repo } = await initializeAutomergeRepoKeyhiveRustWithRepo({
                 createRepo: (config) => new Repo(config),
-                storage: new IndexedDBStorageAdapter(`${siteName}-keyhive`),
+                storage: new IndexedDBWorkerStorageAdapter(`${siteName}-keyhive`),
                 peerIdSuffix: `${siteName}-worker` + Math.random().toString(36).slice(2),
                 automaticArchiveIngestion: true,
                 cachingMode: "periodic",
@@ -131,13 +268,14 @@ function getRepoHive() {
                 // defaults to "subduction".
                 ...(useKeyhiveSyncServer ? { syncServer: "keyhive" } : {}),
                 repo: {
-                    storage: new IndexedDBStorageAdapter(),
+                    storage: new IndexedDBWorkerStorageAdapter(),
                     subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
                     enableRemoteHeadsGossiping: true,
                 },
             });
             self.repo = repo;
             self.hive = hive;
+            setupSyncStateBroadcast(repo);
             log("repo constructed, waiting for network subsystem");
             // Don't block getRepoHive() on whenReady() — the network subsystem starts
             // with only the subduction adapter, and the MessageChannel adapter is
@@ -160,6 +298,285 @@ function getRepoHive() {
     }
     return repoHivePromise;
 }
+// ── Sync-state broadcast ───────────────────────────────────────────────
+//
+// Only this worker is directly connected to the sync server, so it's the only
+// place that learns the server's heads (the repo's "subduction-remote-heads"
+// event, keyed by each Subduction peer's verifying-key storageId) and whether
+// the server link is up ("subduction-connection"). We rebroadcast both on
+// SYNCSTATE_CHANNEL so every tab can render a sync indicator without holding
+// its own server connection. A tab that opens mid-stream posts {type:"request"}
+// to get the current snapshot replayed.
+let syncStateWired = false;
+function setupSyncStateBroadcast(repo, identity) {
+    if (syncStateWired)
+        return;
+    syncStateWired = true;
+    const channel = new BroadcastChannel(SYNCSTATE_CHANNEL);
+    // documentId -> storageId (verifying key) -> last-known heads
+    const snapshot = new Map();
+    let connected = repo.isSubductionConnected();
+    // Directly-connected sync-server peer ids (verifying keys). Stable once
+    // known; tabs use this to judge "synced" against the server specifically.
+    let serverPeerIds = [];
+    const postWhoAmI = () => {
+        if (!identity)
+            return;
+        channel.postMessage({
+            type: "whoami",
+            peerId: identity.peerId,
+            verifyingKey: identity.verifyingKey,
+        });
+    };
+    // Announce our identity so tabs can label which peer rows are this worker.
+    postWhoAmI();
+    // Heads are addressed, not broadcast: push a doc's heads only to the control
+    // ports that subscribed to it (see syncWatchers / pushSyncState).
+    const postHeads = (documentId, storageId, heads, timestamp) => pushSyncState({
+        type: "sync-state",
+        documentId,
+        storageId,
+        heads,
+        timestamp,
+    });
+    // Let a `sync-sub` (which may have arrived while the repo was still booting)
+    // replay this doc's current snapshot to the subscribing port immediately.
+    const replayDoc = (documentId, port) => {
+        const byStorage = snapshot.get(documentId);
+        if (!byStorage)
+            return;
+        for (const [storageId, { heads, timestamp }] of byStorage) {
+            try {
+                port.postMessage({
+                    type: "sync-state",
+                    documentId,
+                    storageId,
+                    heads,
+                    timestamp,
+                });
+            }
+            catch {
+                // Port gone; its close handler reaps it.
+            }
+        }
+    };
+    replaySyncForPort = replayDoc;
+    // Catch up any ports that subscribed before this wiring existed.
+    for (const [port, docs] of syncWatchers) {
+        for (const documentId of docs)
+            replayDoc(documentId, port);
+    }
+    const postConnection = () => channel.postMessage({
+        type: "connection",
+        connected,
+        serverPeerIds,
+    });
+    // Learn (and re-announce) which connected Subduction peer is the sync server.
+    // The peer list is empty until the handshake finishes, so retry briefly.
+    const refreshServerPeers = async () => {
+        for (let attempt = 0; attempt < 6; attempt++) {
+            try {
+                const ids = await repo.connectedSubductionPeerIds();
+                if (ids.length > 0) {
+                    serverPeerIds = ids;
+                    postConnection();
+                    return;
+                }
+            }
+            catch {
+                // repo has no subduction source / not ready yet
+            }
+            await new Promise((r) => setTimeout(r, 500));
+        }
+    };
+    // Advertise the worker's OWN heads for every doc it holds (keyed by our
+    // verifying key), so the worker hop is visible on every document.
+    //
+    // Docs pushed in by Subduction that this worker never explicitly opened don't
+    // surface via the repo's "document" event, so we discover them by re-scanning
+    // repo.handles (on a tick, and whenever the server reports a doc) and attach a
+    // heads-changed listener once per doc. No-op when there's no identity (keyhive
+    // path).
+    const ownTracked = new Set();
+    const broadcastOwnHeads = (handle) => {
+        if (!identity)
+            return;
+        const documentId = handle.documentId;
+        let heads;
+        try {
+            heads = [...handle.heads()];
+        }
+        catch {
+            return; // handle not ready yet
+        }
+        const timestamp = Date.now();
+        let byStorage = snapshot.get(documentId);
+        if (!byStorage) {
+            byStorage = new Map();
+            snapshot.set(documentId, byStorage);
+        }
+        byStorage.set(identity.peerId, { heads, timestamp });
+        postHeads(documentId, identity.peerId, heads, timestamp);
+        reviewResync(documentId);
+    };
+    const trackOwnHandle = (handle) => {
+        if (!identity || ownTracked.has(handle.documentId))
+            return;
+        ownTracked.add(handle.documentId);
+        handle.on("heads-changed", () => broadcastOwnHeads(handle));
+        broadcastOwnHeads(handle);
+    };
+    const scanOwnHandles = () => {
+        if (!identity)
+            return;
+        for (const handle of Object.values(repo.handles)) {
+            trackOwnHandle(handle);
+        }
+    };
+    // ── Backoff re-sync of stuck/diverged docs ──────────────────────────
+    //
+    // Subduction sync is event-driven and only retries syncs it observed *fail*;
+    // a doc that settles missing commits the server holds — or whose heal retries
+    // were exhausted — is otherwise never retried. When we're behind and the
+    // server's advertised heads haven't advanced for a grace window (so it's
+    // genuinely stuck, not just lagging a live edit), we re-arm its sync round
+    // with per-doc exponential backoff. Convergence clears the state.
+    const serverHeadSetsFor = (documentId) => {
+        const byStorage = snapshot.get(documentId);
+        if (!byStorage)
+            return [];
+        const sets = [];
+        for (const [storageId, { heads }] of byStorage) {
+            if (serverPeerIds.includes(storageId))
+                sets.push(heads);
+        }
+        return sets;
+    };
+    const resyncState = new Map();
+    // Inspectable from the SharedWorker console as `self.patchworkResync` to see
+    // whether/how often a doc is being re-synced and against which server heads.
+    const resyncDiag = (self.patchworkResync ??= { fires: 0, byDoc: {} });
+    const reviewResync = (documentId) => {
+        if (!identity || !connected) {
+            resyncState.delete(documentId);
+            return;
+        }
+        const handle = repo.handles[documentId];
+        if (!handle)
+            return;
+        const serverSets = serverHeadSetsFor(documentId);
+        if (serverSets.length === 0) {
+            resyncState.delete(documentId); // no server signal to compare against
+            return;
+        }
+        // The server advertises subduction *sedimentree* heads (loose-commit +
+        // fragment-boundary commit ids), which are NOT the Automerge frontier — so
+        // never compare them to handle.heads() for equality. Instead ask whether we
+        // already hold every commit the server advertises (`DocHandle.containsHeads`).
+        // If we do, the server has nothing we're missing → caught up. If not, we're
+        // genuinely behind and a re-sync can pull the rest.
+        const serverHeadsUrl = [...new Set(serverSets.flat())];
+        let haveAll;
+        try {
+            haveAll = handle.containsHeads(serverHeadsUrl);
+        }
+        catch {
+            return; // doc not ready, or an undecodable head
+        }
+        if (haveAll) {
+            resyncState.delete(documentId); // we hold everything the server has
+            return;
+        }
+        // Behind. "Stuck" = the server's advertised set hasn't advanced (no
+        // progress) for a while. Key the grace timer on the server heads only, so
+        // your own edits churning don't keep resetting it.
+        const serverSig = [...serverHeadsUrl].sort().join(",");
+        const now = Date.now();
+        const prev = resyncState.get(documentId);
+        if (!prev || prev.serverSig !== serverSig) {
+            // First sighting, or the server advanced its view (progress): restart.
+            resyncState.set(documentId, {
+                serverSig,
+                since: now,
+                delay: RESYNC_INITIAL_DELAY_MS,
+                lastResyncAt: 0,
+            });
+            return;
+        }
+        if (now - prev.since < RESYNC_GRACE_MS)
+            return; // not stuck long enough yet
+        if (now - prev.lastResyncAt < prev.delay)
+            return; // within backoff cooldown
+        log("re-syncing behind doc", documentId, { serverSets });
+        resyncDiag.fires++;
+        resyncDiag.byDoc[documentId] = {
+            at: now,
+            count: (resyncDiag.byDoc[documentId]
+                ?.count ?? 0) + 1,
+            serverSets,
+        };
+        try {
+            repo.resyncSubduction(documentId);
+        }
+        catch (e) {
+            log("resyncSubduction failed", e);
+        }
+        prev.lastResyncAt = now;
+        prev.delay = Math.min(prev.delay * 2, RESYNC_MAX_DELAY_MS);
+    };
+    const reviewAllResync = () => {
+        if (!identity)
+            return;
+        for (const documentId of snapshot.keys())
+            reviewResync(documentId);
+        for (const id of [...resyncState.keys()]) {
+            if (!snapshot.has(id))
+                resyncState.delete(id);
+        }
+    };
+    repo.on("subduction-remote-heads", ({ documentId, storageId, heads, timestamp }) => {
+        const headsCopy = [...heads];
+        let byStorage = snapshot.get(documentId);
+        if (!byStorage) {
+            byStorage = new Map();
+            snapshot.set(documentId, byStorage);
+        }
+        byStorage.set(storageId, { heads: headsCopy, timestamp });
+        postHeads(documentId, storageId, headsCopy, timestamp);
+        // A doc the server reported is one we hold — make sure we're advertising
+        // our own heads for it too.
+        scanOwnHandles();
+        reviewResync(documentId);
+    });
+    repo.on("subduction-connection", ({ connected: isConnected }) => {
+        connected = isConnected;
+        postConnection();
+        if (isConnected)
+            void refreshServerPeers();
+    });
+    // A BroadcastChannel never receives its own posts, so this only sees tabs'
+    // requests, never our own broadcasts. We replay just the global signals here;
+    // a late tab gets per-doc heads by subscribing (sync-sub), not from this.
+    channel.addEventListener("message", (event) => {
+        const data = event.data;
+        if (data?.type !== "request")
+            return;
+        postWhoAmI();
+        postConnection();
+    });
+    // In case we're already connected by the time this wires up.
+    void refreshServerPeers();
+    // Discover the worker's docs by re-scanning repo.handles initially and on a
+    // tick (Subduction-pushed docs don't surface via the "document" event).
+    scanOwnHandles();
+    if (identity)
+        setInterval(scanOwnHandles, 3000);
+    // Drive the backoff re-sync of stuck/diverged docs. A tick is essential here:
+    // the "stuck" case is precisely when no head events are firing, so the
+    // grace/backoff timers can only advance on a timer.
+    if (identity)
+        setInterval(reviewAllResync, RESYNC_REVIEW_INTERVAL_MS);
+}
 function dropRepoChannel(repo, channel) {
     // removeNetworkAdapter pulls the adapter out of networkSubsystem.adapters and
     // calls adapter.disconnect(), which (for the MessageChannel adapter) emits the
@@ -242,6 +659,16 @@ function handleControlMessage(event, controlPort, connection) {
             });
         });
     }
+    else if (data?.type === "sync-sub") {
+        if (typeof data.documentId === "string") {
+            syncSubscribe(controlPort, data.documentId);
+        }
+    }
+    else if (data?.type === "sync-unsub") {
+        if (typeof data.documentId === "string") {
+            syncUnsubscribe(controlPort, data.documentId);
+        }
+    }
     else if (data?.type === "debug") {
         debugging = data.debug;
         log("automerge worker debugging enabled");
@@ -266,6 +693,14 @@ function handleControlMessage(event, controlPort, connection) {
             replyPort?.close();
         });
     }
+    else if (data?.type === "ping") {
+        // Heartbeat: reply so the tab can detect our death or restart.
+        controlPort.postMessage({
+            type: "pong",
+            id: data.id,
+            instanceId: WORKER_INSTANCE_ID,
+        });
+    }
 }
 self.addEventListener("connect", (event) => {
     const controlPort = event.ports[0];
@@ -276,9 +711,33 @@ self.addEventListener("connect", (event) => {
     // Fires when the owning page is destroyed. Browsers without the close
     // event fall back to the adapters' lazy useWeakRef cleanup.
     controlPort.addEventListener("close", () => {
+        controlPorts.delete(controlPort);
+        // The tab is gone — drop its sync subscriptions wholesale so we stop
+        // pushing it heads (no per-doc unsub needed, no leak).
+        syncWatchers.delete(controlPort);
         void dropConnection(connection);
     });
     controlPort.start();
+    // Greet the tab with our per-boot instance id so it can detect a restart
+    // (a different id than last seen) even if no port "close" fired.
+    controlPort.postMessage({
+        type: "hello",
+        instanceId: WORKER_INSTANCE_ID,
+        bootTime: WORKER_BOOT_TIME,
+    });
+    // Start forwarding console output to this tab, and flush anything buffered
+    // while no tab was connected (e.g. boot-time logs) to the first arrival.
+    controlPorts.add(controlPort);
+    if (preConnectBuffer.length) {
+        for (const { level, args } of preConnectBuffer.splice(0)) {
+            try {
+                controlPort.postMessage({ type: "console", level, args });
+            }
+            catch {
+                // Port may already be gone — ignore.
+            }
+        }
+    }
 });
 // ── Automerge URL resolution ───────────────────────────────────────────
 /**
@@ -422,7 +881,7 @@ async function handleHandoffRequest(message) {
             id,
             type: "response",
             response: {
-                status: 500,
+                status: 557,
                 body,
                 headers: { "content-type": "text/plain" },
             },
@@ -469,7 +928,7 @@ async function handleHandoffRequest(message) {
             id,
             type: "response",
             response: {
-                status: 500,
+                status: 558,
                 body: String(error),
                 headers: { "content-type": "text/plain" },
             },

package/dist/externals.js

@@ -7,10 +7,9 @@ const externals = [
     "@automerge/automerge-repo",
     "@automerge/automerge-repo/slim",
     "@automerge/automerge-repo-network-messagechannel",
+    "@automerge/automerge-repo-network-websocket",
     "@automerge/automerge-repo-storage-indexeddb",
     "@automerge/automerge-repo-keyhive",
-    "@automerge/automerge-repo-network-messagechannel",
-    "@automerge/automerge-repo-storage-indexeddb",
     "@automerge/automerge-subduction",
     "@automerge/automerge-subduction/slim",
     "@keyhive/keyhive",

package/dist/module-loader-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/module-loader-worker.js

@@ -0,0 +1,55 @@
+// Dedicated module worker for plugin-descriptor discovery.
+//
+// A module-settings doc lists Automerge folder-doc packages. To register the
+// plugins a package provides we only need their *descriptions* (id, type,
+// name, icon…), not their implementations. This worker imports a package's
+// entry point off the main thread purely to read its exported `plugins` array,
+// strips the non-cloneable `load()` / `import` machinery, and posts the plain
+// descriptors back. The main thread re-imports the package (at the same heads)
+// only when a plugin is actually loaded — see `importPluginFromFolderDocUrl`.
+//
+// Created with type:"module"; its dynamic `import()` of `/<automergeUrl>/…`
+// entry points is served by the service worker that controls this worker.
+import { importModuleFromFolderDocUrl } from "@inkandswitch/patchwork-filesystem";
+// Keep only the structured-cloneable description fields. `load` is a closure
+// and `module` is the (possibly already-loaded) implementation — neither can
+// cross the worker boundary. `import` is droppable too: the main thread
+// rebuilds loading by re-importing the package and calling the live plugin.
+function toDescriptor(plugin) {
+    if (!plugin || typeof plugin !== "object")
+        return {};
+    const { load, import: _import, module, ...description } = plugin;
+    return description;
+}
+function isDiscoverRequest(data) {
+    return (typeof data === "object" &&
+        data !== null &&
+        data.type === "discover" &&
+        typeof data.id === "number" &&
+        typeof data.url === "string");
+}
+self.addEventListener("message", (event) => {
+    const data = event.data;
+    if (!isDiscoverRequest(data))
+        return;
+    const { id, url } = data;
+    importModuleFromFolderDocUrl(url)
+        .then((mod) => {
+        const plugins = Array.isArray(mod?.plugins) ? mod.plugins : [];
+        const descriptors = plugins.map(toDescriptor);
+        self.postMessage({
+            type: "descriptors",
+            id,
+            descriptors,
+        });
+    })
+        .catch((error) => {
+        self.postMessage({
+            type: "error",
+            id,
+            error: error instanceof Error
+                ? (error.stack ?? error.message)
+                : String(error),
+        });
+    });
+});