@inkandswitch/patchwork 0.7.4 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @inkandswitch/patchwork
 
+## 0.8.0
+
+### Minor Changes
+
+- 2e71745: Every Repo on the origin is its own Subduction node. A tab holds this origin's IndexedDB, keeps its own WebSocket to the sync server, and meets the other tabs over a BroadcastChannel carrying Subduction (`siblingAdapters()` in `@inkandswitch/patchwork-bootloader/siblings`, passed to `new Repo({ subductionAdapters })`). The automerge SharedWorker no longer sits between tabs and storage — it is one more such node, kept only to resolve `automerge:` URLs for the service worker, which can't own a Repo itself. The websocket proxy worker is gone with it.
+
+  Benchmarked against the shared-worker arrangement (`sites/bench`): boot and memory are a wash or better, cross-tab propagation matches, and two shared-worker failures go away — a `find()` racing a sibling's `create()` settled as unavailable, and edits made just before a tab closed were lost, since a storageless tab had nothing to flush to. Each tab flushing its own IndexedDB closes both.
+
+  Keyhive sites use the subduction-backed hive in both the tab and the worker, each talking to the sync server directly.
+
+  `patchwork.sw.subscribeSyncState(documentId, listener)` stays, now a filter over the tab's own Repo's `subduction-remote-heads` event, replaying the server's current heads from `handle.getSyncInfo()` on subscribe; `SyncStateDocMessage` is exported from `@inkandswitch/patchwork`. Removed from `setupServiceWorker()`'s result: `subscribeToRepoChannel`, `getRepoChannel`, `subscribeSyncState`. The `@patchwork/syncstate` BroadcastChannel and the other `SyncState*` message types are gone too; a tab's own Repo has what they carried — `repo.isSubductionConnected()` and the `subduction-connection` event for the link, `repo.connectedSubductionPeerIds()` for which peers are the server, and `patchwork.signerIdentity` for this tab's peer id. `createRepo` in `@inkandswitch/patchwork` takes no arguments.
+
+  `@inkandswitch/patchwork-bootloader` depends on `@automerge/automerge-repo-network-broadcastchannel`, which is also on the importmap.
+
+  That worker is renamed for what it now does: `@inkandswitch/patchwork-bootloader/automerge-worker` is now `@inkandswitch/patchwork-bootloader/automerge-protocol-handler-worker`, emitted as `automerge-protocol-handler-worker.js` (the `workerPath` option on `setupServiceWorker` still overrides it), and `getAutomergeWorker()` is now `getAutomergeProtocolHandlerWorker()`.
+
+  Inter-tab sync is Subduction, not classic automerge sync. `connectSiblings(repo, hive)` is replaced by `siblingAdapters()`, which returns the `subductionAdapters` entries for a Repo rather than mutating one after the fact, so it is passed to the `Repo` constructor. The frames on the siblings BroadcastChannel are Subduction transport frames authenticated by each node's own signer; the keyhive network adapter no longer wraps that channel, since keyhive material reaches siblings the same way it reaches the sync server. The one remaining classic-sync path is the opt-in classic sync server the protocol handler worker connects to on request.
+
+  Subduction's handshake has an initiator and a responder, and a BroadcastChannel is a mesh, so the siblings adapter is passed with `role: "mesh"`, added to the automerge-repo fork's `subductionAdapters` by this repo's pnpm patch: for each pair of peers on the adapter, the one whose peer id sorts lower initiates the handshake and the other accepts.
+
+### Patch Changes
+
+- 47bc4cf: `@automerge/automerge` goes to `3.4.1`, and `@automerge/automerge-repo-network-broadcastchannel` joins the automerge-repo family at `2.6.0-subduction.48`.
+- Updated dependencies [47bc4cf]
+- Updated dependencies [2e71745]
+  - @inkandswitch/patchwork-bootloader@0.7.0
+  - @inkandswitch/patchwork-filesystem@0.2.9
+  - @inkandswitch/patchwork-plugins@1.2.4
+
 ## 0.7.4
 
 ### Patch Changes

package/dist/head.js

@@ -6,11 +6,7 @@
     "@automerge/automerge/slim",
     "@automerge/automerge-repo",
     "@automerge/automerge-repo/slim",
-    // Port-donation plumbing for WorkerWebSocketEndpoint: tabs spawn the shared
-    // proxy entry and donate its port to the automerge worker (Chrome can't
-    // spawn workers from inside a SharedWorker). See setup.ts/automerge-worker.ts.
-    "@automerge/automerge-repo/worker-port",
-    "@automerge/automerge-repo/subduction-websocket-worker-shared",
+    "@automerge/automerge-repo-network-broadcastchannel",
     "@automerge/automerge-repo-network-messagechannel",
     "@automerge/automerge-repo-network-websocket",
     "@automerge/automerge-repo-storage-indexeddb",

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 /**
  * One import for a Patchwork site.
  *
- * `setup(options)` constructs the Repo, wires up the automerge-worker port,
- * loads plugins via the ModuleWatcher, resolves the user's account document,
+ * `setup(options)` constructs the Repo, wires up the
+ * automerge-protocol-handler-worker port, loads plugins via the
+ * ModuleWatcher, resolves the user's account document,
  * installs the router, and resolves with the site's runtime API — `repo`,
  * `create`, `open`, `find`, `packages`, `plugins`, `sw` — which is what a
  * site assigns to `window.patchwork`.
@@ -15,7 +16,7 @@
  * Pulls in DOM- and plugin-layer dependencies, so it is for a browser site's
  * `main.ts` only. Non-UI consumers should import
  * `@inkandswitch/patchwork-bootloader` directly, which does SW registration
- * and the automerge-worker handoff and nothing else.
+ * and the automerge-protocol-handler-worker handoff and nothing else.
  */
 import { Repo } from "@automerge/vanillajs/slim";
 import type { AutomergeRepoKeyhiveBase as AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
@@ -34,4 +35,4 @@ export default setup;
 export { createRepo, initWasm } from "./repo.js";
 export { createRouter } from "./router.js";
 export { showLoadingAnimation, hideLoadingAnimation, showErrorScreen, } from "./loading.js";
-export type { OpenOptions, Patchwork, PatchworkOptions, ServiceWorkerApi, SignerIdentity, } from "./types.js";
+export type { OpenOptions, Patchwork, PatchworkOptions, ServiceWorkerApi, SignerIdentity, SyncStateDocMessage, } from "./types.js";

package/dist/index.js

@@ -1,23 +1,3 @@
-/**
- * One import for a Patchwork site.
- *
- * `setup(options)` constructs the Repo, wires up the automerge-worker port,
- * loads plugins via the ModuleWatcher, resolves the user's account document,
- * installs the router, and resolves with the site's runtime API — `repo`,
- * `create`, `open`, `find`, `packages`, `plugins`, `sw` — which is what a
- * site assigns to `window.patchwork`.
- *
- * Setup owns page-wide state — the `window.repo`/`window.Automerge`/
- * `window.AutomergeRepo`/`window.hive` globals, custom-element registration,
- * document listeners — so it may run only once per page; a second call
- * throws.
- *
- * Pulls in DOM- and plugin-layer dependencies, so it is for a browser site's
- * `main.ts` only. Non-UI consumers should import
- * `@inkandswitch/patchwork-bootloader` directly, which does SW registration
- * and the automerge-worker handoff and nothing else.
- */
-import { MessageChannelNetworkAdapter, } from "@automerge/vanillajs/slim";
 import * as Automerge from "@automerge/automerge/slim";
 import * as AutomergeRepo from "@automerge/automerge-repo/slim";
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
@@ -28,7 +8,7 @@ import { createDocOfDatatype2, getRegistry, registerPlugins, resolveAccountHandl
 import * as plugins from "@inkandswitch/patchwork-plugins";
 import setupServiceWorker, { lifecycleLog, } from "@inkandswitch/patchwork-bootloader";
 import debug from "debug";
-import { createRepo, firstRepoPort, initWasm, removeAdapterFor, } from "./repo.js";
+import { createRepo, initWasm } from "./repo.js";
 import { createRouter } from "./router.js";
 import { createDefaultAccount } from "./createAccount.js";
 const log = debug("patchwork:setup");
@@ -68,43 +48,13 @@ async function doSetup(options) {
     let hive;
     let repo;
     let signerIdentity;
-    // Called with a fresh port when the automerge worker dies and is recreated.
-    // Assigned once the repo exists.
-    let onWorkerPortRenewed;
     if (options.repo) {
         log("using provided Repo");
         repo = options.repo;
         hive = options.hive;
     }
     else {
-        const workerPort = await firstRepoPort(sw, (port) => {
-            if (onWorkerPortRenewed)
-                onWorkerPortRenewed(port);
-            else {
-                console.warn("automerge worker port renewed before the repo existed; dropping it");
-            }
-        });
-        let workerAdapter = new MessageChannelNetworkAdapter(workerPort);
-        ({ repo, hive, signerIdentity } = await createRepo(workerAdapter));
-        // The worker was recreated with cold state: wire the repo onto the fresh
-        // port and drop the adapter stranded on the dead one.
-        const bootHive = hive;
-        onWorkerPortRenewed = (port) => {
-            const fresh = new MessageChannelNetworkAdapter(port);
-            // Mirror the boot wiring: a keyhive repo talks to the worker through a
-            // keyhive adapter wrapped around the message channel.
-            const registered = bootHive
-                ? bootHive.createKeyhiveNetworkAdapter(fresh, {
-                    onlyShareWithSyncServer: false,
-                    periodicallyRequestSync: false,
-                    syncRequestInterval: 2000,
-                })
-                : fresh;
-            repo.networkSubsystem.addNetworkAdapter(registered);
-            removeAdapterFor(repo, workerAdapter, registered);
-            workerAdapter = fresh;
-            lifecycleLog("repo re-wired to the recreated automerge worker");
-        };
+        ({ repo, hive, signerIdentity } = await createRepo());
     }
     // Dev-console / tool-runtime globals (e2e and loaded tools read these). The
     // `window.patchwork` handle is deliberately not set here — the caller does
@@ -115,8 +65,6 @@ async function doSetup(options) {
         AutomergeRepo;
     if (hive)
         window.hive = hive;
-    await repo.networkSubsystem.whenReady();
-    log("networkSubsystem ready");
     hive?.networkAdapter?.syncKeyhive?.();
     registerRepoProviderElement(repo);
     const rootElementId = options.rootElementId ?? "root";
@@ -172,8 +120,7 @@ async function doSetup(options) {
         plugins,
         sw: {
             connectClassicSync: sw.connectClassicSync,
-            subscribeToRepoChannel: sw.subscribeToRepoChannel,
-            subscribeSyncState: sw.subscribeSyncState,
+            subscribeSyncState: (documentId, listener) => subscribeSyncState(repo, documentId, listener),
         },
         async create(type, init) {
             const datatype = await getRegistry("patchwork:datatype").load(type);
@@ -283,6 +230,40 @@ function installLifecycleLogging() {
     window.addEventListener("offline", () => lifecycleLog("offline"), opts);
     lifecycleLog("logging installed (visibilityState=%s, hasFocus=%s)", document.visibilityState, document.hasFocus());
 }
+// The tab's own Repo hears the server's heads directly, so this is a filter
+// over its `subduction-remote-heads` event. The current value is replayed
+// from the handle's sync info, when the server has reported any.
+function subscribeSyncState(repo, documentId, listener) {
+    const onHeads = (payload) => {
+        if (payload.documentId !== documentId)
+            return;
+        listener({
+            type: "sync-state",
+            documentId,
+            storageId: payload.storageId,
+            heads: [...payload.heads],
+            timestamp: payload.timestamp,
+        });
+    };
+    repo.on("subduction-remote-heads", onHeads);
+    void (async () => {
+        const handle = repo.handles[documentId];
+        if (!handle)
+            return;
+        for (const storageId of await repo.connectedSubductionPeerIds()) {
+            const info = handle.getSyncInfo(storageId);
+            if (info) {
+                onHeads({
+                    documentId,
+                    storageId,
+                    heads: info.lastHeads,
+                    timestamp: info.lastSyncTimestamp,
+                });
+            }
+        }
+    })();
+    return () => repo.off("subduction-remote-heads", onHeads);
+}
 // ── Named exports ────────────────────────────────────────────────────────
 export { createRepo, initWasm } from "./repo.js";
 export { createRouter } from "./router.js";

package/dist/repo.d.ts

@@ -1,23 +1,15 @@
-import { MessageChannelNetworkAdapter, Repo } from "@automerge/vanillajs/slim";
-import { type AutomergeRepoKeyhiveBase } from "@automerge/automerge-repo-keyhive";
-import setupServiceWorker from "@inkandswitch/patchwork-bootloader";
+import { Repo } from "@automerge/vanillajs/slim";
+import { type AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
 import type { SignerIdentity } from "./types.js";
 export declare function initWasm(): Promise<void>;
-export declare function createRepo(workerAdapter: MessageChannelNetworkAdapter): Promise<{
+export type TabRepo = {
     repo: Repo;
-    hive?: AutomergeRepoKeyhiveBase;
+    hive?: AutomergeRepoKeyhive;
     signerIdentity?: SignerIdentity;
-}>;
+};
 /**
- * Resolve with the first repo port the worker delivers, calling `onRenewed` for
- * every later one.
- *
- * subscribeToRepoChannel is deliberately not awaited: it resolves only after
- * the boot channel's port-ready handshake, which can take its full 30s timeout
- * against a stranded worker connection. Boot blocks on the first *delivered*
- * port instead — if the boot channel stalls, worker recovery hands the listener
- * a good port long before that timeout.
+ * The tab's own node: this origin's IndexedDB, a socket to the sync server,
+ * and the siblings channel to every other Repo on the origin. Nothing is
+ * shared with other tabs except the database underneath.
  */
-export declare function firstRepoPort(sw: Awaited<ReturnType<typeof setupServiceWorker>>, onRenewed: (port: MessagePort) => void): Promise<MessagePort>;
-/** Drop the adapter sitting on the dead worker port, leaving `keep` in place. */
-export declare function removeAdapterFor(repo: Repo, stale: MessageChannelNetworkAdapter, keep: unknown): void;
+export declare function createRepo(): Promise<TabRepo>;

package/dist/repo.js

@@ -1,6 +1,7 @@
-import { initializeWasm, Repo, } from "@automerge/vanillajs/slim";
+import { initializeWasm, Repo } from "@automerge/vanillajs/slim";
 import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
-import { initKeyhiveWasm, initializeLegacyAutomergeRepoKeyhive, } from "@automerge/automerge-repo-keyhive";
+import { siblingAdapters } from "@inkandswitch/patchwork-bootloader/siblings";
+import { initKeyhiveWasm, initializeAutomergeRepoKeyhive, } from "@automerge/automerge-repo-keyhive";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
@@ -28,41 +29,43 @@ export function initWasm() {
     }
     return wasmReady;
 }
-export async function createRepo(workerAdapter) {
+/**
+ * The tab's own node: this origin's IndexedDB, a socket to the sync server,
+ * and the siblings channel to every other Repo on the origin. Nothing is
+ * shared with other tabs except the database underneath.
+ */
+export async function createRepo() {
     if (syncServer.keyhive) {
         log("setting up keyhive");
         initKeyhiveWasm();
-        const { hive, repo } = await initializeLegacyAutomergeRepoKeyhive({
+        const { hive, repo } = await initializeAutomergeRepoKeyhive({
             createRepo: (repoConfig) => new Repo(repoConfig),
             storage: new IndexedDBWorkerStorageAdapter(keyhiveStorageName),
             peerIdSuffix: storagePrefix + Math.random().toString(36).slice(2),
-            networkAdapter: workerAdapter,
             automaticArchiveIngestion: true,
             cachingMode: "periodic",
-            onlyShareWithSyncServer: false,
             // ARK selects the relay via `syncServer`, defaulting to "subduction".
             syncServer: syncServer.keyhive,
             repo: {
                 storage: new IndexedDBWorkerStorageAdapter(),
+                subductionWebsocketEndpoints: [syncServer.url],
+                subductionAdapters: siblingAdapters(),
                 enableRemoteHeadsGossiping: true,
             },
         });
         log("keyhive setup complete");
         return { repo, hive };
     }
-    // An explicit signer, rather than the Repo's internal default, so the tab's
-    // identity can be exposed on window.patchwork. The tab never connects via
-    // Subduction, so this id never goes on the wire.
+    // The signer is explicit rather than the Repo's internal default so the
+    // identity the tab presents to the server can be shown on window.patchwork.
     const signer = new MemorySigner();
     const repo = new Repo({
-        network: [workerAdapter],
-        storage: new IndexedDBWorkerStorageAdapter(),
         signer,
-        async sharePolicy(peerId) {
-            return peerId.includes("automerge-worker");
-        },
-        enableRemoteHeadsGossiping: true,
+        storage: new IndexedDBWorkerStorageAdapter(),
         peerId: `${storagePrefix}-tab-${crypto.randomUUID()}`,
+        subductionWebsocketEndpoints: [syncServer.url],
+        subductionAdapters: siblingAdapters(),
+        enableRemoteHeadsGossiping: true,
     });
     const signerIdentity = {
         peerId: signer.peerId().toString(),
@@ -71,41 +74,3 @@ export async function createRepo(workerAdapter) {
     log("repo created, tab subduction identity:", signerIdentity);
     return { repo, signerIdentity };
 }
-/**
- * Resolve with the first repo port the worker delivers, calling `onRenewed` for
- * every later one.
- *
- * subscribeToRepoChannel is deliberately not awaited: it resolves only after
- * the boot channel's port-ready handshake, which can take its full 30s timeout
- * against a stranded worker connection. Boot blocks on the first *delivered*
- * port instead — if the boot channel stalls, worker recovery hands the listener
- * a good port long before that timeout.
- */
-export function firstRepoPort(sw, onRenewed) {
-    return new Promise((resolve) => {
-        let seen = false;
-        void sw.subscribeToRepoChannel((port) => {
-            if (seen)
-                return onRenewed(port);
-            seen = true;
-            resolve(port);
-        });
-    });
-}
-/** Drop the adapter sitting on the dead worker port, leaving `keep` in place. */
-export function removeAdapterFor(repo, stale, keep) {
-    for (const adapter of [...repo.networkSubsystem.adapters]) {
-        if (adapter === keep)
-            continue;
-        // The keyhive wrapper keeps the wrapped adapter on `.networkAdapter`.
-        const base = adapter.networkAdapter ?? adapter;
-        if (base !== stale)
-            continue;
-        try {
-            repo.networkSubsystem.removeNetworkAdapter(adapter);
-        }
-        catch (err) {
-            console.error("failed to remove stale worker network adapter", err);
-        }
-    }
-}

package/dist/site-kit/sync-servers.js

@@ -1,7 +1,8 @@
 // Mirrors core/bootloader/src/sync-config.ts's DEFAULT_CLASSIC_SYNC_SERVER
-// and automerge-worker.ts's SUBDUCTION_SYNC_URL selection — kept here as
-// plain constants (rather than importing those runtime modules) since this
-// only needs the hostnames, not the browser-only logic that reads them.
+// and automerge-protocol-handler-worker.ts's SUBDUCTION_SYNC_URL selection —
+// kept here as plain constants (rather than importing those runtime modules)
+// since this only needs the hostnames, not the browser-only logic that reads
+// them.
 export const DEFAULT_SYNC_SERVERS = {
     classic: "wss://sync3.automerge.org",
     subduction: "wss://subduction.sync.inkandswitch.com",

package/dist/types.d.ts

@@ -2,16 +2,26 @@ import type { AutomergeUrl, DocHandle, Repo } from "@automerge/vanillajs/slim";
 import type { AutomergeRepoKeyhiveBase as AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
 import type { ModuleWatcher, HasPatchworkMetadata } from "@inkandswitch/patchwork-filesystem";
 import type { AccountCreator, AccountDoc } from "@inkandswitch/patchwork-plugins";
-import type { ServiceWorkerRepoChannelListener, SyncStateDocMessage } from "@inkandswitch/patchwork-bootloader/types";
 import type * as pluginsNS from "@inkandswitch/patchwork-plugins";
 export type PluginsApi = typeof pluginsNS;
 export type SignerIdentity = {
     peerId: string;
     verifyingKey: string;
 };
+/** The sync server's last-known heads for one document, as it reports them. */
+export interface SyncStateDocMessage {
+    type: "sync-state";
+    documentId: string;
+    storageId: string;
+    heads: string[];
+    timestamp: number;
+}
 export interface ServiceWorkerApi {
     connectClassicSync: (server?: string) => Promise<void>;
-    subscribeToRepoChannel: (listener: ServiceWorkerRepoChannelListener) => Promise<() => void>;
+    /**
+     * Watch one document's heads at the sync server. Calls `listener` with
+     * what the server holds now, then on every update. Returns unsubscribe.
+     */
     subscribeSyncState: (documentId: string, listener: (update: SyncStateDocMessage) => void) => () => void;
 }
 export interface OpenOptions {
@@ -70,7 +80,8 @@ export interface PatchworkOptions {
     /**
      * Bring your own Repo. When provided, setup skips wasm initialization and
      * repo creation entirely — you are responsible for having initialized
-     * automerge/subduction and wired the automerge-worker port yourself.
+     * automerge/subduction and wired the automerge-protocol-handler-worker
+     * port yourself.
      */
     repo?: Repo;
     /** The keyhive instance accompanying a provided {@link PatchworkOptions.repo}. */

package/dist/vite/config-plugin.js

@@ -69,11 +69,11 @@ export function config(options = {}) {
                 },
             };
         },
-        // The shared automerge-worker's chunk imports bypass the page's service
-        // worker, so offline boot needs the browser's HTTP cache to serve them
-        // without revalidating. Content hashes make that safe; a new build gets
-        // new URLs. Production gets this from the generated _headers file — vite
-        // preview doesn't read that, so mirror it here.
+        // The shared automerge-protocol-handler-worker's chunk imports bypass the
+        // page's service worker, so offline boot needs the browser's HTTP cache to
+        // serve them without revalidating. Content hashes make that safe; a new
+        // build gets new URLs. Production gets this from the generated _headers
+        // file — vite preview doesn't read that, so mirror it here.
         configurePreviewServer(server) {
             if (options.netlify === false ||
                 options.netlify?.immutableAssets === false) {

package/dist/vite/service-worker-plugin.js

@@ -16,8 +16,8 @@ export const workers = [
         fileName: "service-worker.js",
     },
     {
-        specifier: "@inkandswitch/patchwork-bootloader/automerge-worker",
-        fileName: "automerge-worker.js",
+        specifier: "@inkandswitch/patchwork-bootloader/automerge-protocol-handler-worker",
+        fileName: "automerge-protocol-handler-worker.js",
     },
     {
         specifier: "@inkandswitch/patchwork-bootloader/module-loader-worker",

package/package.json

@@ -5,7 +5,7 @@
     "url": "git+https://github.com/inkandswitch/patchwork-system.git",
     "directory": "core/patchwork"
   },
-  "version": "0.7.4",
+  "version": "0.8.0",
   "author": "Ink & Switch",
   "type": "module",
   "license": "MIT",
@@ -72,7 +72,7 @@
     "./global.css": "./dist/global.css"
   },
   "dependencies": {
-    "@automerge/automerge": "3.3.2",
+    "@automerge/automerge": "3.4.1",
     "@automerge/automerge-repo": "2.6.0-subduction.48",
     "@automerge/automerge-repo-keyhive": "0.5.0-alpha.7",
     "@automerge/automerge-repo-storage-indexeddb": "2.6.0-subduction.48",
@@ -83,11 +83,11 @@
     "esbuild": "^0.23.1",
     "sharp": "^0.35.3",
     "vite-plugin-wasm": "^3.6.0",
-    "@inkandswitch/patchwork-bootloader": "^0.6.3",
-    "@inkandswitch/patchwork-elements": "^6.0.2",
-    "@inkandswitch/patchwork-filesystem": "^0.2.8",
-    "@inkandswitch/patchwork-plugins": "^1.2.3",
-    "@inkandswitch/patchwork-providers": "^0.5.2"
+    "@inkandswitch/patchwork-bootloader": "^0.7.0",
+    "@inkandswitch/patchwork-filesystem": "^0.2.9",
+    "@inkandswitch/patchwork-plugins": "^1.2.4",
+    "@inkandswitch/patchwork-providers": "^0.5.2",
+    "@inkandswitch/patchwork-elements": "^6.0.2"
   },
   "devDependencies": {
     "rollup": "^4.61.1",

package/src/index.ts

@@ -1,8 +1,9 @@
 /**
  * One import for a Patchwork site.
  *
- * `setup(options)` constructs the Repo, wires up the automerge-worker port,
- * loads plugins via the ModuleWatcher, resolves the user's account document,
+ * `setup(options)` constructs the Repo, wires up the
+ * automerge-protocol-handler-worker port, loads plugins via the
+ * ModuleWatcher, resolves the user's account document,
  * installs the router, and resolves with the site's runtime API — `repo`,
  * `create`, `open`, `find`, `packages`, `plugins`, `sw` — which is what a
  * site assigns to `window.patchwork`.
@@ -15,12 +16,13 @@
  * Pulls in DOM- and plugin-layer dependencies, so it is for a browser site's
  * `main.ts` only. Non-UI consumers should import
  * `@inkandswitch/patchwork-bootloader` directly, which does SW registration
- * and the automerge-worker handoff and nothing else.
+ * and the automerge-protocol-handler-worker handoff and nothing else.
  */
 import {
   type AutomergeUrl,
   type DocHandle,
-  MessageChannelNetworkAdapter,
+  type DocumentId,
+  type StorageId,
   Repo,
 } from "@automerge/vanillajs/slim";
 import * as Automerge from "@automerge/automerge/slim";
@@ -52,13 +54,9 @@ import type {
   Patchwork,
   PatchworkOptions,
   SignerIdentity,
+  SyncStateDocMessage,
 } from "./types.js";
-import {
-  createRepo,
-  firstRepoPort,
-  initWasm,
-  removeAdapterFor,
-} from "./repo.js";
+import { createRepo, initWasm } from "./repo.js";
 import { createRouter, type Router } from "./router.js";
 import { createDefaultAccount } from "./createAccount.js";
 
@@ -130,46 +128,13 @@ async function doSetup(options: PatchworkOptions): Promise<Patchwork> {
   let hive: AutomergeRepoKeyhive | undefined;
   let repo: Repo;
   let signerIdentity: SignerIdentity | undefined;
-  // Called with a fresh port when the automerge worker dies and is recreated.
-  // Assigned once the repo exists.
-  let onWorkerPortRenewed: ((port: MessagePort) => void) | undefined;
 
   if (options.repo) {
     log("using provided Repo");
     repo = options.repo;
     hive = options.hive;
   } else {
-    const workerPort = await firstRepoPort(sw, (port) => {
-      if (onWorkerPortRenewed) onWorkerPortRenewed(port);
-      else {
-        console.warn(
-          "automerge worker port renewed before the repo existed; dropping it"
-        );
-      }
-    });
-
-    let workerAdapter = new MessageChannelNetworkAdapter(workerPort);
-    ({ repo, hive, signerIdentity } = await createRepo(workerAdapter));
-
-    // The worker was recreated with cold state: wire the repo onto the fresh
-    // port and drop the adapter stranded on the dead one.
-    const bootHive = hive;
-    onWorkerPortRenewed = (port) => {
-      const fresh = new MessageChannelNetworkAdapter(port);
-      // Mirror the boot wiring: a keyhive repo talks to the worker through a
-      // keyhive adapter wrapped around the message channel.
-      const registered = bootHive
-        ? bootHive.createKeyhiveNetworkAdapter(fresh, {
-            onlyShareWithSyncServer: false,
-            periodicallyRequestSync: false,
-            syncRequestInterval: 2000,
-          })
-        : fresh;
-      repo.networkSubsystem.addNetworkAdapter(registered as any);
-      removeAdapterFor(repo, workerAdapter, registered);
-      workerAdapter = fresh;
-      lifecycleLog("repo re-wired to the recreated automerge worker");
-    };
+    ({ repo, hive, signerIdentity } = await createRepo());
   }
 
   // Dev-console / tool-runtime globals (e2e and loaded tools read these). The
@@ -181,8 +146,6 @@ async function doSetup(options: PatchworkOptions): Promise<Patchwork> {
     AutomergeRepo as typeof import("@automerge/automerge-repo");
   if (hive) window.hive = hive;
 
-  await repo.networkSubsystem.whenReady();
-  log("networkSubsystem ready");
   (hive?.networkAdapter as any)?.syncKeyhive?.();
 
   registerRepoProviderElement(repo as any);
@@ -261,8 +224,8 @@ async function doSetup(options: PatchworkOptions): Promise<Patchwork> {
     plugins,
     sw: {
       connectClassicSync: sw.connectClassicSync,
-      subscribeToRepoChannel: sw.subscribeToRepoChannel,
-      subscribeSyncState: sw.subscribeSyncState,
+      subscribeSyncState: (documentId, listener) =>
+        subscribeSyncState(repo, documentId, listener),
     },
 
     async create<D>(type: string, init?: (doc: D) => void) {
@@ -433,6 +396,50 @@ function installLifecycleLogging(): void {
   );
 }
 
+// The tab's own Repo hears the server's heads directly, so this is a filter
+// over its `subduction-remote-heads` event. The current value is replayed
+// from the handle's sync info, when the server has reported any.
+function subscribeSyncState(
+  repo: Repo,
+  documentId: string,
+  listener: (update: SyncStateDocMessage) => void
+): () => void {
+  const onHeads = (payload: {
+    documentId: string;
+    storageId: string;
+    heads: readonly string[];
+    timestamp: number;
+  }) => {
+    if (payload.documentId !== documentId) return;
+    listener({
+      type: "sync-state",
+      documentId,
+      storageId: payload.storageId,
+      heads: [...payload.heads],
+      timestamp: payload.timestamp,
+    });
+  };
+  repo.on("subduction-remote-heads", onHeads);
+
+  void (async () => {
+    const handle = repo.handles[documentId as DocumentId];
+    if (!handle) return;
+    for (const storageId of await repo.connectedSubductionPeerIds()) {
+      const info = handle.getSyncInfo(storageId as StorageId);
+      if (info) {
+        onHeads({
+          documentId,
+          storageId,
+          heads: info.lastHeads,
+          timestamp: info.lastSyncTimestamp,
+        });
+      }
+    }
+  })();
+
+  return () => repo.off("subduction-remote-heads", onHeads);
+}
+
 // ── Named exports ────────────────────────────────────────────────────────
 
 export { createRepo, initWasm } from "./repo.js";
@@ -448,4 +455,5 @@ export type {
   PatchworkOptions,
   ServiceWorkerApi,
   SignerIdentity,
+  SyncStateDocMessage,
 } from "./types.js";

package/src/repo.ts

@@ -1,22 +1,17 @@
-import {
-  initializeWasm,
-  MessageChannelNetworkAdapter,
-  Repo,
-  type AutomergeUrl,
-} from "@automerge/vanillajs/slim";
+import { initializeWasm, Repo } from "@automerge/vanillajs/slim";
 import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
+import { siblingAdapters } from "@inkandswitch/patchwork-bootloader/siblings";
 import * as AutomergeRepo from "@automerge/automerge-repo/slim";
 import {
   initKeyhiveWasm,
-  initializeLegacyAutomergeRepoKeyhive,
-  type AutomergeRepoKeyhiveBase,
+  initializeAutomergeRepoKeyhive,
+  type AutomergeRepoKeyhive,
   type SyncServerSelection,
 } from "@automerge/automerge-repo-keyhive";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
 import { MemorySigner } from "@automerge/automerge-subduction/slim";
-import setupServiceWorker from "@inkandswitch/patchwork-bootloader";
 import {
   keyhiveStorageName,
   storagePrefix,
@@ -53,28 +48,33 @@ export function initWasm(): Promise<void> {
   return wasmReady;
 }
 
-export async function createRepo(
-  workerAdapter: MessageChannelNetworkAdapter
-): Promise<{
+export type TabRepo = {
   repo: Repo;
-  hive?: AutomergeRepoKeyhiveBase;
+  hive?: AutomergeRepoKeyhive;
   signerIdentity?: SignerIdentity;
-}> {
+};
+
+/**
+ * The tab's own node: this origin's IndexedDB, a socket to the sync server,
+ * and the siblings channel to every other Repo on the origin. Nothing is
+ * shared with other tabs except the database underneath.
+ */
+export async function createRepo(): Promise<TabRepo> {
   if (syncServer.keyhive) {
     log("setting up keyhive");
     initKeyhiveWasm();
-    const { hive, repo } = await initializeLegacyAutomergeRepoKeyhive({
+    const { hive, repo } = await initializeAutomergeRepoKeyhive({
       createRepo: (repoConfig) => new Repo(repoConfig),
       storage: new IndexedDBWorkerStorageAdapter(keyhiveStorageName),
       peerIdSuffix: storagePrefix + Math.random().toString(36).slice(2),
-      networkAdapter: workerAdapter,
       automaticArchiveIngestion: true,
       cachingMode: "periodic",
-      onlyShareWithSyncServer: false,
       // ARK selects the relay via `syncServer`, defaulting to "subduction".
       syncServer: syncServer.keyhive,
       repo: {
         storage: new IndexedDBWorkerStorageAdapter(),
+        subductionWebsocketEndpoints: [syncServer.url],
+        subductionAdapters: siblingAdapters(),
         enableRemoteHeadsGossiping: true,
       },
     });
@@ -82,20 +82,17 @@ export async function createRepo(
     return { repo, hive };
   }
 
-  // An explicit signer, rather than the Repo's internal default, so the tab's
-  // identity can be exposed on window.patchwork. The tab never connects via
-  // Subduction, so this id never goes on the wire.
+  // The signer is explicit rather than the Repo's internal default so the
+  // identity the tab presents to the server can be shown on window.patchwork.
   const signer = new MemorySigner();
   const repo = new Repo({
-    network: [workerAdapter],
-    storage: new IndexedDBWorkerStorageAdapter(),
     signer,
-    async sharePolicy(peerId) {
-      return peerId.includes("automerge-worker");
-    },
-    enableRemoteHeadsGossiping: true,
+    storage: new IndexedDBWorkerStorageAdapter(),
     peerId:
       `${storagePrefix}-tab-${crypto.randomUUID()}` as AutomergeRepo.PeerId,
+    subductionWebsocketEndpoints: [syncServer.url],
+    subductionAdapters: siblingAdapters(),
+    enableRemoteHeadsGossiping: true,
   });
   const signerIdentity = {
     peerId: signer.peerId().toString(),
@@ -108,46 +105,3 @@ export async function createRepo(
   log("repo created, tab subduction identity:", signerIdentity);
   return { repo, signerIdentity };
 }
-
-/**
- * Resolve with the first repo port the worker delivers, calling `onRenewed` for
- * every later one.
- *
- * subscribeToRepoChannel is deliberately not awaited: it resolves only after
- * the boot channel's port-ready handshake, which can take its full 30s timeout
- * against a stranded worker connection. Boot blocks on the first *delivered*
- * port instead — if the boot channel stalls, worker recovery hands the listener
- * a good port long before that timeout.
- */
-export function firstRepoPort(
-  sw: Awaited<ReturnType<typeof setupServiceWorker>>,
-  onRenewed: (port: MessagePort) => void
-): Promise<MessagePort> {
-  return new Promise<MessagePort>((resolve) => {
-    let seen = false;
-    void sw.subscribeToRepoChannel((port) => {
-      if (seen) return onRenewed(port);
-      seen = true;
-      resolve(port);
-    });
-  });
-}
-
-/** Drop the adapter sitting on the dead worker port, leaving `keep` in place. */
-export function removeAdapterFor(
-  repo: Repo,
-  stale: MessageChannelNetworkAdapter,
-  keep: unknown
-): void {
-  for (const adapter of [...repo.networkSubsystem.adapters]) {
-    if (adapter === keep) continue;
-    // The keyhive wrapper keeps the wrapped adapter on `.networkAdapter`.
-    const base = (adapter as any).networkAdapter ?? adapter;
-    if (base !== stale) continue;
-    try {
-      repo.networkSubsystem.removeNetworkAdapter(adapter as any);
-    } catch (err) {
-      console.error("failed to remove stale worker network adapter", err);
-    }
-  }
-}

package/src/site-kit/sync-servers.ts

@@ -2,9 +2,10 @@ import type { PatchworkSiteOptions } from "./options.js";
 import type { SyncServerSelection } from "@automerge/automerge-repo-keyhive";
 
 // Mirrors core/bootloader/src/sync-config.ts's DEFAULT_CLASSIC_SYNC_SERVER
-// and automerge-worker.ts's SUBDUCTION_SYNC_URL selection — kept here as
-// plain constants (rather than importing those runtime modules) since this
-// only needs the hostnames, not the browser-only logic that reads them.
+// and automerge-protocol-handler-worker.ts's SUBDUCTION_SYNC_URL selection —
+// kept here as plain constants (rather than importing those runtime modules)
+// since this only needs the hostnames, not the browser-only logic that reads
+// them.
 export const DEFAULT_SYNC_SERVERS = {
   classic: "wss://sync3.automerge.org",
   subduction: "wss://subduction.sync.inkandswitch.com",

package/src/types.ts

@@ -8,21 +8,27 @@ import type {
   AccountCreator,
   AccountDoc,
 } from "@inkandswitch/patchwork-plugins";
-import type {
-  ServiceWorkerRepoChannelListener,
-  SyncStateDocMessage,
-} from "@inkandswitch/patchwork-bootloader/types";
 import type * as pluginsNS from "@inkandswitch/patchwork-plugins";
 
 export type PluginsApi = typeof pluginsNS;
 
 export type SignerIdentity = { peerId: string; verifyingKey: string };
 
+/** The sync server's last-known heads for one document, as it reports them. */
+export interface SyncStateDocMessage {
+  type: "sync-state";
+  documentId: string;
+  storageId: string;
+  heads: string[];
+  timestamp: number;
+}
+
 export interface ServiceWorkerApi {
   connectClassicSync: (server?: string) => Promise<void>;
-  subscribeToRepoChannel: (
-    listener: ServiceWorkerRepoChannelListener
-  ) => Promise<() => void>;
+  /**
+   * Watch one document's heads at the sync server. Calls `listener` with
+   * what the server holds now, then on every update. Returns unsubscribe.
+   */
   subscribeSyncState: (
     documentId: string,
     listener: (update: SyncStateDocMessage) => void
@@ -91,7 +97,8 @@ export interface PatchworkOptions {
   /**
    * Bring your own Repo. When provided, setup skips wasm initialization and
    * repo creation entirely — you are responsible for having initialized
-   * automerge/subduction and wired the automerge-worker port yourself.
+   * automerge/subduction and wired the automerge-protocol-handler-worker
+   * port yourself.
    */
   repo?: Repo;
 

package/src/vite/config-plugin.ts

@@ -40,9 +40,7 @@ export function buildDefines(
  * used to hand-write in its own vite.config.ts. Each is switched off
  * individually via the matching `false` option.
  */
-export function config(
-  options: PatchworkVitePluginOptions = {}
-): Plugin {
+export function config(options: PatchworkVitePluginOptions = {}): Plugin {
   return {
     name: "@patchwork/config",
     config() {
@@ -87,11 +85,11 @@ export function config(
         },
       };
     },
-    // The shared automerge-worker's chunk imports bypass the page's service
-    // worker, so offline boot needs the browser's HTTP cache to serve them
-    // without revalidating. Content hashes make that safe; a new build gets
-    // new URLs. Production gets this from the generated _headers file — vite
-    // preview doesn't read that, so mirror it here.
+    // The shared automerge-protocol-handler-worker's chunk imports bypass the
+    // page's service worker, so offline boot needs the browser's HTTP cache to
+    // serve them without revalidating. Content hashes make that safe; a new
+    // build gets new URLs. Production gets this from the generated _headers
+    // file — vite preview doesn't read that, so mirror it here.
     configurePreviewServer(server) {
       if (
         options.netlify === false ||
@@ -101,10 +99,7 @@ export function config(
       }
       server.middlewares.use((req, res, next) => {
         if (req.url?.startsWith("/assets/")) {
-          res.setHeader(
-            "Cache-Control",
-            "public, max-age=31536000, immutable"
-          );
+          res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
         }
         next();
       });

package/src/vite/service-worker-plugin.ts

@@ -19,8 +19,9 @@ export const workers = [
     fileName: "service-worker.js",
   },
   {
-    specifier: "@inkandswitch/patchwork-bootloader/automerge-worker",
-    fileName: "automerge-worker.js",
+    specifier:
+      "@inkandswitch/patchwork-bootloader/automerge-protocol-handler-worker",
+    fileName: "automerge-protocol-handler-worker.js",
   },
   {
     specifier: "@inkandswitch/patchwork-bootloader/module-loader-worker",