@inkandswitch/patchwork 0.7.4 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @inkandswitch/patchwork
 
+## 0.8.1
+
+### Patch Changes
+
+- 5462610: Apply Patchwork's automerge-repo source patches at bundle time, so a site that installs `@inkandswitch/patchwork` gets them. They were only a pnpm patch, which exists in this repo's node_modules and nowhere else, so every consumer bundled an automerge-repo without the `mesh` subduction role or the `awaiting-reconnect` fix to `isConnecting()`.
+
+  The new `patches` plugin is part of `patchwork()` and also exported on its own. It rewrites the two files as they pass through rollup, and registers the same rewrite as an esbuild plugin for dep pre-bundling, which runs outside the plugin pipeline. It is pinned to one automerge-repo version and every anchor has to match, so bumping the dependency fails the build rather than quietly dropping the patches. A copy that already carries the edits — this repo's, via the pnpm patch — is left alone.
+
+- 5462610: Move keyhive out of `syncServers` and into its own top-level site option: `keyhive?: boolean | { syncServer?, useIdFactory? }`. `keyhive: true` enables it against the `"subduction"` relay; the object form picks a different relay (or a custom `{url, contactCardJson, peerId}` identity) and turns individual behaviour off. `keyhive.useIdFactory: false` drops the `idFactory` ARK injects into the repo config, so document ids are generated the Repo's own way instead of derived from keyhive. It reaches both the tab repo and the automerge protocol handler worker through the `__SYNC_SERVER__` define.
+
+  `syncServers` is now just URLs — `subduction` and `classic`, no longer mutually exclusive with anything. Sites passing `syncServers: { keyhive: X }` should pass `keyhive: { syncServer: X }` instead; `syncServers.subduction` still overrides the URL a named relay implies.
+
+- 5462610: Persist the Subduction signer so every context on an origin presents the same identity. The seed lives in the shared IndexedDB, so tabs and the automerge protocol handler worker adopt one signer instead of each minting a fresh `MemorySigner` on load. Generating it takes a Web Lock, so a cold profile opening two contexts at once still settles on one seed.
+
+  `@inkandswitch/patchwork-bootloader/signer` is a new export: `loadOrCreateSigner(storage)` returns the origin's `MemorySigner`, generating and storing a seed the first time.
+
+- Updated dependencies [5462610]
+- Updated dependencies [5462610]
+  - @inkandswitch/patchwork-bootloader@0.7.1
+
+## 0.8.0
+
+### Minor Changes
+
+- 2e71745: Every Repo on the origin is its own Subduction node. A tab holds this origin's IndexedDB, keeps its own WebSocket to the sync server, and meets the other tabs over a BroadcastChannel carrying Subduction (`siblingAdapters()` in `@inkandswitch/patchwork-bootloader/siblings`, passed to `new Repo({ subductionAdapters })`). The automerge SharedWorker no longer sits between tabs and storage — it is one more such node, kept only to resolve `automerge:` URLs for the service worker, which can't own a Repo itself. The websocket proxy worker is gone with it.
+
+  Benchmarked against the shared-worker arrangement (`sites/bench`): boot and memory are a wash or better, cross-tab propagation matches, and two shared-worker failures go away — a `find()` racing a sibling's `create()` settled as unavailable, and edits made just before a tab closed were lost, since a storageless tab had nothing to flush to. Each tab flushing its own IndexedDB closes both.
+
+  Keyhive sites use the subduction-backed hive in both the tab and the worker, each talking to the sync server directly.
+
+  `patchwork.sw.subscribeSyncState(documentId, listener)` stays, now a filter over the tab's own Repo's `subduction-remote-heads` event, replaying the server's current heads from `handle.getSyncInfo()` on subscribe; `SyncStateDocMessage` is exported from `@inkandswitch/patchwork`. Removed from `setupServiceWorker()`'s result: `subscribeToRepoChannel`, `getRepoChannel`, `subscribeSyncState`. The `@patchwork/syncstate` BroadcastChannel and the other `SyncState*` message types are gone too; a tab's own Repo has what they carried — `repo.isSubductionConnected()` and the `subduction-connection` event for the link, `repo.connectedSubductionPeerIds()` for which peers are the server, and `patchwork.signerIdentity` for this tab's peer id. `createRepo` in `@inkandswitch/patchwork` takes no arguments.
+
+  `@inkandswitch/patchwork-bootloader` depends on `@automerge/automerge-repo-network-broadcastchannel`, which is also on the importmap.
+
+  That worker is renamed for what it now does: `@inkandswitch/patchwork-bootloader/automerge-worker` is now `@inkandswitch/patchwork-bootloader/automerge-protocol-handler-worker`, emitted as `automerge-protocol-handler-worker.js` (the `workerPath` option on `setupServiceWorker` still overrides it), and `getAutomergeWorker()` is now `getAutomergeProtocolHandlerWorker()`.
+
+  Inter-tab sync is Subduction, not classic automerge sync. `connectSiblings(repo, hive)` is replaced by `siblingAdapters()`, which returns the `subductionAdapters` entries for a Repo rather than mutating one after the fact, so it is passed to the `Repo` constructor. The frames on the siblings BroadcastChannel are Subduction transport frames authenticated by each node's own signer; the keyhive network adapter no longer wraps that channel, since keyhive material reaches siblings the same way it reaches the sync server. The one remaining classic-sync path is the opt-in classic sync server the protocol handler worker connects to on request.
+
+  Subduction's handshake has an initiator and a responder, and a BroadcastChannel is a mesh, so the siblings adapter is passed with `role: "mesh"`, added to the automerge-repo fork's `subductionAdapters` by this repo's pnpm patch: for each pair of peers on the adapter, the one whose peer id sorts lower initiates the handshake and the other accepts.
+
+### Patch Changes
+
+- 47bc4cf: `@automerge/automerge` goes to `3.4.1`, and `@automerge/automerge-repo-network-broadcastchannel` joins the automerge-repo family at `2.6.0-subduction.48`.
+- Updated dependencies [47bc4cf]
+- Updated dependencies [2e71745]
+  - @inkandswitch/patchwork-bootloader@0.7.0
+  - @inkandswitch/patchwork-filesystem@0.2.9
+  - @inkandswitch/patchwork-plugins@1.2.4
+
 ## 0.7.4
 
 ### Patch Changes

package/dist/head.js

@@ -6,11 +6,7 @@
     "@automerge/automerge/slim",
     "@automerge/automerge-repo",
     "@automerge/automerge-repo/slim",
-    // Port-donation plumbing for WorkerWebSocketEndpoint: tabs spawn the shared
-    // proxy entry and donate its port to the automerge worker (Chrome can't
-    // spawn workers from inside a SharedWorker). See setup.ts/automerge-worker.ts.
-    "@automerge/automerge-repo/worker-port",
-    "@automerge/automerge-repo/subduction-websocket-worker-shared",
+    "@automerge/automerge-repo-network-broadcastchannel",
     "@automerge/automerge-repo-network-messagechannel",
     "@automerge/automerge-repo-network-websocket",
     "@automerge/automerge-repo-storage-indexeddb",

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 /**
  * One import for a Patchwork site.
  *
- * `setup(options)` constructs the Repo, wires up the automerge-worker port,
- * loads plugins via the ModuleWatcher, resolves the user's account document,
+ * `setup(options)` constructs the Repo, wires up the
+ * automerge-protocol-handler-worker port, loads plugins via the
+ * ModuleWatcher, resolves the user's account document,
  * installs the router, and resolves with the site's runtime API — `repo`,
  * `create`, `open`, `find`, `packages`, `plugins`, `sw` — which is what a
  * site assigns to `window.patchwork`.
@@ -15,7 +16,7 @@
  * Pulls in DOM- and plugin-layer dependencies, so it is for a browser site's
  * `main.ts` only. Non-UI consumers should import
  * `@inkandswitch/patchwork-bootloader` directly, which does SW registration
- * and the automerge-worker handoff and nothing else.
+ * and the automerge-protocol-handler-worker handoff and nothing else.
  */
 import { Repo } from "@automerge/vanillajs/slim";
 import type { AutomergeRepoKeyhiveBase as AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
@@ -34,4 +35,4 @@ export default setup;
 export { createRepo, initWasm } from "./repo.js";
 export { createRouter } from "./router.js";
 export { showLoadingAnimation, hideLoadingAnimation, showErrorScreen, } from "./loading.js";
-export type { OpenOptions, Patchwork, PatchworkOptions, ServiceWorkerApi, SignerIdentity, } from "./types.js";
+export type { OpenOptions, Patchwork, PatchworkOptions, ServiceWorkerApi, SignerIdentity, SyncStateDocMessage, } from "./types.js";

package/dist/index.js

@@ -1,23 +1,3 @@
-/**
- * One import for a Patchwork site.
- *
- * `setup(options)` constructs the Repo, wires up the automerge-worker port,
- * loads plugins via the ModuleWatcher, resolves the user's account document,
- * installs the router, and resolves with the site's runtime API — `repo`,
- * `create`, `open`, `find`, `packages`, `plugins`, `sw` — which is what a
- * site assigns to `window.patchwork`.
- *
- * Setup owns page-wide state — the `window.repo`/`window.Automerge`/
- * `window.AutomergeRepo`/`window.hive` globals, custom-element registration,
- * document listeners — so it may run only once per page; a second call
- * throws.
- *
- * Pulls in DOM- and plugin-layer dependencies, so it is for a browser site's
- * `main.ts` only. Non-UI consumers should import
- * `@inkandswitch/patchwork-bootloader` directly, which does SW registration
- * and the automerge-worker handoff and nothing else.
- */
-import { MessageChannelNetworkAdapter, } from "@automerge/vanillajs/slim";
 import * as Automerge from "@automerge/automerge/slim";
 import * as AutomergeRepo from "@automerge/automerge-repo/slim";
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
@@ -28,7 +8,7 @@ import { createDocOfDatatype2, getRegistry, registerPlugins, resolveAccountHandl
 import * as plugins from "@inkandswitch/patchwork-plugins";
 import setupServiceWorker, { lifecycleLog, } from "@inkandswitch/patchwork-bootloader";
 import debug from "debug";
-import { createRepo, firstRepoPort, initWasm, removeAdapterFor, } from "./repo.js";
+import { createRepo, initWasm } from "./repo.js";
 import { createRouter } from "./router.js";
 import { createDefaultAccount } from "./createAccount.js";
 const log = debug("patchwork:setup");
@@ -68,43 +48,13 @@ async function doSetup(options) {
     let hive;
     let repo;
     let signerIdentity;
-    // Called with a fresh port when the automerge worker dies and is recreated.
-    // Assigned once the repo exists.
-    let onWorkerPortRenewed;
     if (options.repo) {
         log("using provided Repo");
         repo = options.repo;
         hive = options.hive;
     }
     else {
-        const workerPort = await firstRepoPort(sw, (port) => {
-            if (onWorkerPortRenewed)
-                onWorkerPortRenewed(port);
-            else {
-                console.warn("automerge worker port renewed before the repo existed; dropping it");
-            }
-        });
-        let workerAdapter = new MessageChannelNetworkAdapter(workerPort);
-        ({ repo, hive, signerIdentity } = await createRepo(workerAdapter));
-        // The worker was recreated with cold state: wire the repo onto the fresh
-        // port and drop the adapter stranded on the dead one.
-        const bootHive = hive;
-        onWorkerPortRenewed = (port) => {
-            const fresh = new MessageChannelNetworkAdapter(port);
-            // Mirror the boot wiring: a keyhive repo talks to the worker through a
-            // keyhive adapter wrapped around the message channel.
-            const registered = bootHive
-                ? bootHive.createKeyhiveNetworkAdapter(fresh, {
-                    onlyShareWithSyncServer: false,
-                    periodicallyRequestSync: false,
-                    syncRequestInterval: 2000,
-                })
-                : fresh;
-            repo.networkSubsystem.addNetworkAdapter(registered);
-            removeAdapterFor(repo, workerAdapter, registered);
-            workerAdapter = fresh;
-            lifecycleLog("repo re-wired to the recreated automerge worker");
-        };
+        ({ repo, hive, signerIdentity } = await createRepo());
     }
     // Dev-console / tool-runtime globals (e2e and loaded tools read these). The
     // `window.patchwork` handle is deliberately not set here — the caller does
@@ -115,8 +65,6 @@ async function doSetup(options) {
         AutomergeRepo;
     if (hive)
         window.hive = hive;
-    await repo.networkSubsystem.whenReady();
-    log("networkSubsystem ready");
     hive?.networkAdapter?.syncKeyhive?.();
     registerRepoProviderElement(repo);
     const rootElementId = options.rootElementId ?? "root";
@@ -172,8 +120,7 @@ async function doSetup(options) {
         plugins,
         sw: {
             connectClassicSync: sw.connectClassicSync,
-            subscribeToRepoChannel: sw.subscribeToRepoChannel,
-            subscribeSyncState: sw.subscribeSyncState,
+            subscribeSyncState: (documentId, listener) => subscribeSyncState(repo, documentId, listener),
         },
         async create(type, init) {
             const datatype = await getRegistry("patchwork:datatype").load(type);
@@ -283,6 +230,40 @@ function installLifecycleLogging() {
     window.addEventListener("offline", () => lifecycleLog("offline"), opts);
     lifecycleLog("logging installed (visibilityState=%s, hasFocus=%s)", document.visibilityState, document.hasFocus());
 }
+// The tab's own Repo hears the server's heads directly, so this is a filter
+// over its `subduction-remote-heads` event. The current value is replayed
+// from the handle's sync info, when the server has reported any.
+function subscribeSyncState(repo, documentId, listener) {
+    const onHeads = (payload) => {
+        if (payload.documentId !== documentId)
+            return;
+        listener({
+            type: "sync-state",
+            documentId,
+            storageId: payload.storageId,
+            heads: [...payload.heads],
+            timestamp: payload.timestamp,
+        });
+    };
+    repo.on("subduction-remote-heads", onHeads);
+    void (async () => {
+        const handle = repo.handles[documentId];
+        if (!handle)
+            return;
+        for (const storageId of await repo.connectedSubductionPeerIds()) {
+            const info = handle.getSyncInfo(storageId);
+            if (info) {
+                onHeads({
+                    documentId,
+                    storageId,
+                    heads: info.lastHeads,
+                    timestamp: info.lastSyncTimestamp,
+                });
+            }
+        }
+    })();
+    return () => repo.off("subduction-remote-heads", onHeads);
+}
 // ── Named exports ────────────────────────────────────────────────────────
 export { createRepo, initWasm } from "./repo.js";
 export { createRouter } from "./router.js";

package/dist/repo.d.ts

@@ -1,23 +1,15 @@
-import { MessageChannelNetworkAdapter, Repo } from "@automerge/vanillajs/slim";
-import { type AutomergeRepoKeyhiveBase } from "@automerge/automerge-repo-keyhive";
-import setupServiceWorker from "@inkandswitch/patchwork-bootloader";
+import { Repo } from "@automerge/vanillajs/slim";
+import { type AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
 import type { SignerIdentity } from "./types.js";
 export declare function initWasm(): Promise<void>;
-export declare function createRepo(workerAdapter: MessageChannelNetworkAdapter): Promise<{
+export type TabRepo = {
     repo: Repo;
-    hive?: AutomergeRepoKeyhiveBase;
+    hive?: AutomergeRepoKeyhive;
     signerIdentity?: SignerIdentity;
-}>;
+};
 /**
- * Resolve with the first repo port the worker delivers, calling `onRenewed` for
- * every later one.
- *
- * subscribeToRepoChannel is deliberately not awaited: it resolves only after
- * the boot channel's port-ready handshake, which can take its full 30s timeout
- * against a stranded worker connection. Boot blocks on the first *delivered*
- * port instead — if the boot channel stalls, worker recovery hands the listener
- * a good port long before that timeout.
+ * The tab's own node: this origin's IndexedDB, a socket to the sync server,
+ * and the siblings channel to every other Repo on the origin. Nothing is
+ * shared with other tabs except the database underneath.
  */
-export declare function firstRepoPort(sw: Awaited<ReturnType<typeof setupServiceWorker>>, onRenewed: (port: MessagePort) => void): Promise<MessagePort>;
-/** Drop the adapter sitting on the dead worker port, leaving `keep` in place. */
-export declare function removeAdapterFor(repo: Repo, stale: MessageChannelNetworkAdapter, keep: unknown): void;
+export declare function createRepo(): Promise<TabRepo>;

package/dist/repo.js

@@ -1,10 +1,11 @@
-import { initializeWasm, Repo, } from "@automerge/vanillajs/slim";
+import { initializeWasm, Repo } from "@automerge/vanillajs/slim";
 import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
-import { initKeyhiveWasm, initializeLegacyAutomergeRepoKeyhive, } from "@automerge/automerge-repo-keyhive";
+import { siblingAdapters } from "@inkandswitch/patchwork-bootloader/siblings";
+import { loadOrCreateSigner } from "@inkandswitch/patchwork-bootloader/signer";
+import { initKeyhiveWasm, initializeAutomergeRepoKeyhive, } from "@automerge/automerge-repo-keyhive";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
-import { MemorySigner } from "@automerge/automerge-subduction/slim";
 import { keyhiveStorageName, storagePrefix, } from "@inkandswitch/patchwork-bootloader/storage";
 import debug from "debug";
 const log = debug("patchwork:setup:repo");
@@ -28,41 +29,49 @@ export function initWasm() {
     }
     return wasmReady;
 }
-export async function createRepo(workerAdapter) {
+/**
+ * The tab's own node: this origin's IndexedDB, a socket to the sync server,
+ * and the siblings channel to every other Repo on the origin. Nothing is
+ * shared with other tabs except the database underneath.
+ */
+export async function createRepo() {
     if (syncServer.keyhive) {
         log("setting up keyhive");
         initKeyhiveWasm();
-        const { hive, repo } = await initializeLegacyAutomergeRepoKeyhive({
-            createRepo: (repoConfig) => new Repo(repoConfig),
+        const { hive, repo } = await initializeAutomergeRepoKeyhive({
+            // ARK injects an `idFactory` deriving document ids from keyhive. A site
+            // can opt out of it with `keyhive: { useIdFactory: false }`.
+            createRepo: ({ idFactory, ...repoConfig }) => new Repo(syncServer.useIdFactory === false
+                ? repoConfig
+                : { ...repoConfig, idFactory }),
             storage: new IndexedDBWorkerStorageAdapter(keyhiveStorageName),
             peerIdSuffix: storagePrefix + Math.random().toString(36).slice(2),
-            networkAdapter: workerAdapter,
             automaticArchiveIngestion: true,
             cachingMode: "periodic",
-            onlyShareWithSyncServer: false,
             // ARK selects the relay via `syncServer`, defaulting to "subduction".
             syncServer: syncServer.keyhive,
             repo: {
                 storage: new IndexedDBWorkerStorageAdapter(),
+                subductionWebsocketEndpoints: [syncServer.url],
+                subductionAdapters: siblingAdapters(),
                 enableRemoteHeadsGossiping: true,
             },
         });
         log("keyhive setup complete");
         return { repo, hive };
     }
-    // An explicit signer, rather than the Repo's internal default, so the tab's
-    // identity can be exposed on window.patchwork. The tab never connects via
-    // Subduction, so this id never goes on the wire.
-    const signer = new MemorySigner();
+    // The signer is explicit rather than the Repo's internal default so that
+    // every tab on this origin signs as the same peer, and so the identity the
+    // tab presents to the server can be shown on window.patchwork.
+    const storage = new IndexedDBWorkerStorageAdapter();
+    const signer = await loadOrCreateSigner(storage);
     const repo = new Repo({
-        network: [workerAdapter],
-        storage: new IndexedDBWorkerStorageAdapter(),
         signer,
-        async sharePolicy(peerId) {
-            return peerId.includes("automerge-worker");
-        },
-        enableRemoteHeadsGossiping: true,
+        storage,
         peerId: `${storagePrefix}-tab-${crypto.randomUUID()}`,
+        subductionWebsocketEndpoints: [syncServer.url],
+        subductionAdapters: siblingAdapters(),
+        enableRemoteHeadsGossiping: true,
     });
     const signerIdentity = {
         peerId: signer.peerId().toString(),
@@ -71,41 +80,3 @@ export async function createRepo(workerAdapter) {
     log("repo created, tab subduction identity:", signerIdentity);
     return { repo, signerIdentity };
 }
-/**
- * Resolve with the first repo port the worker delivers, calling `onRenewed` for
- * every later one.
- *
- * subscribeToRepoChannel is deliberately not awaited: it resolves only after
- * the boot channel's port-ready handshake, which can take its full 30s timeout
- * against a stranded worker connection. Boot blocks on the first *delivered*
- * port instead — if the boot channel stalls, worker recovery hands the listener
- * a good port long before that timeout.
- */
-export function firstRepoPort(sw, onRenewed) {
-    return new Promise((resolve) => {
-        let seen = false;
-        void sw.subscribeToRepoChannel((port) => {
-            if (seen)
-                return onRenewed(port);
-            seen = true;
-            resolve(port);
-        });
-    });
-}
-/** Drop the adapter sitting on the dead worker port, leaving `keep` in place. */
-export function removeAdapterFor(repo, stale, keep) {
-    for (const adapter of [...repo.networkSubsystem.adapters]) {
-        if (adapter === keep)
-            continue;
-        // The keyhive wrapper keeps the wrapped adapter on `.networkAdapter`.
-        const base = adapter.networkAdapter ?? adapter;
-        if (base !== stale)
-            continue;
-        try {
-            repo.networkSubsystem.removeNetworkAdapter(adapter);
-        }
-        catch (err) {
-            console.error("failed to remove stale worker network adapter", err);
-        }
-    }
-}

package/dist/site-kit/index.d.ts

@@ -7,7 +7,7 @@
  * wires these into vite's plugin hooks (dev middleware, emitFile, virtual
  * modules, config()).
  */
-export type { PatchworkSiteOptions, PatchworkIconsOptions, PatchworkHtmlOptions, PatchworkNetlifyOptions, PatchworkKeyhiveSyncServer, PatchworkSyncServersOptions, } from "./options.js";
+export type { PatchworkSiteOptions, PatchworkIconsOptions, PatchworkHtmlOptions, PatchworkNetlifyOptions, PatchworkKeyhiveSyncServer, PatchworkKeyhiveOptions, PatchworkSyncServersOptions, } from "./options.js";
 export { resolveSyncServers, PRELOAD_WASM_ASSETS } from "./sync-servers.js";
 export { getIcons, ICON_SPECS, type IconSpec } from "./icons.js";
 export { buildHtml, escapeHtml } from "./html.js";

package/dist/site-kit/options.d.ts

@@ -31,20 +31,28 @@ export interface PatchworkNetlifyOptions {
     /** Cache-Control: immutable on /assets/*. Default true. */
     immutableAssets?: boolean;
 }
-type PatchworkPrimarySyncServerOptions = {
-    subduction?: string;
-    keyhive?: never;
-} | {
-    subduction?: never;
-    keyhive: PatchworkKeyhiveSyncServer;
-};
 export type PatchworkKeyhiveSyncServer = "keyhive" | "subduction" | ({
     url: string;
 } & SyncServerIdentity);
+export interface PatchworkKeyhiveOptions {
+    /**
+     * Which relay ARK registers and grants access to. Default `"subduction"`.
+     * A custom identity also carries the WebSocket URL to reach it on.
+     */
+    syncServer?: PatchworkKeyhiveSyncServer;
+    /**
+     * Use the `idFactory` ARK injects into the repo config, which derives
+     * document ids from keyhive. Default true. `false` drops it and lets the
+     * Repo generate ids its own way.
+     */
+    useIdFactory?: boolean;
+}
 export type PatchworkSyncServersOptions = {
     /** wss:// URL for the legacy automerge-repo sync-server channel (connected on demand via connectClassicSync). Default: wss://sync3.automerge.org. Pass false to skip its preconnect hint. */
     classic?: string | false;
-} & PatchworkPrimarySyncServerOptions;
+    /** wss:// URL for the subduction channel. Default: wss://subduction.sync.inkandswitch.com. Overrides the URL a named `keyhive.syncServer` would otherwise imply. */
+    subduction?: string;
+};
 export declare const DEFAULT_TITLE = "Patchwork";
 export interface PatchworkSiteOptions {
     /**
@@ -76,12 +84,14 @@ export interface PatchworkSiteOptions {
     /** manifest background_color */
     backgroundColor?: string;
     /**
-     * Sync-server configuration for this build. Providing `keyhive` enables
-     * keyhive and selects the relay identity ARK grants access to. Custom
-     * identities also require their WebSocket URL. `subduction` and `keyhive`
-     * are mutually exclusive. The live server and `classic` are also emitted as
-     * connection hints. Pass `false` to keep the default servers but skip those
-     * hints.
+     * Enables keyhive for this build. `true` takes every default; an object
+     * picks the relay and turns individual behaviour off. Omitted or `false`
+     * builds a plain subduction repo.
+     */
+    keyhive?: boolean | PatchworkKeyhiveOptions;
+    /**
+     * The sync-server URLs for this build. Also emitted as connection hints;
+     * pass `false` to keep the URLs but skip the hints.
      */
     syncServers?: false | PatchworkSyncServersOptions;
     icons?: false | PatchworkIconsOptions;
@@ -89,4 +99,3 @@ export interface PatchworkSiteOptions {
     manifest?: false | Record<string, unknown>;
     netlify?: false | PatchworkNetlifyOptions;
 }
-export {};

package/dist/site-kit/sync-servers.d.ts

@@ -8,6 +8,7 @@ export declare const DEFAULT_SYNC_SERVERS: {
 export declare function resolvePrimarySyncServer(options: PatchworkSiteOptions): {
     url: string;
     keyhive?: SyncServerSelection;
+    useIdFactory?: boolean;
 };
 /**
  * Resolves which sync-server origins are actually live for this build: the

package/dist/site-kit/sync-servers.js

@@ -1,30 +1,32 @@
 // Mirrors core/bootloader/src/sync-config.ts's DEFAULT_CLASSIC_SYNC_SERVER
-// and automerge-worker.ts's SUBDUCTION_SYNC_URL selection — kept here as
-// plain constants (rather than importing those runtime modules) since this
-// only needs the hostnames, not the browser-only logic that reads them.
+// and automerge-protocol-handler-worker.ts's SUBDUCTION_SYNC_URL selection —
+// kept here as plain constants (rather than importing those runtime modules)
+// since this only needs the hostnames, not the browser-only logic that reads
+// them.
 export const DEFAULT_SYNC_SERVERS = {
     classic: "wss://sync3.automerge.org",
     subduction: "wss://subduction.sync.inkandswitch.com",
     keyhive: "wss://keyhive.sync.automerge.org",
 };
 export function resolvePrimarySyncServer(options) {
-    const servers = options.syncServers || undefined;
-    if (servers?.keyhive) {
-        if (typeof servers.keyhive === "string") {
-            return {
-                keyhive: servers.keyhive,
-                url: DEFAULT_SYNC_SERVERS[servers.keyhive],
-            };
-        }
-        const { url, ...identity } = servers.keyhive;
+    const subduction = (options.syncServers || undefined)?.subduction;
+    if (!options.keyhive) {
+        return { url: subduction ?? DEFAULT_SYNC_SERVERS.subduction };
+    }
+    const keyhive = options.keyhive === true ? {} : options.keyhive;
+    const useIdFactory = keyhive.useIdFactory ?? true;
+    const syncServer = keyhive.syncServer ?? "subduction";
+    if (typeof syncServer === "string") {
         return {
-            keyhive: identity,
-            url,
+            keyhive: syncServer,
+            url: subduction ?? DEFAULT_SYNC_SERVERS[syncServer],
+            useIdFactory,
         };
     }
-    return {
-        url: servers?.subduction ?? DEFAULT_SYNC_SERVERS.subduction,
-    };
+    // A custom relay carries the only URL it can be reached on, so it wins over
+    // `syncServers.subduction`.
+    const { url, ...identity } = syncServer;
+    return { keyhive: identity, url, useIdFactory };
 }
 function wsToHttpOrigin(wsUrl) {
     return wsUrl.replace(/^ws/, "http");

package/dist/types.d.ts

@@ -2,16 +2,26 @@ import type { AutomergeUrl, DocHandle, Repo } from "@automerge/vanillajs/slim";
 import type { AutomergeRepoKeyhiveBase as AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
 import type { ModuleWatcher, HasPatchworkMetadata } from "@inkandswitch/patchwork-filesystem";
 import type { AccountCreator, AccountDoc } from "@inkandswitch/patchwork-plugins";
-import type { ServiceWorkerRepoChannelListener, SyncStateDocMessage } from "@inkandswitch/patchwork-bootloader/types";
 import type * as pluginsNS from "@inkandswitch/patchwork-plugins";
 export type PluginsApi = typeof pluginsNS;
 export type SignerIdentity = {
     peerId: string;
     verifyingKey: string;
 };
+/** The sync server's last-known heads for one document, as it reports them. */
+export interface SyncStateDocMessage {
+    type: "sync-state";
+    documentId: string;
+    storageId: string;
+    heads: string[];
+    timestamp: number;
+}
 export interface ServiceWorkerApi {
     connectClassicSync: (server?: string) => Promise<void>;
-    subscribeToRepoChannel: (listener: ServiceWorkerRepoChannelListener) => Promise<() => void>;
+    /**
+     * Watch one document's heads at the sync server. Calls `listener` with
+     * what the server holds now, then on every update. Returns unsubscribe.
+     */
     subscribeSyncState: (documentId: string, listener: (update: SyncStateDocMessage) => void) => () => void;
 }
 export interface OpenOptions {
@@ -70,7 +80,8 @@ export interface PatchworkOptions {
     /**
      * Bring your own Repo. When provided, setup skips wasm initialization and
      * repo creation entirely — you are responsible for having initialized
-     * automerge/subduction and wired the automerge-worker port yourself.
+     * automerge/subduction and wired the automerge-protocol-handler-worker
+     * port yourself.
      */
     repo?: Repo;
     /** The keyhive instance accompanying a provided {@link PatchworkOptions.repo}. */

package/dist/vite/config-plugin.js

@@ -69,11 +69,11 @@ export function config(options = {}) {
                 },
             };
         },
-        // The shared automerge-worker's chunk imports bypass the page's service
-        // worker, so offline boot needs the browser's HTTP cache to serve them
-        // without revalidating. Content hashes make that safe; a new build gets
-        // new URLs. Production gets this from the generated _headers file — vite
-        // preview doesn't read that, so mirror it here.
+        // The shared automerge-protocol-handler-worker's chunk imports bypass the
+        // page's service worker, so offline boot needs the browser's HTTP cache to
+        // serve them without revalidating. Content hashes make that safe; a new
+        // build gets new URLs. Production gets this from the generated _headers
+        // file — vite preview doesn't read that, so mirror it here.
         configurePreviewServer(server) {
             if (options.netlify === false ||
                 options.netlify?.immutableAssets === false) {

package/dist/vite/patches-plugin.d.ts

@@ -0,0 +1,2 @@
+import type { Plugin } from "vite";
+export declare function patches(): Plugin;