@ixo/oracle-runtime-workers 0.12.0 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixo/oracle-runtime-workers",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "QiForge oracle runtime for Cloudflare Workers — Durable Object per user (SQLite in WASM over DO storage), Matrix E2EE gateway Durable Object, Hono HTTP/SSE shell.",
   "private": false,
   "publishConfig": {
@@ -33,7 +33,7 @@
     "@composio/core": "0.10.0",
     "@composio/langchain": "0.9.2",
     "@ixo/editor": "6.0.1",
-    "@ixo/matrix-bot-workers-sdk": "0.4.0",
+    "@ixo/matrix-bot-workers-sdk": "0.7.0",
     "@ixo/matrix-crdt": "^1.2.5",
     "@langchain/core": "1.1.48",
     "@langchain/langgraph": "1.3.2",

package/src/do/contracts.ts

@@ -73,6 +73,34 @@ export interface OracleWorkerEnv {
   MATRIX_HOT_ROOMS?: string;
   /** Cap on events replayed per room after a restart (SDK default 0 = unbounded). */
   MATRIX_BACKFILL_MAX_EVENTS?: string;
+  /**
+   * Gateway memory guards (`@ixo/matrix-bot-workers-sdk` 0.5+): events per
+   * room per `/sync` batch (default 30), the largest `/sync` response held
+   * in memory (default 16 MiB; over it the batch is re-requested at timeline
+   * limit 1 and the rooms catch up through `/messages`), events per catch-up
+   * page (default 100), the largest catch-up page (default 10 MiB; a bigger
+   * one is fetched again smaller) and the largest ciphertext the bot will
+   * decrypt (default 0 = no cap). A cap of `0` switches that guard off.
+   */
+  MATRIX_SYNC_TIMELINE_LIMIT?: string;
+  MATRIX_SYNC_BYTES_CAP?: string;
+  MATRIX_CATCHUP_PAGE_SIZE?: string;
+  MATRIX_PAGE_BYTES_CAP?: string;
+  MATRIX_MAX_DECRYPT_BYTES?: string;
+  /**
+   * `true` restores every room key the account's key backup holds on a
+   * device's first start (SDK 0.6+), capped at `..._MAX_KEYS` (default
+   * 5,000; a larger backup is skipped and keys stay on demand). Off by
+   * default: the gateway reads keys from the backup one session at a time.
+   */
+  MATRIX_BACKUP_BULK_RESTORE?: string;
+  MATRIX_BACKUP_BULK_RESTORE_MAX_KEYS?: string;
+  /**
+   * Keep-alive fuse (SDK 0.7+): while the gateway object works, its alarm is
+   * re-armed this far ahead so a host drain brings it back within the fuse
+   * (default 10 s, floor 2 s, `0` = off).
+   */
+  MATRIX_KEEPALIVE_FUSE_MS?: string;
 
   // --- storage ------------------------------------------------------------
   /**

package/src/matrix/gateway-do.ts

@@ -310,6 +310,23 @@ export class MatrixGatewayDO
         env.MATRIX_RECYCLE_AFTER_SENDS ?? String(DEFAULT_RECYCLE_AFTER_SENDS),
       MATRIX_HOT_ROOMS: env.MATRIX_HOT_ROOMS,
       MATRIX_BACKFILL_MAX_EVENTS: env.MATRIX_BACKFILL_MAX_EVENTS,
+      // Memory guards (SDK 0.5+): byte-capped /sync and catch-up pages and
+      // an optional ciphertext cap on decryption. Unset = the SDK defaults.
+      MATRIX_SYNC_TIMELINE_LIMIT: env.MATRIX_SYNC_TIMELINE_LIMIT,
+      MATRIX_SYNC_BYTES_CAP: env.MATRIX_SYNC_BYTES_CAP,
+      MATRIX_CATCHUP_PAGE_SIZE: env.MATRIX_CATCHUP_PAGE_SIZE,
+      MATRIX_PAGE_BYTES_CAP: env.MATRIX_PAGE_BYTES_CAP,
+      MATRIX_MAX_DECRYPT_BYTES: env.MATRIX_MAX_DECRYPT_BYTES,
+      // Opt-in bulk restore of the key backup on a device's first start
+      // (SDK 0.6+); off by default — the gateway fetches room keys from the
+      // backup on demand, one session at a time.
+      MATRIX_BACKUP_BULK_RESTORE: env.MATRIX_BACKUP_BULK_RESTORE,
+      MATRIX_BACKUP_BULK_RESTORE_MAX_KEYS:
+        env.MATRIX_BACKUP_BULK_RESTORE_MAX_KEYS,
+      // Keep-alive fuse (SDK 0.7+): the alarm is re-armed a few seconds
+      // ahead while the object works, so a host drain brings it back within
+      // the fuse instead of at the next cycle.
+      MATRIX_KEEPALIVE_FUSE_MS: env.MATRIX_KEEPALIVE_FUSE_MS,
       LOG_LEVEL: env.LOG_LEVEL,
     });
     return {
@@ -685,14 +702,13 @@ export class MatrixGatewayDO
   }
 
   /**
-   * Every start of this instance — first request, keep-alive alarm, RPC —
-   * goes through here. A start that actually brought the bot up is the
+   * After every successful start of this instance — a request, the
+   * keep-alive alarm bringing it back after a reset, a device rotation
+   * (the SDK's `onStarted` hook, detached from the caller). That is the
    * moment to re-dispatch the turns a previous incarnation left unfinished.
    */
-  override async ensureStarted(): Promise<StartResult> {
-    const result = await super.ensureStarted();
-    if (result.started) this.scheduleInboxReplay();
-    return result;
+  protected override async onStarted(_result: StartResult): Promise<void> {
+    this.scheduleInboxReplay();
   }
 
   private scheduleInboxReplay(): void {