@lix-js/sdk 0.16.1 → 0.17.0

package/dist/worker/client.js

@@ -1,4 +1,7 @@
-import { createWorkerConnection, openDirectLixBinding } from "#worker-factory";
+import { ADMISSION_PROTOCOL_EPOCH, ADMISSION_STORAGE_EPOCH } from "./shared-admission.js";
+import { observeOpenProgress, emitOpenProgress } from "../open-progress.js";
+import { fetchTransport } from "../http-transport.js";
+import { createWorkerConnection, createSharedWorkerConnection, openDirectLixBinding } from "#worker-factory";
 import { ownedSnapshotRestoreChunks } from "../snapshot-restore.js";
 import { deserializeWorkerError, serializeWorkerError, } from "./protocol.js";
 const MAX_IDLE_WORKERS = 1;
@@ -6,7 +9,12 @@ const MAX_IDLE_WORKERS = 1;
 // survives close(). Concurrent opens still receive isolated workers.
 const idleWorkers = [];
 export async function openLixWorker(storage, onDisposed, telemetry, server, onProgress, snapshot) {
-    let client = idleWorkers.pop();
+    const providerOptions = storage.kind === "jsStorage" ? storage.options : undefined;
+    const sharedKey = !snapshot && server && providerOptions && typeof providerOptions === "object"
+        && "sharedEngineKey" in providerOptions && typeof providerOptions.sharedEngineKey === "string"
+        && providerOptions.sharedEngineKey.startsWith("lix:opfs:") ? providerOptions.sharedEngineKey : undefined;
+    const sharedConnection = sharedKey ? createSharedWorkerConnection(`${sharedKey}:protocol-${ADMISSION_PROTOCOL_EPOCH}:storage-${ADMISSION_STORAGE_EPOCH}`) : undefined;
+    let client = sharedConnection ? new LixWorkerClient(sharedConnection, false) : idleWorkers.pop();
     while (client?.isDisposed)
         client = idleWorkers.pop();
     client ??= new LixWorkerClient();
@@ -104,6 +112,20 @@ export async function pumpSnapshotToWorker(client, reader, snapshotId, open) {
 }
 /** Opens the local worker transport behind the semantic Lix binding. */
 export async function openLixWorkerBinding(storage, onDisposed, telemetry, server, onProgress, snapshot) {
+    const progress = observeOpenProgress(onProgress);
+    const routed = server && onProgress ? { ...server,
+        transport: progress.transport(server.transport ?? fetchTransport(server.fetch)),
+    } : server;
+    try {
+        const binding = await openLixWorkerBindingInner(storage, onDisposed, telemetry, routed, onProgress ? value => emitOpenProgress(onProgress, value) : undefined, snapshot);
+        progress.complete();
+        return binding;
+    }
+    finally {
+        progress.stop();
+    }
+}
+async function openLixWorkerBindingInner(storage, onDisposed, telemetry, server, onProgress, snapshot) {
     if (openDirectLixBinding) {
         const telemetryDispatch = telemetry
             ? (span) => {
@@ -277,6 +299,8 @@ export function workerBinding(client, lease, sessionId) {
         replicaRecoverySources: () => request({ kind: "replicaRecoverySources" }),
         exportReplicaRecovery: (id) => request({ kind: "exportReplicaRecovery", id }),
         recoverReplica: (id) => request({ kind: "recoverReplica", id }),
+        recoverReplicaWithServer: (id, server) => client.withRecoveryServer(server, (transportScope, serialized) => request({ kind: "recoverReplicaWithServer", id, server: serialized, transportScope })),
+        syncHealth: () => request({ kind: "syncHealth" }),
         activeBranchId: () => request({ kind: "activeBranchId" }),
         activeAccountId: () => request({ kind: "activeAccountId" }),
         createBranch: (options) => request({ kind: "createBranch", options }),
@@ -353,7 +377,7 @@ function workerObserveBinding(request, notify, observeId) {
 }
 async function releaseWorker(client) {
     client.endLease();
-    if (!client.isDisposed && idleWorkers.length < MAX_IDLE_WORKERS) {
+    if (client.reusable && !client.isDisposed && idleWorkers.length < MAX_IDLE_WORKERS) {
         idleWorkers.push(client);
         return;
     }
@@ -361,6 +385,7 @@ async function releaseWorker(client) {
 }
 export class LixWorkerClient {
     connection;
+    reusable;
     nextRequestId = 1;
     nextSnapshotInputId = 1;
     pending = new Map();
@@ -369,12 +394,26 @@ export class LixWorkerClient {
     onDisposed;
     telemetry;
     syncServer;
+    scopedServers = new Map();
+    nextTransportScope = 1;
+    async withRecoveryServer(server, operation) {
+        const scope = this.nextTransportScope++;
+        const runtime = { url: server.url, headers: server.headerProvider ?? server.headers, transport: server.transport };
+        this.scopedServers.set(scope, runtime);
+        try {
+            return await operation(scope, serializeSyncServer(runtime));
+        }
+        finally {
+            this.scopedServers.delete(scope);
+        }
+    }
     onProgress;
     openReport;
     syncFetchControllers = new Map();
     syncFetchStreams = new Map();
-    constructor(connection = createWorkerConnection()) {
+    constructor(connection = createWorkerConnection(), reusable = true) {
         this.connection = connection;
+        this.reusable = reusable;
         connection.onMessage((message) => this.handleMessage(message));
         connection.onFatal((error) => this.handleFatal(error));
     }
@@ -497,10 +536,10 @@ export class LixWorkerClient {
                 }
                 break;
             case "sync.headers":
-                void this.resolveSyncHeaders(message.requestId);
+                void this.resolveSyncHeaders(message.requestId, message.transportScope);
                 break;
             case "sync.fetch":
-                void this.resolveSyncFetch(message.requestId, message.request);
+                void this.resolveSyncFetch(message.requestId, message.request, message.transportScope);
                 break;
             case "sync.fetch.stream.pull":
                 void this.resolveSyncFetchStreamPull(message.requestId);
@@ -510,9 +549,11 @@ export class LixWorkerClient {
                 break;
         }
     }
-    async resolveSyncHeaders(requestId) {
+    async resolveSyncHeaders(requestId, transportScope) {
         try {
-            const source = this.syncServer?.headers;
+            if (transportScope !== undefined && !this.scopedServers.has(transportScope))
+                throw workerClosedError();
+            const source = (transportScope === undefined ? this.syncServer : this.scopedServers.get(transportScope))?.headers;
             const headers = typeof source === "function" ? await source() : source;
             this.notify({
                 kind: "sync.headers.result",
@@ -528,38 +569,33 @@ export class LixWorkerClient {
             });
         }
     }
-    async resolveSyncFetch(requestId, request) {
-        const fetcher = this.syncServer?.fetch;
-        if (!fetcher) {
-            this.notify({
-                kind: "sync.fetch.result",
-                requestId,
-                result: {
-                    ok: false,
-                    error: serializeWorkerError(new Error("Sync fetch bridge is unavailable")),
-                },
-            });
+    async resolveSyncFetch(requestId, request, transportScope) {
+        const server = transportScope === undefined ? this.syncServer : this.scopedServers.get(transportScope);
+        if (!server) {
+            this.notify({ kind: "sync.fetch.result", requestId, result: { ok: false, error: serializeWorkerError(workerClosedError()) } });
             return;
         }
+        const transport = server.transport ?? fetchTransport(server.fetch);
         const controller = new AbortController();
         this.syncFetchControllers.set(requestId, controller);
         let retainedStream = false;
         try {
-            const response = await fetcher(request.url, {
-                method: request.method,
-                headers: request.headers,
-                body: typeof request.body === "string"
-                    ? request.body
-                    : request.body?.slice().buffer,
-                credentials: request.credentials,
-                signal: controller.signal,
-            });
+            const response = await transport({ url: request.url, response: request.response, init: {
+                    method: request.method,
+                    headers: request.headers,
+                    body: typeof request.body === "string"
+                        ? request.body
+                        : request.body?.slice().buffer,
+                    credentials: request.credentials,
+                    signal: controller.signal,
+                    cache: request.cache, redirect: request.redirect,
+                } });
             if (this.syncFetchControllers.get(requestId) !== controller ||
                 controller.signal.aborted) {
                 await response.body?.cancel().catch(() => undefined);
                 return;
             }
-            if (request.responseMode === "stream") {
+            if (request.response.mode === "streaming") {
                 this.syncFetchStreams.set(requestId, response.body?.getReader());
                 retainedStream = true;
                 this.notify({
@@ -577,7 +613,7 @@ export class LixWorkerClient {
                 });
                 return;
             }
-            const body = await readSyncResponseBody(response, request.responseLimit, controller);
+            const body = new Uint8Array(await response.arrayBuffer());
             this.notify({
                 kind: "sync.fetch.result",
                 requestId,
@@ -593,6 +629,8 @@ export class LixWorkerClient {
             });
         }
         catch (error) {
+            if (isSyncResponseTooLarge(error))
+                controller.abort(error);
             if (!controller.signal.aborted || isSyncResponseTooLarge(error)) {
                 this.notify({
                     kind: "sync.fetch.result",
@@ -674,58 +712,10 @@ export class LixWorkerClient {
         this.connection.unref();
     }
 }
-async function readSyncResponseBody(response, limit, controller) {
-    if (!Number.isSafeInteger(limit) || limit <= 0) {
-        throw new TypeError("Browser sync fetch has no valid response limit");
-    }
-    const declaredLength = Number(response.headers.get("content-length"));
-    if (Number.isFinite(declaredLength) && declaredLength > limit) {
-        const error = syncResponseTooLarge(limit);
-        controller.abort(error);
-        throw error;
-    }
-    const stream = response.body;
-    if (!stream)
-        return new Uint8Array();
-    const reader = stream.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            total += value.byteLength;
-            if (total > limit) {
-                const error = syncResponseTooLarge(limit);
-                controller.abort(error);
-                await reader.cancel(error).catch(() => undefined);
-                throw error;
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const body = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        body.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return body;
-}
-function syncResponseTooLarge(limit) {
-    const error = new Error(`sync fetch response exceeds ${limit} bytes`);
-    error.name = "LixError";
-    error.code = "LIX_ERROR_SYNC_RESPONSE_TOO_LARGE";
-    return error;
-}
 function isSyncResponseTooLarge(error) {
     return (error instanceof Error &&
         error.code ===
-            "LIX_ERROR_SYNC_RESPONSE_TOO_LARGE");
+            "LIX_TRANSPORT_RESPONSE_LIMIT");
 }
 function workerClosedError() {
     const error = new Error("Lix worker is closed");
@@ -742,7 +732,6 @@ function serializeSyncServer(server) {
             ? undefined
             : headerEntries(server.headers),
         dynamicHeaders: typeof server.headers === "function",
-        customFetch: server.fetch !== undefined,
     };
 }
 function headerEntries(headers) {
@@ -758,7 +747,7 @@ async function resolveDirectSyncServer(server) {
     return {
         url: new URL(server.url).toString(),
         headers: headerEntries(headers),
-        fetch: server.fetch,
+        transport: server.transport ?? (server.fetch ? fetchTransport(server.fetch) : undefined),
     };
 }
 export async function hostedLixWorkerOperation(operation) {
@@ -771,3 +760,28 @@ export async function hostedLixWorkerOperation(operation) {
         await client.terminate();
     }
 }
+export async function convertReplicaWorkerOperation(storage, server, branchId) {
+    const providerOptions = storage.kind === "jsStorage" ? storage.options : undefined;
+    const sharedKey = providerOptions && typeof providerOptions === "object"
+        && "sharedEngineKey" in providerOptions && typeof providerOptions.sharedEngineKey === "string"
+        && providerOptions.sharedEngineKey.startsWith("lix:opfs:") ? providerOptions.sharedEngineKey : undefined;
+    const connection = sharedKey ? createSharedWorkerConnection(`${sharedKey}:protocol-${ADMISSION_PROTOCOL_EPOCH}:storage-${ADMISSION_STORAGE_EPOCH}`) : undefined;
+    const client = connection ? new LixWorkerClient(connection, false) : new LixWorkerClient();
+    client.beginLease(undefined, undefined, server);
+    try {
+        await client.request({ kind: "replica.convert", storage, server: serializeSyncServer(server), branchId }, 0);
+    }
+    finally {
+        await client.terminate();
+    }
+}
+export async function retryReplicaMigrationCleanupWorkerOperation(storage, server) {
+    const client = new LixWorkerClient();
+    client.beginLease(undefined, undefined, server);
+    try {
+        return await client.request({ kind: "replica.cleanup", storage, server: serializeSyncServer(server) }, 0);
+    }
+    finally {
+        await client.terminate();
+    }
+}

package/dist/worker/durable-local-admission.d.ts

@@ -0,0 +1,20 @@
+import { type AdmissionIdentity } from "./shared-admission.js";
+export interface DurableLocalAdmissionStore {
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Durable local routing evidence only. Never grants or restores a remote lease. */
+export declare class DurableLocalAdmission {
+    private readonly scope;
+    private readonly store;
+    private readonly url;
+    private readonly repositoryId;
+    constructor(scope: string, url: string, store?: DurableLocalAdmissionStore);
+    private key;
+    private validIdentity;
+    read(headers: [string, string][]): Promise<AdmissionIdentity | undefined>;
+    /** Call only after actual storage/account validation, never after metadata admission alone. */
+    record(headers: [string, string][], identity: AdmissionIdentity): Promise<void>;
+    remove(headers: [string, string][]): Promise<void>;
+}

package/dist/worker/durable-local-admission.js

@@ -0,0 +1,87 @@
+import { ADMISSION_PROTOCOL_EPOCH, ADMISSION_STORAGE_EPOCH } from "./shared-admission.js";
+const anonymous = "00000000-0000-7000-8000-000000000002";
+const databaseName = "lix-local-admission-v1";
+const storeName = "proofs";
+/** Each operation closes its connection and resolves only after transaction commit. */
+class IndexedDbProofStore {
+    async operation(key, mode, value) {
+        const db = await new Promise((resolve, reject) => {
+            const request = indexedDB.open(databaseName, 1);
+            request.onupgradeneeded = () => request.result.createObjectStore(storeName);
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+        });
+        try {
+            return await new Promise((resolve, reject) => {
+                const transaction = db.transaction(storeName, mode === "get" ? "readonly" : "readwrite");
+                const store = transaction.objectStore(storeName);
+                const request = mode === "get" ? store.get(key) : mode === "put" ? store.put(value, key) : store.delete(key);
+                transaction.oncomplete = () => resolve(request.result);
+                transaction.onabort = () => reject(transaction.error ?? new Error("Local admission transaction aborted"));
+                transaction.onerror = () => reject(transaction.error ?? new Error("Local admission transaction failed"));
+            });
+        }
+        finally {
+            db.close();
+        }
+    }
+    get(key) { return this.operation(key, "get"); }
+    async put(key, value) { await this.operation(key, "put", value); }
+    async delete(key) { await this.operation(key, "delete"); }
+}
+/** Durable local routing evidence only. Never grants or restores a remote lease. */
+export class DurableLocalAdmission {
+    scope;
+    store;
+    url;
+    repositoryId;
+    constructor(scope, url, store = new IndexedDbProofStore()) {
+        this.scope = scope;
+        this.store = store;
+        const parsed = new URL(url);
+        const id = parsed.pathname.match(/^\/lix\/([0-9a-f-]{36})\/?$/i)?.[1];
+        if (!scope || scope.length > 4096 || !id || !["https:", "http:"].includes(parsed.protocol) || parsed.search || parsed.hash || parsed.username || parsed.password) {
+            throw new Error("Invalid durable local admission scope");
+        }
+        parsed.pathname = `/lix/${id}`;
+        this.url = parsed.toString();
+        this.repositoryId = id;
+    }
+    async key(headers) {
+        const entries = [];
+        new Headers(headers).forEach((value, name) => entries.push([name, value]));
+        const bytes = new TextEncoder().encode(JSON.stringify([1, this.scope, this.url, entries, ADMISSION_PROTOCOL_EPOCH, ADMISSION_STORAGE_EPOCH]));
+        const digest = await crypto.subtle.digest("SHA-256", bytes);
+        return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, "0")).join("");
+    }
+    validIdentity(value) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const v = value;
+        return Object.keys(v).sort().join(",") === "principalId,protocolEpoch,repositoryId,storageEpoch" &&
+            v.repositoryId === this.repositoryId && typeof v.principalId === "string" && /^[\x21-\x7e]{1,255}$/.test(v.principalId) &&
+            v.protocolEpoch === ADMISSION_PROTOCOL_EPOCH && v.storageEpoch === ADMISSION_STORAGE_EPOCH;
+    }
+    async read(headers) {
+        const key = await this.key(headers);
+        const value = await this.store.get(key);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return undefined;
+        const record = value;
+        if (Object.keys(record).sort().join(",") !== "identity,key,schemaVersion" || record.schemaVersion !== 1 || record.key !== key || !this.validIdentity(record.identity))
+            return undefined;
+        if (!new Headers(headers).get("authorization") && record.identity.principalId !== anonymous)
+            return undefined;
+        return { ...record.identity };
+    }
+    /** Call only after actual storage/account validation, never after metadata admission alone. */
+    async record(headers, identity) {
+        if (!this.validIdentity(identity))
+            throw new Error("Invalid durable local admission identity");
+        if (!new Headers(headers).get("authorization") && identity.principalId !== anonymous)
+            return;
+        const key = await this.key(headers);
+        await this.store.put(key, { schemaVersion: 1, key, identity: { ...identity } });
+    }
+    async remove(headers) { await this.store.delete(await this.key(headers)); }
+}

package/dist/worker/entry.shared.browser.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/worker/entry.shared.browser.js

@@ -0,0 +1,211 @@
+/// <reference lib="webworker" />
+import { openLixBinding, convertReplicaBinding } from "#binding";
+import { fetchTransport, HttpTransportError } from "../http-transport.js";
+import { SharedAdmissionCache, requestAdmission, sharedCredentialKey, sameAdmission, } from "./shared-admission.js";
+import { DurableLocalAdmission } from "./durable-local-admission.js";
+import { startWorkerHost } from "./host.js";
+import { SharedEngineOwner } from "./shared-engine.js";
+import { serializeWorkerError } from "./protocol.js";
+const scope = globalThis;
+let owner;
+let configuration;
+// Same-origin callers own the local store. Durable routing proofs can reopen
+// its cached data after worker shutdown, but never authorize remote requests.
+// Raw credentials remain in memory only.
+const admitted = new SharedAdmissionCache();
+let rootIdentity;
+scope.onconnect = (event) => {
+    const port = event.ports[0];
+    let client;
+    let disconnected = false;
+    let input;
+    const prepareClient = async (...args) => {
+        const [storage, telemetry, parent, server, progress, snapshot] = args;
+        if (!server || snapshot)
+            throw new Error("Shared partial engines require a server and existing storage");
+        const config = JSON.stringify([storage, server.url]);
+        if (configuration !== undefined && config !== configuration)
+            throw new Error("Shared engine configuration mismatch");
+        configuration = config;
+        const raw = server;
+        const readHeaders = async () => raw.headerProvider ? await raw.headerProvider() : raw.headers;
+        let verifiedKey;
+        let verifiedGeneration;
+        let candidateIdentity;
+        let candidateHeaders;
+        let candidateOnline = false;
+        let candidateGeneration = 0;
+        let candidateCredentialGeneration = 0;
+        const providerOptions = storage.kind === "jsStorage" ? storage.options : undefined;
+        const physicalScope = providerOptions && typeof providerOptions === "object" &&
+            "sharedEngineKey" in providerOptions && typeof providerOptions.sharedEngineKey === "string"
+            ? providerOptions.sharedEngineKey : undefined;
+        if (!physicalScope?.startsWith("lix:opfs:"))
+            throw new Error("Missing physical shared storage identity");
+        const localAdmission = new DurableLocalAdmission(physicalScope, raw.url);
+        const transport = raw.transport ?? fetchTransport();
+        const authenticate = async (headers, allowOffline) => {
+            const credentialGeneration = admitted.generation(raw.url, headers);
+            let result;
+            try {
+                result = await admitted.verify(raw.url, headers, rootIdentity, () => requestAdmission(raw.url, headers, transport), allowOffline);
+            }
+            catch (error) {
+                const code = error?.code;
+                if (code === "LIX_ADMISSION_AUTH_REJECTED") {
+                    if (candidateHeaders && sharedCredentialKey(raw.url, candidateHeaders) === sharedCredentialKey(raw.url, headers)) {
+                        candidateOnline = false;
+                        candidateGeneration++;
+                    }
+                    admitted.remove(raw.url, headers);
+                    await localAdmission.remove(headers).catch(() => undefined);
+                }
+                if (!allowOffline || code !== "LIX_IDENTITY_UNVERIFIED_OFFLINE")
+                    throw error;
+                const local = await localAdmission.read(headers).catch(() => undefined);
+                if (!local)
+                    throw error;
+                if (rootIdentity && !sameAdmission(local, rootIdentity)) {
+                    throw new HttpTransportError("LIX_SHARED_ENGINE_IDENTITY_MISMATCH", "Cached local repository/account does not match this owner");
+                }
+                result = { identity: local, online: false };
+            }
+            if (admitted.generation(raw.url, headers) !== credentialGeneration) {
+                throw new HttpTransportError("LIX_ADMISSION_AUTH_REJECTED", "Credentials were rejected while local admission was in flight");
+            }
+            if (result.online) {
+                verifiedKey = sharedCredentialKey(raw.url, headers);
+                verifiedGeneration = credentialGeneration;
+            }
+            candidateCredentialGeneration = credentialGeneration;
+            candidateGeneration++;
+            candidateIdentity = result.identity;
+            candidateHeaders = headers.map(([name, value]) => [name, value]);
+            candidateOnline = result.online;
+            return result;
+        };
+        const routed = {
+            ...raw,
+            transport: async (request) => {
+                try {
+                    const response = await transport(request);
+                    return response;
+                }
+                catch (error) {
+                    verifiedKey = undefined;
+                    throw error;
+                }
+            },
+            headerProvider: async () => {
+                const headers = await readHeaders();
+                if (sharedCredentialKey(raw.url, headers) !== verifiedKey || admitted.generation(raw.url, headers) !== verifiedGeneration) {
+                    // Failure only suspends this remote lease; local sessions survive.
+                    verifiedKey = undefined;
+                    await authenticate(headers, false);
+                }
+                return headers;
+            },
+        };
+        if (!owner) {
+            owner = new SharedEngineOwner(async (transport, backgroundTelemetry, opener) => {
+                return openLixBinding(storage, backgroundTelemetry, opener.parent, transport, opener.progress);
+            });
+        }
+        client = {
+            server: routed,
+            isDisconnected: () => disconnected,
+            telemetry,
+            parent,
+            progress,
+            rejectCredentials: async (headers) => {
+                const rejectedKey = sharedCredentialKey(raw.url, headers);
+                if (verifiedKey === rejectedKey)
+                    verifiedKey = undefined;
+                if (candidateHeaders && sharedCredentialKey(raw.url, candidateHeaders) === rejectedKey) {
+                    candidateOnline = false;
+                    candidateGeneration++;
+                }
+                admitted.remove(raw.url, headers);
+                await localAdmission.remove(headers).catch(() => undefined);
+            },
+            commitIdentity: async () => {
+                if (!candidateIdentity)
+                    throw new Error("Missing verified owner identity");
+                rootIdentity ??= candidateIdentity;
+                if (candidateOnline && candidateHeaders) {
+                    // The owner has checked the actual stored account before this call.
+                    // Failure to cache only disables later offline reopening.
+                    const generation = candidateGeneration;
+                    const headers = candidateHeaders;
+                    const identity = candidateIdentity;
+                    await admitted.persistLocal(raw.url, headers, candidateCredentialGeneration, () => localAdmission.record(headers, identity), () => localAdmission.remove(headers)).catch(() => undefined);
+                    // A rejection during the asynchronous write must not resurrect its proof.
+                    if (generation !== candidateGeneration)
+                        await localAdmission.remove(headers).catch(() => undefined);
+                }
+            },
+            verifyIdentity: async () => {
+                const headers = await readHeaders();
+                const { identity, online } = await authenticate(headers, true);
+                return { authorityUrl: raw.url, accountId: identity.principalId, headers, online };
+            },
+        };
+        return { owner, client };
+    };
+    const controller = startWorkerHost({
+        postMessage: (message) => port.postMessage(message),
+        onMessage: (listener) => { input = listener; },
+    }, async (...args) => {
+        const prepared = await prepareClient(...args);
+        const binding = await prepared.owner.attach(prepared.client);
+        if (disconnected) {
+            await binding.close();
+            throw new Error("Shared engine client disconnected during open");
+        }
+        return binding;
+    }, async (storage, server, branchId) => {
+        const prepared = await prepareClient(storage, undefined, undefined, server);
+        await prepared.owner.convert(prepared.client, transport => convertReplicaBinding(storage, transport, branchId), branchId);
+    });
+    const disconnect = async () => {
+        if (disconnected)
+            return;
+        disconnected = true;
+        if (client)
+            owner?.deactivate(client);
+        let failure;
+        try {
+            await controller.close();
+        }
+        catch (error) {
+            failure = error;
+        }
+        try {
+            if (client)
+                await owner?.detach(client);
+        }
+        catch (error) {
+            failure ??= error;
+        }
+        try {
+            port.postMessage({ kind: "shared.disconnected", error: failure === undefined ? undefined : serializeWorkerError(failure) });
+        }
+        finally {
+            port.close();
+        }
+    };
+    port.onmessage = (event) => {
+        const message = event.data;
+        if (message?.kind === "shared.disconnect") {
+            void disconnect();
+            return;
+        }
+        if (message?.kind === "shared.clientLease") {
+            // The page holds this lock. Acquisition means it closed or crashed.
+            void navigator.locks.request(message.name, () => disconnect());
+            return;
+        }
+        input?.(message);
+    };
+    port.start();
+};

package/dist/worker/factory.browser.d.ts

@@ -2,3 +2,5 @@ import type { LixBinding, LixStorageConfig, TelemetryDispatch, TelemetryParentCo
 import type { WorkerConnection } from "./protocol.js";
 export declare const openDirectLixBinding: undefined | ((storage: LixStorageConfig, telemetry?: TelemetryDispatch, telemetryParent?: TelemetryParentContext, server?: SyncServerBindingOptions, openProgress?: OpenProgressDispatch, snapshot?: ReadableStream<Uint8Array>) => Promise<LixBinding>);
 export declare function createWorkerConnection(): WorkerConnection;
+/** Package-private provider identity selects one engine, not one engine per tab. */
+export declare function createSharedWorkerConnection(key: string): WorkerConnection;