@ours.network/fleet 1.2.0-nightly.70 → 1.2.0-nightly.71

package/dist/subscriptions/login.js

@@ -26,6 +26,7 @@ class BaseLogin {
     provider;
     owner;
     kind;
+    changed;
     loginId = randomBytes(16).toString('hex');
     expiresAt;
     state = 'starting';
@@ -35,10 +36,11 @@ class BaseLogin {
     done;
     finish;
     timer;
-    constructor(provider, owner, kind, now = Date.now()) {
+    constructor(provider, owner, kind, now = Date.now(), changed = () => { }) {
         this.provider = provider;
         this.owner = owner;
         this.kind = kind;
+        this.changed = changed;
         this.expiresAt = now + LOGIN_TTL_MS;
         this.done = new Promise(resolve => { this.finish = resolve; });
         this.timer = setTimeout(() => this.end('expired', 'login timed out'), LOGIN_TTL_MS);
@@ -64,6 +66,7 @@ class BaseLogin {
         clearTimeout(this.timer);
         this.stop();
         this.finish(state === 'succeeded');
+        this.changed();
     }
     /** Called by the service after verifying the new home. */
     complete(ok, error) { this.end(ok ? 'succeeded' : 'failed', error); }
@@ -76,8 +79,8 @@ export class ClaudeLogin extends BaseLogin {
     continued = false;
     /** Resolves with the CLI exit status once it exits. */
     exited;
-    constructor(owner, bins, home, profileId) {
-        super('claude', owner, 'paste_code');
+    constructor(owner, bins, home, profileId, changed) {
+        super('claude', owner, 'paste_code', Date.now(), changed);
         const darwin = process.platform === 'darwin';
         const args = darwin
             ? ['-q', '/dev/null', bins.claude, 'auth', 'login']
@@ -109,6 +112,7 @@ export class ClaudeLogin extends BaseLogin {
                     }
                     this.url = url;
                     this.state = 'awaiting_user';
+                    this.changed();
                 }
             }
             // Claude asks for Enter after success; the answer carries no secret.
@@ -131,6 +135,7 @@ export class ClaudeLogin extends BaseLogin {
             throw new FleetError('invalid_request', 'that does not look like a sign-in code');
         this.submitted = true;
         this.state = 'verifying';
+        this.changed();
         this.output = '';
         this.child?.stdin.write(`${code}\r`);
     }
@@ -151,8 +156,8 @@ export class CodexDeviceLogin extends BaseLogin {
     codexLoginId;
     /** Resolves true when the app-server reports a successful login. */
     completed;
-    constructor(owner, bins, home, profileId) {
-        super('codex', owner, 'device_code');
+    constructor(owner, bins, home, profileId, changed) {
+        super('codex', owner, 'device_code', Date.now(), changed);
         this.completed = (async () => {
             try {
                 this.server = await CodexAppServer.start(bins.codex, profileEnv('CODEX_HOME', profileId, home));
@@ -184,9 +189,12 @@ export class CodexDeviceLogin extends BaseLogin {
                 this.url = url;
                 this.userCode = String(started.userCode).slice(0, 32);
                 this.state = 'awaiting_user';
+                this.changed();
                 const ok = await Promise.race([completion, this.done.then(() => false)]);
-                if (this.state === 'awaiting_user')
+                if (this.state === 'awaiting_user') {
                     this.state = 'verifying';
+                    this.changed();
+                }
                 return ok;
             }
             catch {

package/dist/subscriptions/service.d.ts

@@ -71,7 +71,7 @@ export declare class SubscriptionService {
     private readonly logins;
     private readonly probes;
     constructor(options: SubscriptionServiceOptions);
-    list(): Promise<ProviderView[]>;
+    list(observeOnly?: boolean): Promise<ProviderView[]>;
     /** Health + account + (Codex) usage for one profile. Concurrent calls share one run. */
     check(provider: SubscriptionProvider, profileId: string): Promise<CheckResult>;
     private checkClaude;

package/dist/subscriptions/service.js

@@ -23,7 +23,7 @@ export class SubscriptionService {
         this.bins = options.binaries ?? defaultBinaries();
         this.now = options.now ?? Date.now;
     }
-    async list() {
+    async list(observeOnly = false) {
         const state = readSubscriptionState();
         const pins = await this.pins();
         return SUBSCRIPTION_PROVIDERS.map(provider => {
@@ -31,7 +31,7 @@ export class SubscriptionService {
             const profiles = p.profiles.map(profile => {
                 const key = `${provider}/${profile.id}`;
                 const cached = this.checks.get(key);
-                if (!cached || this.now() - Date.parse(cached.health.checkedAt ?? '0') > STALE_CHECK_MS)
+                if (!observeOnly && (!cached || this.now() - Date.parse(cached.health.checkedAt ?? '0') > STALE_CHECK_MS))
                     void this.check(provider, profile.id).catch(() => { });
                 const observed = provider === 'claude' ? this.observedUsage(pins, profile.id) : undefined;
                 const probed = provider === 'claude' ? this.probedUsage(profile.id) : undefined;
@@ -135,8 +135,8 @@ export class SubscriptionService {
         }
         const { id: profileId, home } = createProfileHome(provider);
         const login = provider === 'claude'
-            ? new ClaudeLogin(owner, this.bins, home, profileId)
-            : new CodexDeviceLogin(owner, this.bins, home, profileId);
+            ? new ClaudeLogin(owner, this.bins, home, profileId, this.options.onChange)
+            : new CodexDeviceLogin(owner, this.bins, home, profileId, this.options.onChange);
         const loginId = login.view().loginId;
         this.logins.set(loginId, login);
         void this.completeLogin(provider, profileId, login);

package/dist/subscriptions/store.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { existsSync, mkdirSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
@@ -94,6 +95,7 @@ export async function updateSubscriptionState(fn) {
         const state = readSubscriptionState();
         const result = fn(state);
         replaceFileAtomically(stateFile(), `${JSON.stringify(state, null, 2)}\n`, 0o600);
+        publishFleetResourceCommit(stateFile());
         return result;
     });
 }
@@ -137,4 +139,5 @@ export function readPin(stateDir, provider) {
 }
 export function writePin(stateDir, pin) {
     replaceFileAtomically(join(stateDir, PIN_FILE), `${JSON.stringify({ [pin.provider]: pin })}\n`, 0o600);
+    publishFleetResourceCommit(join(stateDir, PIN_FILE));
 }

package/dist/watchdog/query.d.ts

@@ -39,7 +39,9 @@ export declare function buildWatchdogFindings(cfg: {
  * polling. `now` is injectable (defaults to Date.now) so the TTL boundary is
  * unit-testable without real timers.
  */
-export declare function cachedWatchdogFindingsProvider(build: () => Map<string, WatchdogRoleFinding>, ttlMs: number, now?: () => number): () => Map<string, WatchdogRoleFinding>;
+export declare function cachedWatchdogFindingsProvider(build: () => Map<string, WatchdogRoleFinding>, ttlMs: number, now?: () => number): (() => Map<string, WatchdogRoleFinding>) & {
+    invalidate: () => void;
+};
 export interface WatchdogSummary {
     name: string;
     enabled: boolean;

package/dist/watchdog/query.js

@@ -59,12 +59,13 @@ export function buildWatchdogFindings(cfg, latestReport) {
  */
 export function cachedWatchdogFindingsProvider(build, ttlMs, now = Date.now) {
     let cached;
-    return () => {
+    const read = () => {
         const at = now();
         if (!cached || at - cached.at >= ttlMs)
             cached = { at, value: build() };
         return cached.value;
     };
+    return Object.assign(read, { invalidate: () => { cached = undefined; } });
 }
 const DEFAULT_REPORTS_LIMIT = 50;
 const MAX_REPORTS_LIMIT = 500;

package/dist/web/events.d.ts

@@ -8,6 +8,8 @@ export interface FleetEvent {
 }
 export declare class FleetEventBus {
     private readonly events;
+    private readonly resourceListeners;
+    subscribeResources(listener: () => void): () => void;
     private readonly clients;
     publish(kind: string, payload: unknown, roleId?: string): FleetEvent;
     attach(socket: WebSocket, lastEventId?: string): () => void;

package/dist/web/events.js

@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto';
 export class FleetEventBus {
     events = [];
+    resourceListeners = new Set();
+    subscribeResources(listener) { this.resourceListeners.add(listener); return () => { this.resourceListeners.delete(listener); }; }
     clients = new Set();
     publish(kind, payload, roleId) {
         const event = { eventId: randomUUID(), at: new Date().toISOString(), roleId, kind, payload };
@@ -12,6 +14,12 @@ export class FleetEventBus {
             if (socket.readyState === socket.OPEN && socket.bufferedAmount < 1024 * 1024)
                 socket.send(frame);
         }
+        for (const listener of this.resourceListeners) {
+            try {
+                listener();
+            }
+            catch { }
+        }
         return event;
     }
     attach(socket, lastEventId) {
@@ -30,5 +38,6 @@ export class FleetEventBus {
         for (const socket of this.clients)
             socket.close(1001, 'server shutdown');
         this.clients.clear();
+        this.resourceListeners.clear();
     }
 }

package/dist/web/prefix-gateway.js

@@ -103,17 +103,24 @@ export function createPrefixGateway(options) {
             delete headers['sec-websocket-protocol'];
         return { ...route, headers, session, authHeaders, deviceSocket: socketCredential !== undefined };
     };
-    const track = (authHeaders, session, close) => {
+    const track = (authHeaders, session, close, neutral = false) => {
         if (!session)
             return () => { };
         // The session authenticated for this request, with its own deadline, not whatever is current later.
         const unbind = auth.bindTransport(session, close);
-        const timer = setInterval(() => { try {
-            auth.authenticate({ headers: authHeaders });
-        }
-        catch {
-            close();
-        } }, 30_000);
+        const timer = setInterval(() => {
+            if (neutral) {
+                if (!auth.sessionValid(session))
+                    close();
+            }
+            else
+                try {
+                    auth.authenticate({ headers: authHeaders });
+                }
+                catch {
+                    close();
+                }
+        }, neutral ? 1000 : 30_000);
         timer.unref();
         return () => { clearInterval(timer); unbind(); };
     };
@@ -123,7 +130,7 @@ export function createPrefixGateway(options) {
     const accountCors = (req) => {
         const origin = auth?.accountOrigin(req);
         return origin ? { 'access-control-allow-origin': origin, vary: 'Origin',
-            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag, X-Ours-Workspace-Auth, X-Ours-Request-Id' } : {};
+            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag, X-Ours-Workspace-Auth, X-Ours-Request-Id, X-Resource-Producer, X-Resource-Revision, X-Resource-Source-Generation, X-Resource-Source-Position, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline' } : {};
     };
     const server = createServer((req, res) => {
         const cors = accountCors(req);
@@ -134,7 +141,7 @@ export function createPrefixGateway(options) {
                 auth.validateBoundary({ headers: req.headers, method: req.method, url: req.url }, false);
                 res.writeHead(204, { ...cors, 'cache-control': 'no-store', 'access-control-max-age': '600',
                     'access-control-allow-methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
-                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration' });
+                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline' });
                 res.end();
                 return;
             }
@@ -186,7 +193,10 @@ export function createPrefixGateway(options) {
                 res.writeHead(502, { ...(route.service ? cors : {}), 'content-type': 'application/json' });
             res.end(JSON.stringify({ error: { code: 'upstream_unavailable', message: 'Service is unavailable' } }));
         });
-        const untrack = track(route.authHeaders, route.session, () => { upstream.destroy(); res.destroy(); });
+        const neutral = req.method === 'GET' && route.service?.prefix === '/notifications'
+            && new URL(req.url ?? '/', 'http://gateway.invalid').searchParams.get('resources') === '1'
+            && new URL(req.url ?? '/', 'http://gateway.invalid').pathname === '/notifications/api/v1/events';
+        const untrack = track(route.authHeaders, route.session, () => { upstream.destroy(); res.destroy(); }, neutral);
         res.on('close', untrack);
         req.on('aborted', () => upstream.destroy());
         res.on('close', () => upstream.destroy());

package/dist/web/resource-views.d.ts

@@ -0,0 +1,124 @@
+import type { ServerResponse } from 'node:http';
+import { type FleetResourceScope, type FleetResourceState } from '../application/resource-observer.js';
+export declare function abortableProjection<T>(read: Promise<T>, signal: AbortSignal): Promise<T>;
+export interface ResourceFrameBinding {
+    readonly protocolVersion: 1;
+    readonly producerGeneration: string;
+    readonly subscriptionEpoch: number;
+    readonly viewId: string;
+    readonly sequence: number;
+    readonly revision: number;
+    readonly baselineId?: string;
+}
+export type ResourceHealthReason = 'auth_required' | 'unsupported' | 'upstream_unavailable';
+export type ResourceEnvelope = ResourceFrameBinding & ({
+    readonly kind: 'snapshot';
+    readonly payload: unknown;
+} | {
+    readonly kind: 'upsert';
+    readonly payload: unknown;
+} | {
+    readonly kind: 'delete';
+    readonly payload: {
+        readonly id: string;
+        readonly revision: number;
+    };
+} | {
+    readonly kind: 'ready';
+    readonly payload: {
+        readonly baselineId: string;
+        readonly source: FleetResourceState;
+    };
+} | {
+    readonly kind: 'coverage';
+    readonly payload: {
+        readonly source: FleetResourceState;
+    };
+} | {
+    readonly kind: 'resync';
+    readonly payload: {
+        readonly reason: 'capacity' | 'projection_unavailable';
+    };
+} | {
+    readonly kind: 'health';
+    readonly payload: {
+        readonly healthy: false;
+        readonly reason: ResourceHealthReason;
+    };
+});
+export interface ResourceWireFrame {
+    event: 'resource' | 'resource-chunk';
+    data: Record<string, unknown>;
+}
+export declare const RESOURCE_FRAME_BYTES: number;
+export declare const RESOURCE_PENDING_BYTES: number;
+export declare const RESOURCE_ASSEMBLY_BYTES: number;
+/** Lazily yield byte chunks so backpressure never queues an entire large record.
+ * Base64 prevents splitting a Unicode scalar from corrupting JSON/SSE parsing. */
+export declare function resourceFrames(envelope: ResourceEnvelope): Generator<ResourceWireFrame>;
+/** One Fleet HTTP writer. The active record owns the assembly budget;
+ * waiting live records share the smaller pending-output budget. */
+export declare class ResourceOutput {
+    #private;
+    readonly response: ServerResponse;
+    readonly signal: AbortSignal;
+    readonly failed: (error: Error) => void;
+    constructor(response: ServerResponse, signal: AbortSignal, failed: (error: Error) => void);
+    send(envelope: ResourceEnvelope): Promise<void>;
+    close(error?: Error): void;
+}
+export interface ResourceDescriptor {
+    viewId: string;
+    resource: 'directory' | 'roles' | 'tasks' | 'task-lists' | 'configuration' | 'previews' | 'task-layout' | 'creation-action' | 'action' | 'member-addition' | 'login' | 'onboarding-health' | 'subscriptions';
+    entityId?: string;
+    receiptId?: string;
+    provider?: 'claude' | 'codex';
+    includeTemporary?: boolean;
+    includeDefinitions?: boolean;
+    ids?: string[];
+    state?: string;
+    list?: string;
+    groupByList?: boolean;
+    includeDeleting?: boolean;
+}
+export declare function canonicalResourceDescriptor(input: unknown): ResourceDescriptor;
+interface BoundProjection {
+    payload: unknown;
+    source: FleetResourceState;
+    producerGeneration: string;
+    revision: number;
+    baselineId: string;
+    descriptor: ResourceDescriptor;
+}
+export declare class ResourceBindingError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/** Same committed snapshot/ready/bound-read contract as Messenger. No controllers,
+ * notification reads or presence are acquired by this delivery owner. */
+export declare class FleetResourceViews {
+    private scope;
+    private project;
+    readonly producerGeneration: `${string}-${string}-${string}-${string}-${string}`;
+    private connections;
+    constructor(scope: FleetResourceScope, project: (descriptor: ResourceDescriptor, signal: AbortSignal, owner: string) => Promise<unknown>);
+    open(response: ServerResponse, owner: string, authorized: () => boolean): {
+        connectionId: `${string}-${string}-${string}-${string}-${string}`;
+        close: () => void;
+    };
+    register(owner: string, connectionId: string, viewId: string, epoch: number, input: unknown): {
+        subscriptionEpoch: number;
+        baselineId: string;
+    };
+    remove(owner: string, connectionId: string, viewId: string, epoch: number): void;
+    bound(owner: string, connectionId: string, viewId: string, epoch: number, baselineId: string): Promise<BoundProjection>;
+    close(): void;
+    private get;
+    private current;
+    private retire;
+    private emit;
+    private affects;
+    private schedule;
+    private refresh;
+}
+export {};