@ricsam/r5d-worker 0.0.161 → 0.0.163

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.161",
+  "version": "0.0.163",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.161";
+  if (true) return "0.0.163";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.161" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.163" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.161" : "development"
+    true ? "0.0.163" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.161",
+  "version": "0.0.163",
   "type": "module"
 }

package/dist/mjs/personal/client.mjs

@@ -103,7 +103,7 @@ async function startPersonalWorker(options, version) {
     platform: process.platform,
     arch: process.arch,
     hostname: os.hostname(),
-    capabilities: { updateClis: true, durableWorkspace: true }
+    capabilities: { updateClis: true, durableWorkspace: true, outerWorkspace: true }
   });
   const grant = PersonalWorkerGrant.parse(
     await request("/api/personal/resources/register", { kind: "worker", ...identity, label: options.label, metadata: metadata() })
@@ -116,7 +116,7 @@ async function startPersonalWorker(options, version) {
       try {
         const response = await request(`${endpoint}/storage`, {
           instanceId: identity.instanceId,
-          request: { sessionId, envelope: { protocol: 1, installationId: grant.installationId, request: storageRequest } }
+          request: { ...sessionId === null ? { scope: "account" } : { sessionId }, envelope: { protocol: 1, installationId: grant.installationId, request: storageRequest } }
         });
         if (!response || !("result" in response)) throw new Error("Invalid scoped storage response");
         return response.result;

package/dist/mjs/personal/publication-refusal.mjs

@@ -0,0 +1,47 @@
+const CONFLICT_PUBLICATION_CODES = /* @__PURE__ */ new Set([
+  "conflict",
+  "sync_conflict",
+  "workbench_conflict",
+  "workbench_operation_in_progress"
+]);
+const TRANSIENT_PUBLICATION_CODES = /* @__PURE__ */ new Set([
+  "not_initialized",
+  "apply_refused",
+  "mirror_advanced",
+  "authority_closed",
+  "busy"
+]);
+const BLOCKED_PUBLICATION_CODES = /* @__PURE__ */ new Set([
+  "secret_or_runtime_path",
+  "secret_content",
+  "unsafe_file",
+  "unsafe_git",
+  "unsafe_path",
+  "unsafe_tree",
+  "too_large"
+]);
+const PUBLICATION_OBSERVATION_THRESHOLDS = /* @__PURE__ */ new Map([["unsafe_file", 2]]);
+const OPERATION_IN_PROGRESS_CODE = "workbench_operation_in_progress";
+const ABANDONED_OPERATION_OBSERVATIONS = 2;
+const STUCK_OPERATION_OBSERVATIONS = 30;
+function publicationRefusalOutcome(code) {
+  if (CONFLICT_PUBLICATION_CODES.has(code)) return "conflict_blocked";
+  if (BLOCKED_PUBLICATION_CODES.has(code)) return "large_diff_blocked";
+  return "failed";
+}
+function publicationRefusalElects(code, observations, context = {}) {
+  if (code === OPERATION_IN_PROGRESS_CODE)
+    return context.workbenchHasLiveRun ? observations >= STUCK_OPERATION_OBSERVATIONS : observations >= ABANDONED_OPERATION_OBSERVATIONS;
+  return observations >= (PUBLICATION_OBSERVATION_THRESHOLDS.get(code) ?? 1);
+}
+export {
+  ABANDONED_OPERATION_OBSERVATIONS,
+  BLOCKED_PUBLICATION_CODES,
+  CONFLICT_PUBLICATION_CODES,
+  OPERATION_IN_PROGRESS_CODE,
+  PUBLICATION_OBSERVATION_THRESHOLDS,
+  STUCK_OPERATION_OBSERVATIONS,
+  TRANSIENT_PUBLICATION_CODES,
+  publicationRefusalElects,
+  publicationRefusalOutcome
+};

package/dist/mjs/personal/runtime.mjs

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { publicationRefusalElects, publicationRefusalOutcome, TRANSIENT_PUBLICATION_CODES } from "./publication-refusal.mjs";
 import { PersonalTcpManager } from "./tcp.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { promises as fs } from "node:fs";
@@ -11,6 +12,7 @@ import { EXECUTOR_CAPABILITY, ExecutorCredential } from "../runtime/protocol.mjs
 import { privateDirectory, readPrivateJson } from "../runtime/storage.mjs";
 import { WorkspaceAuthority } from "../runtime/workspace/authority.mjs";
 import { ApprovedWorkbench, WorkspaceError } from "../runtime/workspace/contracts.mjs";
+import { OuterSnapshotRefusal } from "../runtime/workspace/outer.mjs";
 import { WorkspaceStorageClient } from "../runtime/workspace/storage-client.mjs";
 import { BranchName, GitOid, StorageId } from "../runtime/workspace/storage-wire.mjs";
 const PersonalWorkerGrant = z.object({
@@ -203,7 +205,11 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       config: { installationId: grant.installationId, root: authorityRoot, workspaceRoot, dynamicWorkbenches: true, workbenches: [] },
       executor: async () => ({ client, workerFence: current.workerFence }),
       resolveWorkbench: async (identity) => identity.userId === grant.userId ? manifests.get(routes.get(identity.sessionId) ?? "") ?? null : null,
-      storage: async (identity) => new WorkspaceStorageClient(grant.installationId, options.storage(identity.sessionId), async () => current.workerFence)
+      storage: async (identity) => new WorkspaceStorageClient(grant.installationId, options.storage(identity.sessionId), async () => current.workerFence),
+      accountStorage: async (userId) => {
+        if (userId !== grant.userId) throw new Error("Wrong personal worker principal");
+        return new WorkspaceStorageClient(grant.installationId, options.storage(null), async () => current.workerFence);
+      }
     });
     async function approve(input) {
       const cwd = input.rootProfile === "account" ? workspaceRoot : input.namespace && input.projectName ? path.join(workspaceRoot, "projects", input.namespace, input.projectName, ...input.branch.split("/")) : path.join(workspaceRoot, "workbenches", input.id);
@@ -253,62 +259,46 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         }
       }
     }
-    const blockedPublicationCodes = /* @__PURE__ */ new Set([
-      "secret_or_runtime_path",
-      "secret_content",
-      "unsafe_file",
-      "unsafe_git",
-      "unsafe_path",
-      "unsafe_tree",
-      "too_large"
-    ]);
-    const conflictPublicationCodes = /* @__PURE__ */ new Set(["conflict", "workbench_conflict"]);
     const failedPublicationAttempts = /* @__PURE__ */ new Map();
     let publication = null, closing = false;
     const synchronize = () => {
       if (publication) return publication;
       const next = (async () => {
         const results = [];
-        for (const [workbenchId, sessionId] of publicationSessions) {
-          if (closing) break;
-          const manifest = manifests.get(workbenchId);
-          if (!manifest || manifest.rootProfile !== "project") continue;
-          try {
-            const result = await authority.publish({ userId: grant.userId, sessionId });
-            failedPublicationAttempts.delete(workbenchId);
-            results.push({ workbenchId, ...result });
-          } catch (error) {
-            const code = error instanceof WorkspaceError ? error.code : "publication_failed";
-            results.push({ workbenchId, error: code });
-            if (code !== "not_initialized" && options.publicationReport) {
-              let startingHead = null;
-              try {
-                const status = await authority.status({ userId: grant.userId, sessionId });
-                startingHead = status.head;
-              } catch {
-              }
-              const outcome = conflictPublicationCodes.has(code) ? "conflict_blocked" : blockedPublicationCodes.has(code) ? "large_diff_blocked" : "failed";
-              const fingerprint = canonicalJson({ code, startingHead, outcome });
-              let attempt = failedPublicationAttempts.get(workbenchId);
-              if (!attempt || attempt.fingerprint !== fingerprint) {
-                attempt = { fingerprint, attemptId: randomUUID(), observations: 1 };
-                failedPublicationAttempts.set(workbenchId, attempt);
-              } else {
-                attempt.observations++;
-              }
-              if (code === "unsafe_file" && attempt.observations < 2) continue;
+        try {
+          const outer = await authority.synchronizeOuter(grant.userId);
+          failedPublicationAttempts.delete("workspace");
+          results.push({ workbenchId: "workspace", ...outer });
+        } catch (error) {
+          const code = error instanceof WorkspaceError ? error.code : "publication_failed";
+          results.push({ workbenchId: "workspace", error: code });
+          if (!TRANSIENT_PUBLICATION_CODES.has(code) && options.publicationReport) {
+            let startingHead = null;
+            try {
+              startingHead = (await authority.outerStatus(grant.userId)).publishedHead;
+            } catch {
+            }
+            const outcome = publicationRefusalOutcome(code);
+            const paths = error instanceof OuterSnapshotRefusal ? error.paths : [];
+            const fingerprint = canonicalJson({ code, startingHead, outcome, paths });
+            let attempt = failedPublicationAttempts.get("workspace");
+            if (!attempt || attempt.fingerprint !== fingerprint) {
+              attempt = { fingerprint, attemptId: randomUUID(), observations: 1 };
+              failedPublicationAttempts.set("workspace", attempt);
+            } else {
+              attempt.observations++;
+            }
+            if (publicationRefusalElects(code, attempt.observations)) {
               try {
                 await options.publicationReport(WorkspacePublicationReport.parse({
                   protocol: 1,
                   attemptId: attempt.attemptId,
-                  sessionId,
-                  workbenchId,
-                  repositoryId: manifest.repositoryId,
-                  branch: manifest.branch,
+                  scope: "workspace",
                   outcome,
                   startingHead,
                   diffSizeBytes: outcome === "large_diff_blocked" && code === "too_large" ? 5 * 1024 * 1024 + 1 : 0,
-                  error: code
+                  error: code,
+                  ...paths.length ? { paths } : {}
                 }));
               } catch (reportError) {
                 process.stderr.write(`[r5d-worker] publication report deferred: ${reportError instanceof WorkspaceError ? reportError.code : "publication_report_failed"}
@@ -317,13 +307,24 @@ exec ${quote(executable)} ${quote(cli)} "$@"
             }
           }
         }
+        for (const [workbenchId, sessionId] of publicationSessions) {
+          if (closing) break;
+          const manifest = manifests.get(workbenchId);
+          if (!manifest || manifest.rootProfile !== "project") continue;
+          try {
+            results.push({ workbenchId, ...await authority.mirror({ userId: grant.userId, sessionId }) });
+          } catch (error) {
+            results.push({ workbenchId, error: error instanceof WorkspaceError ? error.code : "mirror_failed" });
+          }
+        }
         return results;
       })();
       publication = next;
       void next.then(
         (results) => {
-          if (results.some((result) => result.error && result.error !== "not_initialized"))
-            process.stderr.write(`[r5d-worker] periodic workspace publication deferred: ${results.filter((result) => result.error).map((result) => `${result.workbenchId}:${result.error}`).join(", ")}
+          const deferred = results.filter((result) => result.error && !TRANSIENT_PUBLICATION_CODES.has(result.error));
+          if (deferred.length)
+            process.stderr.write(`[r5d-worker] periodic workspace publication deferred: ${deferred.map((result) => `${result.workbenchId}:${result.error}`).join(", ")}
 `);
           if (publication === next) publication = null;
         },