@ricsam/r5d-worker 0.0.162 → 0.0.164

package/dist/mjs/runtime/workspace/authority.mjs

@@ -11,6 +11,7 @@ import {
   WorkspaceConfig,
   WorkspaceError
 } from "./contracts.mjs";
+import { OuterRepository, OuterSnapshotRefusal, OUTER_BRANCH, OUTER_CONFLICT_CODE } from "./outer.mjs";
 import { SessionArtifactStore, SessionArtifactChunk, RESERVED_ARTIFACT_ENV } from "./artifacts.mjs";
 import { WorkspaceFileWrite, WorkspaceFileWriteLookup } from "./file-write.mjs";
 import { WorkspaceStorageClient } from "./storage-client.mjs";
@@ -18,9 +19,12 @@ import {
   durableJson,
   ensureAuthorityGitRepositoryLayout,
   git,
+  gitResult,
   materializeTree,
   noSymlinkAncestors,
+  PLATFORM_COMMIT_EMAILS,
   privateRoot,
+  PROJECT_COMMIT_IDENTITY,
   readHostRegular,
   readRegular,
   selectedTree,
@@ -45,6 +49,7 @@ class WorkspaceAuthority {
   closeTask;
   actions = /* @__PURE__ */ new Set();
   repositoryInitializations = /* @__PURE__ */ new Map();
+  outerRepository;
   pending = 0;
   expectedCwd(config) {
     const workspaceRoot = this.config.workspaceRoot ?? this.config.root;
@@ -227,7 +232,10 @@ class WorkspaceAuthority {
   hydrations = /* @__PURE__ */ new Map();
   async ensureHydrated(identity) {
     const b = await this.bench(identity);
-    if (b.config.rootProfile === "account") return;
+    if (b.config.rootProfile === "account") {
+      if (this.outerEnabled()) await this.synchronizeOuter(b.config.userId, { bootstrapOnly: true });
+      return;
+    }
     if (b.state.initialized) return;
     let task = this.hydrations.get(b.config.id);
     if (!task) {
@@ -312,10 +320,12 @@ class WorkspaceAuthority {
   async inspectGit(identity, command) {
     const b = await this.bench(identity);
     return this.serial(b, async () => {
-      if (!b.state.initialized || !b.state.head) throw new WorkspaceError("not_initialized", "Initialize workspace first");
-      const head = b.state.head;
+      if (!b.state.initialized) throw new WorkspaceError("not_initialized", "Initialize workspace first");
+      const innerHead = this.outerEnabled(b) && this.linkedWorkbench(b) ? await this.innerHead(b) : void 0;
+      const head = innerHead === void 0 ? b.state.head : innerHead ?? (await git(b.repo, ["hash-object", "-t", "tree", "--stdin"], "")).toString().trim();
+      if (!head) throw new WorkspaceError("not_initialized", "Initialize workspace first");
       const base = command.base ? GitOid.parse(command.base) : head;
-      const treeHash = await snapshotTree(b.repo, b.config.cwd, head);
+      const treeHash = await snapshotTree(b.repo, b.config.cwd, innerHead === void 0 ? head : innerHead);
       if (command.method === "history") {
         const history = (await git(b.repo, ["log", "-100", "--format=%H%x00%P%x00%s%x00%an%x00%ae%x00%aI%x00%cI", head])).toString();
         return { head, treeHash, commits: history.trimEnd().split("\n").filter(Boolean).map((line) => {
@@ -363,10 +373,12 @@ class WorkspaceAuthority {
     if (owner.lockId !== this.lockId) throw new WorkspaceError("authority_lost", "Workspace authority lock changed");
   }
   serial(b, fn, admitted = false) {
+    return this.serialKey(this.linkedWorkbench(b) ? b.repo : b.config.id, fn, admitted);
+  }
+  serialKey(queueKey, fn, admitted = false) {
     if (this.closing && !admitted) return Promise.reject(new WorkspaceError("authority_closed", "Workspace authority is closing"));
     if (this.pending >= 32) return Promise.reject(new WorkspaceError("busy", "Workspace request budget reached"));
     this.pending++;
-    const queueKey = this.linkedWorkbench(b) ? b.repo : b.config.id;
     const task = (this.queues.get(queueKey) ?? Promise.resolve()).catch(() => {
     }).then(async () => {
       await this.owned(admitted);
@@ -442,7 +454,14 @@ class WorkspaceAuthority {
       state.runs = Object.fromEntries(
         Object.entries(state.runs).filter(([, run]) => (run.sessionId ?? b.config.sessionId) === identity.sessionId)
       );
-      return { workbench: { ...b.config, sessionId: identity.sessionId }, ...state, files };
+      let outer;
+      if (b.config.rootProfile === "account" && this.outerEnabled()) {
+        outer = structuredClone((await this.outer(b.config.userId)).state);
+        state.initialized = outer.initialized;
+        state.head = outer.head;
+        state.blocked = outer.blocked;
+      }
+      return { workbench: { ...b.config, sessionId: identity.sessionId }, ...state, files, ...outer ? { outer } : {} };
     });
   }
   async cleanRefreshBase(b, expectedBase) {
@@ -476,7 +495,18 @@ class WorkspaceAuthority {
    * clean workbench refresh; process/PTY liveness never gates synchronization. */
   async hydrate(identity, expectedBase) {
     const b = await this.bench(identity);
-    if (b.config.rootProfile === "account") return { head: "", unchanged: true };
+    if (b.config.rootProfile === "account") {
+      if (!this.outerEnabled()) return { head: "", unchanged: true };
+      return this.synchronizeOuter(b.config.userId, expectedBase === void 0 ? { bootstrapOnly: true } : { requireHead: GitOid.parse(expectedBase) });
+    }
+    if (this.outerEnabled(b)) {
+      if (!b.state.initialized) {
+        await this.synchronizeOuter(b.config.userId, { bootstrapOnly: true });
+        await this.serial(b, () => this.hydrateLinkedIdle(b, identity));
+      }
+      if (expectedBase !== void 0) return this.synchronizeOuter(b.config.userId, { requireHead: GitOid.parse(expectedBase) });
+      return { head: b.state.head ?? "" };
+    }
     return this.serial(b, () => this.hydrateIdle(b, identity, expectedBase));
   }
   async hydrateIdle(b, identity, expectedBase) {
@@ -532,27 +562,7 @@ class WorkspaceAuthority {
       message: "Source synchronization interrupted; preserve workbench and inspect staged tree/retained originals before maintenance"
     };
     await this.save(b);
-    const chunks = [];
-    let offset = 0, snapshot = null, size = -1, hash = "";
-    do {
-      const chunk = await storage.read({
-        method: "repository.bundle",
-        repositoryId: b.config.repositoryId,
-        snapshot,
-        offset,
-        limit: STORAGE_LIMITS.chunkBytes
-      });
-      const bytes = Buffer.from(chunk.data, "base64");
-      if (chunk.data !== bytes.toString("base64") || bytes.length > STORAGE_LIMITS.chunkBytes || chunk.offset !== offset || chunk.nextOffset !== offset + bytes.length || !bytes.length || chunk.size > STORAGE_LIMITS.blobBytes || chunk.nextOffset > chunk.size || snapshot && (snapshot !== chunk.snapshot || size !== chunk.size || hash !== chunk.sha256))
-        throw new WorkspaceError("invalid_bundle", "Chunk identity/size/offset changed; no checkout performed");
-      snapshot = chunk.snapshot;
-      size = chunk.size;
-      hash = chunk.sha256;
-      offset = chunk.nextOffset;
-      chunks.push(bytes);
-    } while (offset < size);
-    const bundle = Buffer.concat(chunks);
-    if (sha256(bundle) !== hash) throw new WorkspaceError("invalid_bundle", "Bundle SHA256 mismatch");
+    const bundle = await this.downloadBundle(storage, b.config.repositoryId);
     const file = path.join(b.directory, `${randomUUID()}.bundle`);
     await fs.writeFile(file, bundle, { mode: 384, flag: "wx" });
     await git(b.repo, ["bundle", "unbundle", file]);
@@ -776,9 +786,11 @@ class WorkspaceAuthority {
       b.state.initialized = true;
       b.state.blocked = null;
       await this.save(b);
-      const result = await this.publishIdle(b, identity);
+      const result = await this.publishIdle(b, identity, this.linkedWorkbench(b) ? "Initialize project" : void 0, false, this.linkedWorkbench(b));
       if (this.linkedWorkbench(b)) {
         await fs.unlink(path.join(b.config.cwd, "README.md"));
+        b.state.mirroredHead = result.head;
+        await this.save(b);
       }
       await this.installGitPolicy(b, result.head);
       return result;
@@ -804,22 +816,7 @@ class WorkspaceAuthority {
           await git(b.config.cwd, ["reset", "--mixed", visibleHead]);
         }
       }
-      const origin = this.githubOrigin(b);
-      await git(b.repo, ["config", "--local", "--replace-all", "remote.origin.url", origin]);
-      await git(b.repo, ["config", "--local", "--replace-all", "remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*"]);
-      const localConfig = (await readRegular(path.join(b.repo, "config"), 128 * 1024)).toString("utf8");
-      if (/^\[remote "canonical"\]\s*$/m.test(localConfig))
-        await git(b.repo, ["config", "--local", "--remove-section", "remote.canonical"]);
-      await git(b.repo, ["config", "--local", "--replace-all", `branch.${b.config.branch}.remote`, "origin"]);
-      await git(b.repo, ["config", "--local", "--replace-all", `branch.${b.config.branch}.merge`, `refs/heads/${b.config.branch}`]);
-      if (remoteTrackingHead)
-        await git(b.repo, ["update-ref", `refs/remotes/origin/${b.config.branch}`, remoteTrackingHead]);
-      await git(b.repo, ["config", "--local", "--replace-all", "push.default", "upstream"]);
-      await git(b.repo, ["config", "--local", "--replace-all", "credential.helper", ""]);
-      await git(b.repo, ["config", "--local", "--add", "credential.helper", GITHUB_CREDENTIAL_HELPER]);
-      await git(b.repo, ["config", "--local", "--replace-all", "credential.useHttpPath", "false"]);
-      await git(b.repo, ["config", "protocol.allow", "never"]);
-      await git(b.repo, ["config", "protocol.https.allow", "always"]);
+      await this.configureLinkedRemote(b, remoteTrackingHead);
       return;
     }
     const destination = path.join(b.config.cwd, ".git");
@@ -848,6 +845,28 @@ class WorkspaceAuthority {
     await fs.writeFile(ref, `${head}
 `, { mode: 384 });
   }
+  /** This repository is also the common Git directory for the visible project
+   * worktrees. Keep their ordinary Git topology pointed at GitHub; mirroring is
+   * performed by WorkspaceAuthority directly and must never be exposed as the
+   * checkout's origin. */
+  async configureLinkedRemote(b, remoteTrackingHead = b.config.baseCommitHash) {
+    const origin = this.githubOrigin(b);
+    await git(b.repo, ["config", "--local", "--replace-all", "remote.origin.url", origin]);
+    await git(b.repo, ["config", "--local", "--replace-all", "remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*"]);
+    const localConfig = (await readRegular(path.join(b.repo, "config"), 128 * 1024)).toString("utf8");
+    if (/^\[remote "canonical"\]\s*$/m.test(localConfig))
+      await git(b.repo, ["config", "--local", "--remove-section", "remote.canonical"]);
+    await git(b.repo, ["config", "--local", "--replace-all", `branch.${b.config.branch}.remote`, "origin"]);
+    await git(b.repo, ["config", "--local", "--replace-all", `branch.${b.config.branch}.merge`, `refs/heads/${b.config.branch}`]);
+    if (remoteTrackingHead)
+      await git(b.repo, ["update-ref", `refs/remotes/origin/${b.config.branch}`, remoteTrackingHead]);
+    await git(b.repo, ["config", "--local", "--replace-all", "push.default", "upstream"]);
+    await git(b.repo, ["config", "--local", "--replace-all", "credential.helper", ""]);
+    await git(b.repo, ["config", "--local", "--add", "credential.helper", GITHUB_CREDENTIAL_HELPER]);
+    await git(b.repo, ["config", "--local", "--replace-all", "credential.useHttpPath", "false"]);
+    await git(b.repo, ["config", "protocol.allow", "never"]);
+    await git(b.repo, ["config", "protocol.https.allow", "always"]);
+  }
   /** Scoped receipt lookup never repeats a file effect; completion can clear its own crash marker. */
   async fileWriteResult(identity, input) {
     WorkspaceFileWriteLookup.parse({ method: "fileWriteResult", ...input });
@@ -1056,10 +1075,7 @@ class WorkspaceAuthority {
     const bytes = await readRegular(file, STORAGE_LIMITS.blobBytes), blobId = operationId;
     b.state.blocked = { code: "publication_unknown", operationId, commit: head, message: "Inspect the original import publication receipt" };
     await this.save(b);
-    for (let offset = 0; offset < bytes.length; offset += STORAGE_LIMITS.chunkBytes) {
-      const end = Math.min(bytes.length, offset + STORAGE_LIMITS.chunkBytes);
-      await storage.mutate({ method: "blob.append", operationId: `${operationId}-chunk-${offset}`, blobId, kind: "blob", offset, data: bytes.subarray(offset, end).toString("base64"), seal: end === bytes.length });
-    }
+    await this.uploadBundle(storage, bytes, blobId, operationId);
     const result = await storage.mutate({ method: "repository.publish", operationId, repositoryId: b.config.repositoryId, branch: b.config.branch, expectedHead: null, commit: head, bundleId: blobId });
     if (result.head !== head) throw new WorkspaceError("invalid_receipt", "Import receipt does not match selected commit");
     if (this.linkedWorkbench(b)) await fs.rm(staged, { recursive: true });
@@ -1068,6 +1084,7 @@ class WorkspaceAuthority {
     b.state.initialized = true;
     b.state.head = head;
     b.state.blocked = null;
+    b.state.mirroredHead = head;
     await this.save(b);
     return { head, workspaceHead: head };
   }
@@ -1075,6 +1092,10 @@ class WorkspaceAuthority {
     const b = await this.bench(identity);
     if (!input.message.trim() || input.message.length > 1e4) throw new WorkspaceError("invalid_input", "Commit message is required");
     return this.serial(b, () => this.productAction(b, input.id, { method: "commit", expectedHead: input.expectedHead, message: input.message }, async () => {
+      if (this.outerEnabled(b)) {
+        const result2 = await this.commitInnerIdle(b, identity, input.message);
+        return { ...result2, treeHash: (await git(b.repo, ["rev-parse", `${result2.head}^{tree}`])).toString().trim() };
+      }
       const result = await this.publishIdle(b, identity, input.message);
       if (this.linkedWorkbench(b)) {
         return { ...result, treeHash: (await git(b.repo, ["rev-parse", `${result.head}^{tree}`])).toString().trim() };
@@ -1088,22 +1109,24 @@ class WorkspaceAuthority {
       return { ...result, treeHash: (await git(b.repo, ["rev-parse", `${result.head}^{tree}`])).toString().trim() };
     }, async () => {
       await this.assertAvailable(b);
-      if (input.expectedHead !== void 0 && input.expectedHead !== b.state.head) throw new WorkspaceError("conflict", "Workbench head changed");
+      if (input.expectedHead !== void 0 && !await this.headMatches(b, input.expectedHead)) throw new WorkspaceError("conflict", "Workbench head changed");
     }));
   }
   async push(identity, input) {
     const b = await this.bench(identity);
     this.validateGithubRemote(input.remote);
     return this.serial(b, () => this.productAction(b, input.id, { method: "push", expectedHead: input.expectedHead, url: input.remote.url, branch: input.remote.branch, expectedRemoteHead: input.remote.expectedHead }, async () => {
+      const head = this.outerEnabled(b) ? await this.innerHead(b) : b.state.head;
+      if (!head) throw new WorkspaceError("conflict", "The checkout has no commit to push");
       if (input.remote.expectedHead) {
         GitOid.parse(input.remote.expectedHead);
-        await git(b.repo, ["merge-base", "--is-ancestor", input.remote.expectedHead, b.state.head]);
+        await git(b.repo, ["merge-base", "--is-ancestor", input.remote.expectedHead, head]);
       }
-      await git(b.repo, ["-c", "protocol.https.allow=always", "push", "--porcelain", ...input.remote.expectedHead !== void 0 ? [`--force-with-lease=refs/heads/${input.remote.branch}:${input.remote.expectedHead ?? ""}`] : [], "--", input.remote.url, `${b.state.head}:refs/heads/${input.remote.branch}`], void 0, void 0, { token: input.remote.token });
-      return { head: b.state.head, pushed: true };
+      await git(b.repo, ["-c", "protocol.https.allow=always", "push", "--porcelain", ...input.remote.expectedHead !== void 0 ? [`--force-with-lease=refs/heads/${input.remote.branch}:${input.remote.expectedHead ?? ""}`] : [], "--", input.remote.url, `${head}:refs/heads/${input.remote.branch}`], void 0, void 0, { token: input.remote.token });
+      return { head, pushed: true };
     }, async () => {
       await this.assertAvailable(b);
-      if (!b.state.head || input.expectedHead !== void 0 && input.expectedHead !== b.state.head) throw new WorkspaceError("conflict", "Workbench head changed");
+      if (input.expectedHead !== void 0 && !await this.headMatches(b, input.expectedHead)) throw new WorkspaceError("conflict", "Workbench head changed");
     }));
   }
   async archiveBranch(identity, input) {
@@ -1136,8 +1159,11 @@ class WorkspaceAuthority {
         const receipt = await storage.read({ method: "operation.get", lookupId: b.state.blocked.operationId });
         if (receipt.state !== "completed" || b.state.blocked.commit && receipt.result?.head !== b.state.blocked.commit) throw new WorkspaceError("publication_unknown", "Reconcile the original publication before resetting");
       }
-      const canonical = await storage.read({ method: "repository.get", repositoryId: b.config.repositoryId, branch: b.config.branch });
-      if (!canonical.head) throw new WorkspaceError("empty_repository", "No canonical source exists to restore");
+      const canonical = await storage.read({ method: "repository.get", repositoryId: b.config.repositoryId, branch: b.config.branch }).catch((error) => {
+        if (this.outerEnabled(b) && error instanceof WorkspaceError && error.code === "not_found") return { head: null };
+        throw error;
+      });
+      if (!canonical.head && !this.outerEnabled(b)) throw new WorkspaceError("empty_repository", "No canonical source exists to restore");
       const retained = path.join(b.directory, `reset-retained-${randomUUID()}`);
       await fs.mkdir(retained, { mode: 448 });
       await durableJson(path.join(retained, "recovery.json"), { workbench: b.config, previousState: b.state, resetId: input.id, targetHead: canonical.head });
@@ -1153,21 +1179,451 @@ class WorkspaceAuthority {
       b.state.initialized = false;
       b.state.head = null;
       b.state.blocked = null;
+      b.state.mirroredHead = null;
       await this.save(b);
-      const result = await this.hydrateIdle(b, identity);
+      const result = this.outerEnabled(b) ? await this.hydrateLinkedIdle(b, identity) : await this.hydrateIdle(b, identity);
       return { ...result, reset: true, retained: true };
     }));
   }
+  // ---- Outer repository ---------------------------------------------------
+  outerEnabled(b) {
+    return !!this.options.accountStorage && (!b || b.config.rootProfile === "account" || this.linkedWorkbench(b));
+  }
+  outerStateFile() {
+    return path.join(this.config.root, "state", "outer.json");
+  }
+  async outer(userId) {
+    if (!this.options.accountStorage) throw new WorkspaceError("outer_unavailable", "This authority has no account storage");
+    const workTree = this.config.workspaceRoot;
+    if (!workTree) throw new WorkspaceError("invalid_config", "The outer repository requires a workspace root");
+    if (!this.outerRepository)
+      this.outerRepository = (async () => {
+        const repo = await OuterRepository.open(path.join(this.config.root, "outer.git"), workTree);
+        const stored = await readRegular(this.outerStateFile(), 1024 * 1024).catch((error) => {
+          if (error.code === "ENOENT") return null;
+          throw error;
+        });
+        const state = stored ? JSON.parse(stored.toString("utf8")) : { userId, initialized: false, publishedHead: null, head: null, blocked: null, conflict: null };
+        if (typeof state.initialized !== "boolean" || !(state.head === null || GitOid.safeParse(state.head).success))
+          throw new WorkspaceError("invalid_state", "Invalid durable outer repository state; maintenance required");
+        if (!stored) await durableJson(this.outerStateFile(), state);
+        return { repo, state };
+      })();
+    const outer = await this.outerRepository.catch((error) => {
+      this.outerRepository = void 0;
+      throw error;
+    });
+    if (outer.state.userId !== userId) throw new WorkspaceError("wrong_binding", "The outer repository belongs to another account");
+    return outer;
+  }
+  saveOuter(state) {
+    return durableJson(this.outerStateFile(), state);
+  }
+  async outerStatus(userId) {
+    return structuredClone((await this.outer(userId)).state);
+  }
+  accountRepositoryId(userId) {
+    return `user-workspace-${sha256(userId).slice(0, 40)}`;
+  }
+  provisionId(repositoryId) {
+    return `provision-${sha256(repositoryId).slice(0, 48)}`;
+  }
+  async hasCommit(repo, commit) {
+    return (await gitResult(repo, ["cat-file", "-e", `${GitOid.parse(commit)}^{commit}`])).code === 0;
+  }
+  async innerHead(b) {
+    const { code, stdout } = await gitResult(b.config.cwd, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+    if (code === 1) return null;
+    if (code !== 0) throw new WorkspaceError("unsafe_git", "Project checkout HEAD is unreadable");
+    return GitOid.parse(stdout.toString("utf8").trim());
+  }
+  async headMatches(b, expected) {
+    if (!this.outerEnabled(b)) return expected === b.state.head;
+    return expected === b.state.mirroredHead || expected === await this.innerHead(b);
+  }
+  async innerTracked(b) {
+    const head = await this.innerHead(b);
+    if (!head) return /* @__PURE__ */ new Set();
+    const listing = await git(b.repo, ["ls-tree", "-r", "--name-only", "-z", head]);
+    return new Set(listing.toString("utf8").split("\0").filter(Boolean));
+  }
+  /** Platform snapshot commits from the per-project model sit on top of the
+   * GitHub tip. Hydration peels them so a checkout's history is its own. */
+  async platformSnapshot(repo, commit) {
+    const header = (await git(repo, ["cat-file", "commit", commit])).toString("utf8").split("\n\n")[0] ?? "";
+    const committer = /^committer .*<([^>]+)>/m.exec(header)?.[1];
+    return committer !== void 0 && PLATFORM_COMMIT_EMAILS.includes(committer);
+  }
+  async firstParent(repo, commit) {
+    const parents = (await git(repo, ["rev-list", "--parents", "-n", "1", commit])).toString("utf8").trim().split(/\s+/).slice(1);
+    return parents[0] ? GitOid.parse(parents[0]) : null;
+  }
+  /** Every initialized project checkout beneath the workspace root, for the
+   * outer walk and the measure. */
+  async innerCheckouts(userId) {
+    const workTree = this.config.workspaceRoot;
+    const result = [];
+    for (const b of this.benches.values()) {
+      if (b.config.userId !== userId || !this.linkedWorkbench(b) || !b.state.initialized || b.state.blocked?.code === "archived") continue;
+      const relative = path.relative(workTree, b.config.cwd);
+      if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) continue;
+      if (!await fs.lstat(b.config.cwd).then((stat) => stat.isDirectory(), () => false)) continue;
+      result.push({ bench: b, root: relative.split(path.sep).join("/"), tracked: () => this.innerTracked(b) });
+    }
+    return result;
+  }
+  /** The mirror's head for a branch, or null when it has none. Only a caller
+   * that owns the repository's existence provisions it: a project repository
+   * is provisioned by its seed or import under that action's own identity. */
+  async remoteHead(storage, repositoryId, branch, provision = false) {
+    try {
+      return (await storage.read({ method: "repository.get", repositoryId, branch })).head;
+    } catch (error) {
+      if (!(error instanceof WorkspaceError) || error.code !== "not_found") throw error;
+      if (provision) await storage.mutate({ method: "repository.provision", operationId: this.provisionId(repositoryId), repositoryId });
+      return null;
+    }
+  }
+  async downloadBundle(storage, repositoryId) {
+    const chunks = [];
+    let offset = 0, snapshot = null, size = -1, hash = "";
+    do {
+      const chunk = await storage.read({
+        method: "repository.bundle",
+        repositoryId,
+        snapshot,
+        offset,
+        limit: STORAGE_LIMITS.chunkBytes
+      });
+      const bytes = Buffer.from(chunk.data, "base64");
+      if (chunk.data !== bytes.toString("base64") || bytes.length > STORAGE_LIMITS.chunkBytes || chunk.offset !== offset || chunk.nextOffset !== offset + bytes.length || !bytes.length || chunk.size > STORAGE_LIMITS.blobBytes || chunk.nextOffset > chunk.size || snapshot && (snapshot !== chunk.snapshot || size !== chunk.size || hash !== chunk.sha256))
+        throw new WorkspaceError("invalid_bundle", "Chunk identity/size/offset changed; no checkout performed");
+      snapshot = chunk.snapshot;
+      size = chunk.size;
+      hash = chunk.sha256;
+      offset = chunk.nextOffset;
+      chunks.push(bytes);
+    } while (offset < size);
+    const bundle = Buffer.concat(chunks);
+    if (sha256(bundle) !== hash) throw new WorkspaceError("invalid_bundle", "Bundle SHA256 mismatch");
+    return bundle;
+  }
+  async uploadBundle(storage, bytes, blobId, operationId) {
+    for (let offset = 0; offset < bytes.length; offset += STORAGE_LIMITS.chunkBytes) {
+      const end = Math.min(bytes.length, offset + STORAGE_LIMITS.chunkBytes);
+      await storage.mutate({
+        method: "blob.append",
+        operationId: `${operationId}-chunk-${offset}`,
+        blobId,
+        kind: "blob",
+        offset,
+        data: bytes.subarray(offset, end).toString("base64"),
+        seal: end === bytes.length
+      });
+    }
+  }
+  async unbundleInto(b, bytes) {
+    const file = path.join(b.directory, `${randomUUID()}.bundle`);
+    await fs.writeFile(file, bytes, { mode: 384, flag: "wx" });
+    try {
+      await git(b.repo, ["bundle", "unbundle", file]);
+    } finally {
+      await fs.rm(file, { force: true });
+    }
+  }
+  async forcePublishSupported(storage) {
+    const hello = await storage.read({ method: "hello" });
+    return hello.capabilities?.includes("storage-force-publish-v1") === true;
+  }
+  /** One synchronization cycle of the outer repository: snapshot the workspace,
+   * integrate what the mirror gained, publish what changed. Serialized on its
+   * own queue; project checkouts stay ordinary concurrent writers whose later
+   * edits the next cycle observes. */
+  async synchronizeOuter(userId, options = {}) {
+    return this.serialKey("outer", () => this.synchronizeOuterIdle(userId, options));
+  }
+  async synchronizeOuterIdle(userId, options) {
+    await this.owned();
+    const { repo, state } = await this.outer(userId);
+    const storage = await this.options.accountStorage(userId);
+    const repositoryId = this.accountRepositoryId(userId);
+    if (state.blocked?.code === "publication_unknown") {
+      const { operationId: operationId2, commit } = state.blocked;
+      const receipt = await storage.read({ method: "operation.get", lookupId: operationId2 }).catch((error) => {
+        if (error instanceof WorkspaceError && error.code === "not_found") return null;
+        throw error;
+      });
+      if (receipt?.state === "completed" && receipt.result?.head !== commit)
+        throw new WorkspaceError("invalid_state", "Workspace publication receipt names another head; maintenance required");
+      const published = receipt?.state === "completed" || await this.remoteHead(storage, repositoryId, OUTER_BRANCH) === commit;
+      if (published) {
+        state.publishedHead = commit;
+        state.head = commit;
+      }
+      state.blocked = null;
+      await this.saveOuter(state);
+    }
+    if (!state.initialized) {
+      const remote2 = await this.remoteHead(storage, repositoryId, OUTER_BRANCH, true);
+      if (remote2) {
+        if (!await repo.has(remote2)) await repo.unbundle(await this.downloadBundle(storage, repositoryId));
+        if (!await repo.isLegacyBootstrap(remote2)) await repo.checkout(remote2);
+        await repo.setHead(remote2);
+      }
+      state.initialized = true;
+      state.publishedHead = remote2;
+      state.head = remote2;
+      await this.saveOuter(state);
+      if (options.bootstrapOnly) return { head: remote2, unchanged: true };
+    } else if (options.bootstrapOnly) return { head: state.head, unchanged: true };
+    if (state.conflict && !options.resolveConflict)
+      throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Workspace synchronization conflict awaits resolution", state.conflict.paths);
+    const inners = await this.innerCheckouts(userId);
+    let snapshot;
+    try {
+      snapshot = await repo.snapshot(inners, { allowLargeDiff: options.allowLargeDiff });
+    } catch (error) {
+      if (error instanceof OuterSnapshotRefusal) {
+        state.blocked = { code: error.code, message: error.message, paths: error.paths };
+        await this.saveOuter(state);
+      }
+      throw error;
+    }
+    if (state.conflict) {
+      const marker = /^(<{7}|={7}|>{7})( |$)/m;
+      for (const file of state.conflict.paths) {
+        const bytes2 = await readRegular(path.join(repo.workTree, file)).catch((error) => {
+          if (error.code === "ENOENT" || error.code === "ENOTDIR") return null;
+          throw error;
+        });
+        if (bytes2 && marker.test(bytes2.toString("utf8")))
+          throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Conflict markers remain; resolve them before confirming", [file]);
+      }
+    } else if (state.blocked && state.blocked.code !== "publication_unknown") {
+      state.blocked = null;
+      await this.saveOuter(state);
+    }
+    const base = state.publishedHead;
+    const baseTree = base ? await repo.treeOf(base) : await repo.emptyTree();
+    let local;
+    if (state.conflict) {
+      local = await repo.commit(snapshot.tree, [state.conflict.ours, state.conflict.theirs], "Resolve workspace synchronization conflict");
+      state.conflict = null;
+      state.blocked = null;
+    } else if (base && snapshot.tree === baseTree) local = base;
+    else local = await repo.commit(snapshot.tree, base ? [base] : [], "Workspace snapshot");
+    if (state.head !== local) {
+      state.head = local;
+      await repo.setHead(local);
+      await this.saveOuter(state);
+    }
+    const integrated = async (head) => {
+      if (options.requireHead && !await repo.isAncestor(options.requireHead, head))
+        throw new WorkspaceError("conflict", "The required workspace head is not integrated; retry the transfer");
+      return options.requireHead ? { integrated: options.requireHead } : {};
+    };
+    const remote = await this.remoteHead(storage, repositoryId, OUTER_BRANCH, true);
+    let currentTree = snapshot.tree;
+    if (remote && remote !== base) {
+      if (!await repo.has(remote)) await repo.unbundle(await this.downloadBundle(storage, repositoryId));
+      if (local === base) {
+        await repo.apply(currentTree, await repo.treeOf(remote));
+        state.publishedHead = remote;
+        state.head = remote;
+        await repo.setHead(remote);
+        await this.saveOuter(state);
+        return { head: remote, unchanged: false, ...await integrated(remote) };
+      }
+      const merge = await repo.merge(local, remote);
+      if (merge.conflicts.length) {
+        await repo.apply(currentTree, merge.tree);
+        state.conflict = { ours: local, theirs: remote, tree: merge.tree, paths: merge.conflicts };
+        state.blocked = { code: OUTER_CONFLICT_CODE, message: "The workspace diverged from another worker; conflict markers were written to the paths named", paths: merge.conflicts };
+        await this.saveOuter(state);
+        throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, state.blocked.message, merge.conflicts);
+      }
+      await repo.apply(currentTree, merge.tree);
+      currentTree = merge.tree;
+      local = await repo.commit(merge.tree, [local, remote], "Merge workspace");
+      state.head = local;
+      await repo.setHead(local);
+      await this.saveOuter(state);
+    }
+    if (local === remote) {
+      state.publishedHead = local;
+      await this.saveOuter(state);
+      return { head: local, unchanged: true, ...await integrated(local) };
+    }
+    const operationId = `ws-${randomUUID()}`, blobId = `ws-${randomUUID()}`;
+    const bytes = await repo.bundle(remote && await repo.has(remote) ? remote : null);
+    state.blocked = { code: "publication_unknown", operationId, commit: local, message: "Workspace publication is in progress/unknown. Inspect the original storage operation; never retry under a new ID." };
+    await this.saveOuter(state);
+    try {
+      await this.uploadBundle(storage, bytes, blobId, operationId);
+      const result = await storage.mutate({
+        method: "repository.publish",
+        operationId,
+        repositoryId,
+        branch: OUTER_BRANCH,
+        expectedHead: remote,
+        commit: local,
+        bundleId: blobId
+      });
+      if (result.head !== local) throw new WorkspaceError("invalid_response", "Workspace publication receipt head mismatch; inspect original operation");
+    } catch (error) {
+      if (error instanceof WorkspaceError && error.rejectedBeforeAdmission) {
+        state.blocked = null;
+        await this.saveOuter(state);
+        throw error.code === "conflict" ? new WorkspaceError("mirror_advanced", "The workspace mirror advanced during publication; retried next cycle", true) : error;
+      }
+      throw error;
+    }
+    state.publishedHead = local;
+    state.blocked = null;
+    await this.saveOuter(state);
+    return { head: local, unchanged: false, ...await integrated(local) };
+  }
+  /** Push a project checkout's own HEAD to its mirror. Last push wins: no merge
+   * is attempted, and a rewind or rewrite replaces the mirror as readily as a
+   * fast-forward. A lost acknowledgement needs no reconciliation because the
+   * next cycle simply observes the mirror already holds the head. */
+  async mirrorInnerIdle(b, identity) {
+    if (!b.state.initialized || !this.linkedWorkbench(b) || b.state.blocked?.code === "archived") return { head: b.state.head, unchanged: true };
+    const head = await this.innerHead(b);
+    if (!head || head === b.state.mirroredHead) return { head, unchanged: true };
+    const storage = await this.storage(b, identity);
+    const remote = await this.remoteHead(storage, b.config.repositoryId, b.config.branch, true);
+    if (remote !== head) {
+      const ref = `refs/r5d/mirror/${b.config.branch}`;
+      await git(b.repo, ["update-ref", ref, head]);
+      const file = path.join(b.directory, `mirror-${randomUUID()}.bundle`);
+      const known = remote !== null && await this.hasCommit(b.repo, remote);
+      const rewound = known && (await gitResult(b.repo, ["merge-base", "--is-ancestor", head, remote])).code === 0;
+      const exclude = known && !rewound ? [`^${remote}`] : (await gitResult(b.repo, ["rev-parse", "--verify", "--quiet", `${head}~1`])).code === 0 ? [`^${head}~1`] : [];
+      await git(b.repo, ["bundle", "create", file, ref, ...exclude]);
+      const bytes = await readRegular(file, STORAGE_LIMITS.blobBytes);
+      await fs.rm(file, { force: true });
+      const operationId = `mirror-${randomUUID()}`;
+      const force = await this.forcePublishSupported(storage);
+      try {
+        await this.uploadBundle(storage, bytes, operationId, operationId);
+        const result = await storage.mutate({
+          method: "repository.publish",
+          operationId,
+          repositoryId: b.config.repositoryId,
+          branch: b.config.branch,
+          expectedHead: remote,
+          commit: head,
+          bundleId: operationId,
+          ...force ? { force: true } : {}
+        });
+        if (result.head !== head) throw new WorkspaceError("invalid_response", "Mirror receipt head mismatch");
+      } catch (error) {
+        if (error instanceof WorkspaceError && error.rejectedBeforeAdmission) return { head, unchanged: true };
+        throw error;
+      }
+    }
+    b.state.mirroredHead = head;
+    b.state.head = head;
+    await this.save(b);
+    return { head, unchanged: false };
+  }
+  /** Mirror one project checkout now, outside the periodic cycle. */
+  async mirror(identity) {
+    const b = await this.bench(identity);
+    if (!this.outerEnabled(b) || b.config.rootProfile === "account") return { head: b.state.head, unchanged: true };
+    return this.serial(b, () => this.mirrorInnerIdle(b, identity));
+  }
+  /** Commit the checkout's working tree to its own history on the user's behalf. */
+  async commitInnerIdle(b, identity, message) {
+    if (!b.state.initialized) throw new WorkspaceError("not_initialized", "Hydrate first");
+    await git(b.config.cwd, ["add", "-A"]);
+    const dirty = (await git(b.config.cwd, ["status", "--porcelain", "-z"])).length > 0;
+    const before = await this.innerHead(b);
+    if (!dirty && before) return { head: before, unchanged: true };
+    await git(b.config.cwd, ["commit", "--quiet", "--allow-empty", "-m", message], void 0, void 0, void 0, { env: PROJECT_COMMIT_IDENTITY });
+    const head = await this.innerHead(b);
+    await this.mirrorInnerIdle(b, identity);
+    return { head };
+  }
+  /** Install a project checkout from its mirror. Files may already be present
+   * because the outer repository delivered them first; the worktree is then
+   * created around them and they show as ordinary dirty content. */
+  async hydrateLinkedIdle(b, identity) {
+    await this.assertAvailable(b);
+    if (b.state.initialized) return { head: b.state.head ?? "" };
+    const storage = await this.storage(b, identity);
+    const mirror = await this.remoteHead(storage, b.config.repositoryId, b.config.branch);
+    if (mirror && !await this.hasCommit(b.repo, mirror)) await this.unbundleInto(b, await this.downloadBundle(storage, b.config.repositoryId));
+    let visible = mirror;
+    while (visible && await this.platformSnapshot(b.repo, visible)) {
+      const parent = await this.firstParent(b.repo, visible);
+      if (!parent) break;
+      visible = parent;
+    }
+    if (!visible && b.config.baseCommitHash && await this.hasCommit(b.repo, b.config.baseCommitHash)) visible = b.config.baseCommitHash;
+    if (!visible) throw new WorkspaceError("empty_repository", "Seed README explicitly for an empty mirrored branch");
+    b.state.blocked = { code: "hydration_incomplete", message: "Checkout installation interrupted; preserve the checkout and inspect before maintenance" };
+    await this.save(b);
+    await this.installLinkedWorktree(b, visible, mirror && visible !== mirror ? mirror : null);
+    await this.configureLinkedRemote(b);
+    b.state.initialized = true;
+    b.state.head = mirror ?? visible;
+    b.state.mirroredHead = mirror;
+    b.state.blocked = null;
+    delete b.state.publishedMetadata;
+    await this.save(b);
+    return { head: b.state.head ?? "" };
+  }
+  async installLinkedWorktree(b, visible, legacySnapshot) {
+    const destination = path.join(b.config.cwd, ".git");
+    if (await fs.lstat(destination).then(() => true, (error) => {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    })) return;
+    await fs.mkdir(b.config.cwd, { recursive: true, mode: 448 });
+    await noSymlinkAncestors(b.config.cwd);
+    await git(b.repo, ["update-ref", `refs/heads/${b.config.branch}`, visible]);
+    if (!(await fs.readdir(b.config.cwd)).length) {
+      await fs.rmdir(b.config.cwd);
+      await git(b.repo, ["worktree", "add", "--force", b.config.cwd, b.config.branch]);
+      if (legacySnapshot) {
+        await git(b.config.cwd, ["reset", "--hard", legacySnapshot]);
+        await git(b.config.cwd, ["reset", "--mixed", visible]);
+      }
+      return;
+    }
+    const staging = path.join(b.directory, `worktree-${randomUUID()}`);
+    await git(b.repo, ["worktree", "add", "--no-checkout", "--force", staging, b.config.branch]);
+    const pointer = /^gitdir: (.+?)\s*$/.exec((await readRegular(path.join(staging, ".git"), 4096)).toString("utf8"));
+    if (!pointer || !path.isAbsolute(pointer[1])) throw new WorkspaceError("unsafe_git", "Invalid linked worktree pointer");
+    const gitDirectory = path.normalize(pointer[1]);
+    if (!gitDirectory.startsWith(path.join(b.repo, "worktrees") + path.sep)) throw new WorkspaceError("unsafe_git", "Linked worktree belongs to another repository");
+    await fs.writeFile(destination, `gitdir: ${gitDirectory}
+`, { mode: 384, flag: "wx" });
+    await fs.writeFile(path.join(gitDirectory, "gitdir"), `${destination}
+`, { mode: 384 });
+    await fs.rm(staging, { recursive: true });
+    await git(b.config.cwd, ["reset", "--mixed", visible]);
+  }
   async publish(identity, options = {}) {
     const b = await this.bench(identity);
-    if (b.config.rootProfile === "account") return { head: "", unchanged: true };
+    if (b.config.rootProfile === "account") {
+      if (!this.outerEnabled()) return { head: "", unchanged: true };
+      return this.synchronizeOuter(b.config.userId, { allowLargeDiff: options.allowLargeDiff, resolveConflict: options.allowBlockedConflict });
+    }
+    if (this.outerEnabled(b)) {
+      const outer = await this.synchronizeOuter(b.config.userId);
+      await this.serial(b, () => this.mirrorInnerIdle(b, identity));
+      return outer;
+    }
     return this.serial(b, async () => {
       const conflictBlocked = !!b.state.blocked && WORKBENCH_CONFLICT_CODES.has(b.state.blocked.code);
       await this.assertAvailable(b, options.allowBlockedConflict === true && conflictBlocked);
       return this.publishIdle(b, identity, "Destination workspace snapshot", options.allowLargeDiff === true);
     });
   }
-  async publishIdle(b, identity, message = "Destination workspace snapshot", allowLargeDiff = false) {
+  async publishIdle(b, identity, message = "Destination workspace snapshot", allowLargeDiff = false, projectIdentity = false) {
     if (!b.state.initialized) throw new WorkspaceError("not_initialized", "Hydrate or explicitly seed first");
     const storage = await this.storage(b, identity);
     const latest = await storage.read({
@@ -1200,7 +1656,7 @@ class WorkspaceAuthority {
         throw new WorkspaceError("too_large", "Source diff exceeds the 5242880-byte automatic publication limit");
     }
     const commit = (await git(b.repo, ["commit-tree", tree, ...b.state.head ? ["-p", b.state.head] : []], `${message}
-`)).toString().trim();
+`, void 0, void 0, projectIdentity ? { env: PROJECT_COMMIT_IDENTITY } : {})).toString().trim();
     await git(b.repo, ["update-ref", this.canonicalRef(b), commit]);
     const bundleFile = path.join(b.directory, `${randomUUID()}.bundle`);
     await git(b.repo, ["bundle", "create", bundleFile, this.canonicalRef(b)]);
@@ -1234,18 +1690,7 @@ class WorkspaceAuthority {
       message: "Publication attempt is in progress/unknown. Inspect original storage operation; NEVER retry under a new ID. Workbench and prepared commit retained."
     };
     await this.save(b);
-    for (let offset = 0; offset < bytes.length; offset += STORAGE_LIMITS.chunkBytes) {
-      const end = Math.min(bytes.length, offset + STORAGE_LIMITS.chunkBytes);
-      await storage.mutate({
-        method: "blob.append",
-        operationId: `${operationId}-chunk-${offset}`,
-        blobId,
-        kind: "blob",
-        offset,
-        data: bytes.subarray(offset, end).toString("base64"),
-        seal: end === bytes.length
-      });
-    }
+    await this.uploadBundle(storage, bytes, blobId, operationId);
     const result = await storage.mutate({
       method: "repository.publish",
       operationId,