@ricsam/r5d-worker 0.0.166 → 0.0.168

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.166",
+  "version": "0.0.168",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.166";
+  if (true) return "0.0.168";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.166" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.168" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.166" : "development"
+    true ? "0.0.168" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.166",
+  "version": "0.0.168",
   "type": "module"
 }

package/dist/mjs/personal/client.mjs

@@ -103,7 +103,7 @@ async function startPersonalWorker(options, version) {
     platform: process.platform,
     arch: process.arch,
     hostname: os.hostname(),
-    capabilities: { updateClis: true, durableWorkspace: true, outerWorkspace: true, fileWalk: true }
+    capabilities: { updateClis: true, durableWorkspace: true, outerWorkspace: true, fileWalk: true, fileSearch: true }
   });
   const grant = PersonalWorkerGrant.parse(
     await request("/api/personal/resources/register", { kind: "worker", ...identity, label: options.label, metadata: metadata() })

package/dist/mjs/personal/runtime.mjs

@@ -13,6 +13,7 @@ import { privateDirectory, readPrivateJson } from "../runtime/storage.mjs";
 import { WorkspaceAuthority } from "../runtime/workspace/authority.mjs";
 import { ApprovedWorkbench, WorkspaceError } from "../runtime/workspace/contracts.mjs";
 import { OuterSnapshotRefusal } from "../runtime/workspace/outer.mjs";
+import { WorkspaceSearch } from "../runtime/workspace/search.mjs";
 import { WorkspaceStorageClient } from "../runtime/workspace/storage-client.mjs";
 import { BranchName, GitOid, StorageId } from "../runtime/workspace/storage-wire.mjs";
 const PersonalWorkerGrant = z.object({
@@ -371,6 +372,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         if (command.method === "fileHistoryDates") return authority.fileHistoryDates(identity, command.path);
         if (command.method === "directory" || command.method === "raw") return authority.inspectFiles(identity, command);
         if (command.method === "walk") return authority.walkFiles(identity, command);
+        if (command.method === "search") return authority.searchFiles(identity, WorkspaceSearch.parse(command));
       }
       if (request.kind === "terminal") {
         await authority.ensureHydrated(identity);

package/dist/mjs/runtime/workspace/authority.mjs

@@ -15,6 +15,7 @@ import { OuterRepository, OuterSnapshotRefusal, OUTER_BRANCH, OUTER_CONFLICT_COD
 import { SessionArtifactStore, SessionArtifactChunk, RESERVED_ARTIFACT_ENV } from "./artifacts.mjs";
 import { WorkspaceFileWrite, WorkspaceFileWriteLookup } from "./file-write.mjs";
 import { walkDirectoryTree } from "./walk.mjs";
+import { searchDirectoryTree } from "./search.mjs";
 import { WorkspaceStorageClient } from "./storage-client.mjs";
 import {
   durableJson,
@@ -338,6 +339,25 @@ class WorkspaceAuthority {
     const walked = await walkDirectoryTree(target);
     return { directory: display, ...walked };
   }
+  /** Searches a tree (or one file) locally in one operation: the walk, every
+   * bounded file read and the thread-isolated match all happen here, so a
+   * search costs one round-trip however many files it touches. */
+  async searchFiles(identity, command) {
+    const b = await this.bench(identity);
+    const relative = command.hostPath ? "" : command.path.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!command.hostPath && relative) safeTreePath(relative);
+    const target = command.hostPath ? this.resolveHostPath(command.path) : path.join(b.config.cwd, relative);
+    const display = command.hostPath ? target : `/${relative}`;
+    const inspect = command.hostPath ? fs.lstat(target).then((stat) => {
+      if (stat.isSymbolicLink()) throw new WorkspaceError("unsafe_path", "Final symlink paths are not inspected");
+    }) : noSymlinkAncestors(target);
+    await inspect.catch((error) => {
+      if (error.code === "ENOENT" || error.code === "ENOTDIR") throw new WorkspaceError("not_found", "File or directory not found");
+      throw error;
+    });
+    const searched = await searchDirectoryTree(target, { pattern: command.pattern, caseSensitive: command.caseSensitive, glob: command.glob, limit: command.limit, hostPath: command.hostPath });
+    return { directory: display, ...searched };
+  }
   async inspectGit(identity, command) {
     const b = await this.bench(identity);
     return this.serial(b, async () => {
@@ -1308,16 +1328,17 @@ class WorkspaceAuthority {
   async downloadBundle(storage, repositoryId) {
     const chunks = [];
     let offset = 0, snapshot = null, size = -1, hash = "";
+    const chunkBytes = await storage.chunkBytes();
     do {
       const chunk = await storage.read({
         method: "repository.bundle",
         repositoryId,
         snapshot,
         offset,
-        limit: STORAGE_LIMITS.chunkBytes
+        limit: chunkBytes
       });
       const bytes = Buffer.from(chunk.data, "base64");
-      if (chunk.data !== bytes.toString("base64") || bytes.length > STORAGE_LIMITS.chunkBytes || chunk.offset !== offset || chunk.nextOffset !== offset + bytes.length || !bytes.length || chunk.size > STORAGE_LIMITS.blobBytes || chunk.nextOffset > chunk.size || snapshot && (snapshot !== chunk.snapshot || size !== chunk.size || hash !== chunk.sha256))
+      if (chunk.data !== bytes.toString("base64") || bytes.length > chunkBytes || chunk.offset !== offset || chunk.nextOffset !== offset + bytes.length || !bytes.length || chunk.size > STORAGE_LIMITS.blobBytes || chunk.nextOffset > chunk.size || snapshot && (snapshot !== chunk.snapshot || size !== chunk.size || hash !== chunk.sha256))
         throw new WorkspaceError("invalid_bundle", "Chunk identity/size/offset changed; no checkout performed");
       snapshot = chunk.snapshot;
       size = chunk.size;
@@ -1330,18 +1351,7 @@ class WorkspaceAuthority {
     return bundle;
   }
   async uploadBundle(storage, bytes, blobId, operationId) {
-    for (let offset = 0; offset < bytes.length; offset += STORAGE_LIMITS.chunkBytes) {
-      const end = Math.min(bytes.length, offset + STORAGE_LIMITS.chunkBytes);
-      await storage.mutate({
-        method: "blob.append",
-        operationId: `${operationId}-chunk-${offset}`,
-        blobId,
-        kind: "blob",
-        offset,
-        data: bytes.subarray(offset, end).toString("base64"),
-        seal: end === bytes.length
-      });
-    }
+    await storage.appendBlob(bytes, blobId, operationId);
   }
   async unbundleInto(b, bytes) {
     const file = path.join(b.directory, `${randomUUID()}.bundle`);

package/dist/mjs/runtime/workspace/search.mjs

@@ -0,0 +1,120 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { Worker } from "node:worker_threads";
+import picomatch from "picomatch";
+import { z } from "zod";
+import { WorkspaceError } from "./contracts.mjs";
+import { readHostRegular, readRegular } from "./files.mjs";
+import { walkDirectoryTree, WORKSPACE_WALK_IGNORED, WORKSPACE_WALK_LIMITS } from "./walk.mjs";
+const WORKSPACE_SEARCH_LIMITS = Object.freeze({
+  bytes: 8 * 1024 * 1024,
+  matches: 1e3,
+  outputBytes: 5e4,
+  lineChars: 2e3,
+  matchTimeoutMs: 1e3
+});
+const WorkspaceSearch = z.object({
+  method: z.literal("search"),
+  path: z.string().max(4096),
+  pattern: z.string().min(1).max(1e3),
+  caseSensitive: z.boolean().optional(),
+  glob: z.string().max(1e3).optional(),
+  limit: z.number().int().min(1).optional(),
+  hostPath: z.boolean().optional()
+}).strict();
+function globMatcher(glob) {
+  return glob.includes("/") ? picomatch(glob, { dot: true }) : picomatch(glob, { basename: true, dot: true });
+}
+function compileSearchPattern(pattern, caseSensitive) {
+  let source = pattern;
+  if (source.startsWith("(?i)")) {
+    source = source.slice(4);
+    caseSensitive = false;
+  }
+  if (!source) throw new WorkspaceError("invalid_pattern", "Invalid regular expression", true);
+  try {
+    new RegExp(source, caseSensitive ? "" : "i");
+  } catch {
+    throw new WorkspaceError("invalid_pattern", "Invalid regular expression", true);
+  }
+  return { source, caseSensitive };
+}
+function decodeSearchText(bytes) {
+  if (bytes.includes(0)) return null;
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function matchTextFiles(files, pattern, caseSensitive, maximum, timeoutMs = WORKSPACE_SEARCH_LIMITS.matchTimeoutMs) {
+  const compiled = compileSearchPattern(pattern, caseSensitive);
+  const limits = { maximum: Math.max(1, Math.min(maximum, WORKSPACE_SEARCH_LIMITS.matches)), outputBytes: WORKSPACE_SEARCH_LIMITS.outputBytes, lineChars: WORKSPACE_SEARCH_LIMITS.lineChars };
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(
+      "const {parentPort,workerData}=require('node:worker_threads');const r=new RegExp(workerData.source,workerData.caseSensitive?'':'i');const matches=[];let truncated=false,bytes=0;outer:for(const file of workerData.files){let n=0;for(const line of file.text.split('\\n')){n++;if(!r.test(line))continue;const text=line.slice(0,workerData.lineChars),size=file.path.length+text.length+8;if(matches.length>=workerData.maximum||bytes+size>workerData.outputBytes){truncated=true;break outer}matches.push({path:file.path,line:n,text});bytes+=size}}parentPort.postMessage({matches,truncated})",
+      { eval: true, workerData: { files, source: compiled.source, caseSensitive: compiled.caseSensitive, ...limits } }
+    );
+    const timer = setTimeout(() => {
+      void worker.terminate();
+      reject(new WorkspaceError("pattern_budget", "Search pattern exceeded its execution budget; narrow the pattern", true));
+    }, timeoutMs);
+    worker.once("message", (value) => {
+      clearTimeout(timer);
+      void worker.terminate();
+      resolve(value);
+    });
+    worker.once("error", (error) => {
+      clearTimeout(timer);
+      void worker.terminate();
+      reject(error);
+    });
+  });
+}
+async function searchDirectoryTree(root, options) {
+  const compiled = compileSearchPattern(options.pattern, options.caseSensitive ?? true);
+  const limits = options.limits ?? WORKSPACE_SEARCH_LIMITS, read = options.hostPath ? readHostRegular : readRegular;
+  const stat = await fs.stat(root);
+  let candidates, truncated = false;
+  if (stat.isFile()) candidates = [{ path: "", size: stat.size }];
+  else {
+    const matches = options.glob ? globMatcher(options.glob) : () => true;
+    const walked = await walkDirectoryTree(root, { ignored: options.ignored ?? WORKSPACE_WALK_IGNORED, limits: WORKSPACE_WALK_LIMITS });
+    truncated = walked.truncated;
+    candidates = walked.entries.filter((entry) => entry.type === "file" && matches(entry.path));
+  }
+  const files = [];
+  let budget = limits.bytes;
+  for (const candidate of candidates) {
+    if ((candidate.size ?? 0) > budget) {
+      truncated = true;
+      continue;
+    }
+    let bytes;
+    try {
+      bytes = await read(candidate.path ? path.join(root, candidate.path) : root, budget);
+    } catch (error) {
+      const code = error.code;
+      if (code === "ENOENT" || code === "ENOTDIR") continue;
+      if (error instanceof WorkspaceError) {
+        truncated = true;
+        continue;
+      }
+      throw error;
+    }
+    budget -= bytes.length;
+    const text = decodeSearchText(bytes);
+    if (text !== null) files.push({ path: candidate.path, text });
+  }
+  const matched = await matchTextFiles(files, compiled.source, compiled.caseSensitive, options.limit ?? limits.matches, limits.matchTimeoutMs);
+  return { matches: matched.matches, truncated: truncated || matched.truncated };
+}
+export {
+  WORKSPACE_SEARCH_LIMITS,
+  WorkspaceSearch,
+  compileSearchPattern,
+  decodeSearchText,
+  globMatcher,
+  matchTextFiles,
+  searchDirectoryTree
+};

package/dist/mjs/runtime/workspace/storage-client.mjs

@@ -1,17 +1,24 @@
 import { z } from "zod";
 import { OwnershipFence } from "@ricsam/r5d-api/runtime-protocol";
-import { STORAGE_LIMITS, StorageRequest } from "./storage-wire.mjs";
+import { LEGACY_CHUNK_BYTES, STORAGE_LIMITS, StorageRequest } from "./storage-wire.mjs";
 import { WorkspaceError } from "./contracts.mjs";
 import { readBoundedBody } from "./http-body.mjs";
 class WorkspaceStorageClient {
-  constructor(installationId, transport, caller) {
+  constructor(installationId, transport, caller, helloTtlMs = 1e4) {
     this.installationId = installationId;
     this.transport = transport;
     this.caller = caller;
+    this.helloTtlMs = helloTtlMs;
   }
   installationId;
   transport;
   caller;
+  helloTtlMs;
+  /** The authority's greeting (fence, capabilities, limits) is reused for a
+   * short window: every mutation used to pay a second round-trip for it, and a
+   * fence that goes stale within the window is refused before admission by the
+   * authority itself. Any transport failure discards it. */
+  greeting;
   static http(options) {
     const url = new URL(options.url);
     if (url.username || url.password || url.search || url.hash || url.pathname !== "/internal/storage/v1/rpc" || url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(url.hostname)))
@@ -41,19 +48,60 @@ class WorkspaceStorageClient {
   read(request) {
     return this.transport(StorageRequest.parse(request));
   }
+  /** The authority's current greeting, fetched at most once per TTL. */
+  async hello() {
+    if (this.greeting && Date.now() - this.greeting.at < this.helloTtlMs) return this.greeting.value;
+    const value = StorageHello.parse(await this.read({ method: "hello" }));
+    if (value.installationId !== this.installationId) throw new WorkspaceError("wrong_installation", "Storage authority belongs to another installation");
+    this.greeting = { value, at: Date.now() };
+    return value;
+  }
+  /** Bytes per blob chunk: this client's ceiling, negotiated down to what the
+   * authority advertises (an authority predating the advertisement gets the
+   * legacy size). */
+  async chunkBytes() {
+    const advertised = (await this.hello()).limits?.chunkBytes ?? LEGACY_CHUNK_BYTES;
+    return Math.max(1, Math.min(STORAGE_LIMITS.chunkBytes, advertised));
+  }
   async mutate(input) {
-    const hello = z.object({
-      protocol: z.literal(1),
-      installationId: z.literal(this.installationId),
-      fence: OwnershipFence,
-      capabilities: z.array(z.string())
-    }).passthrough().parse(await this.read({ method: "hello" }));
+    const hello = await this.hello();
     const callerFence = OwnershipFence.parse(await this.caller());
     if (hello.fence.installationId !== this.installationId || callerFence.installationId !== this.installationId || callerFence.resourceType === "storage-authority")
       throw new WorkspaceError("wrong_installation", "Separate installation-bound caller ownership required");
-    return this.transport(StorageRequest.parse({ ...input, fence: hello.fence, callerFence }));
+    try {
+      return await this.transport(StorageRequest.parse({ ...input, fence: hello.fence, callerFence }));
+    } catch (error) {
+      this.greeting = void 0;
+      throw error;
+    }
+  }
+  /** Uploads `bytes` as blob `blobId` in ordered, negotiated-size chunks; the
+   * last append seals it. Each chunk is its own durable operation
+   * (`<operationId>-chunk-<offset>`), so a repeated upload of the same bytes
+   * settles against the original receipts. */
+  async appendBlob(bytes, blobId, operationId) {
+    const chunkBytes = await this.chunkBytes();
+    for (let offset = 0; offset < bytes.length; offset += chunkBytes) {
+      const end = Math.min(bytes.length, offset + chunkBytes);
+      await this.mutate({
+        method: "blob.append",
+        operationId: `${operationId}-chunk-${offset}`,
+        blobId,
+        kind: "blob",
+        offset,
+        data: bytes.subarray(offset, end).toString("base64"),
+        seal: end === bytes.length
+      });
+    }
   }
 }
+const StorageHello = z.object({
+  protocol: z.literal(1),
+  installationId: z.string(),
+  fence: OwnershipFence,
+  capabilities: z.array(z.string()),
+  limits: z.object({ chunkBytes: z.number().int().min(1).optional() }).passthrough().optional()
+}).passthrough();
 export {
   WorkspaceStorageClient
 };

package/dist/mjs/runtime/workspace/storage-wire.mjs

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { OwnershipFence, RuntimeId } from "@ricsam/r5d-api/runtime-protocol";
-const STORAGE_LIMITS = { chunkBytes: 64 * 1024, blobBytes: 128 * 1024 * 1024, requestBytes: 96 * 1024, treeEntries: 2e5 };
+const STORAGE_LIMITS = { chunkBytes: 1024 * 1024, blobBytes: 128 * 1024 * 1024, requestBytes: 1536 * 1024, treeEntries: 2e5 };
+const LEGACY_CHUNK_BYTES = 64 * 1024;
 const StorageId = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/);
 const GitOid = z.string().regex(/^[0-9a-f]{40}$/);
 const BranchName = z.string().min(1).max(150).refine((value) => value.split("/").every((part) => /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(part)));
@@ -49,6 +50,7 @@ function safeTreePath(value) {
 export {
   BranchName,
   GitOid,
+  LEGACY_CHUNK_BYTES,
   STORAGE_LIMITS,
   StorageId,
   StorageRequest,

package/dist/types/runtime/workspace/authority.d.ts

@@ -4,6 +4,7 @@ import { WorkspaceConfig, type ExecutorRoute, type WorkspaceIdentity, type Outer
 import { SessionArtifactChunk } from "./artifacts";
 import { WorkspaceFileWrite } from "./file-write";
 import { type WorkspaceWalk, type WorkspaceWalkResult } from "./walk";
+import { type WorkspaceSearch, type WorkspaceSearchResult } from "./search";
 import { WorkspaceStorageClient } from "./storage-client";
 export interface WorkspaceAuthorityOptions {
     config: WorkspaceConfig;
@@ -112,6 +113,10 @@ export declare class WorkspaceAuthority {
      * relative to the walked directory; the shared ignore list and bounds live
      * in `./walk` so the server's fallback agrees with them. */
     walkFiles(identity: WorkspaceIdentity, command: WorkspaceWalk): Promise<WorkspaceWalkResult>;
+    /** Searches a tree (or one file) locally in one operation: the walk, every
+     * bounded file read and the thread-isolated match all happen here, so a
+     * search costs one round-trip however many files it touches. */
+    searchFiles(identity: WorkspaceIdentity, command: WorkspaceSearch): Promise<WorkspaceSearchResult>;
     inspectGit(identity: WorkspaceIdentity, command: {
         method: "status" | "diff" | "history" | "fileDiff";
         path?: string;

package/dist/types/runtime/workspace/search.d.ts

@@ -0,0 +1,81 @@
+import { z } from "zod";
+export type WorkspaceSearchLimits = {
+    /** Bytes of file content one search may read in total. */
+    readonly bytes: number;
+    /** Match lines reported before the result is marked truncated. */
+    readonly matches: number;
+    /** Bytes of reported match text. */
+    readonly outputBytes: number;
+    /** Characters kept from a matching line. */
+    readonly lineChars: number;
+    /** Wall-clock budget for regular-expression execution. */
+    readonly matchTimeoutMs: number;
+};
+/** Bounds one text search regardless of what a checkout contains. */
+export declare const WORKSPACE_SEARCH_LIMITS: WorkspaceSearchLimits;
+/** Inspect command: search text files under a path in one worker operation.
+ * `glob` matches paths relative to `path` (a glob without a slash matches
+ * base names). `limit` is clamped to the shared match bound. */
+export declare const WorkspaceSearch: z.ZodObject<{
+    method: z.ZodLiteral<"search">;
+    path: z.ZodString;
+    pattern: z.ZodString;
+    caseSensitive: z.ZodOptional<z.ZodBoolean>;
+    glob: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    hostPath: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type WorkspaceSearch = z.infer<typeof WorkspaceSearch>;
+/** A match's `path` is relative to the searched directory, or empty when the
+ * searched path was itself a file. */
+export type WorkspaceSearchMatch = {
+    path: string;
+    line: number;
+    text: string;
+};
+export type WorkspaceSearchResult = {
+    directory: string;
+    matches: WorkspaceSearchMatch[];
+    truncated: boolean;
+};
+/** A glob without a slash matches base names anywhere under the searched
+ * directory; one with a slash matches the whole relative path. picomatch's
+ * `basename` option silently fails slash patterns, so it is applied only to
+ * slash-free globs. */
+export declare function globMatcher(glob: string): (relative: string) => boolean;
+/** Validates a search pattern before any file is touched. A leading `(?i)`,
+ * the inline flag models trained on ripgrep and PCRE emit, is folded into
+ * case-insensitivity because JavaScript has no inline flag syntax. */
+export declare function compileSearchPattern(pattern: string, caseSensitive: boolean): {
+    source: string;
+    caseSensitive: boolean;
+};
+/** Decodes a file as UTF-8 text, or returns null for binary or non-UTF-8 content. */
+export declare function decodeSearchText(bytes: Buffer): string | null;
+/** Runs the regular expression in a disposable thread so a hostile pattern
+ * cannot stall the process's event loop; the thread is terminated at the
+ * budget. `maximum` bounds reported matches. */
+export declare function matchTextFiles(files: Array<{
+    path: string;
+    text: string;
+}>, pattern: string, caseSensitive: boolean, maximum: number, timeoutMs?: number): Promise<{
+    matches: WorkspaceSearchMatch[];
+    truncated: boolean;
+}>;
+/** Searches the tree under `root` (or `root` itself when it is a file) in
+ * process: one walk with the shared ignore list, bounded reads of the files
+ * the glob selects, and one thread-isolated match. Files that vanish, exceed
+ * the remaining byte budget, or are not UTF-8 text are skipped; the first two
+ * mark the result truncated. */
+export declare function searchDirectoryTree(root: string, options: {
+    pattern: string;
+    caseSensitive?: boolean;
+    glob?: string;
+    limit?: number;
+    hostPath?: boolean;
+    ignored?: ReadonlySet<string>;
+    limits?: WorkspaceSearchLimits;
+}): Promise<{
+    matches: WorkspaceSearchMatch[];
+    truncated: boolean;
+}>;

package/dist/types/runtime/workspace/storage-client.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { OwnershipFence } from "@ricsam/r5d-api/runtime-protocol";
 import { StorageRequest, type StorageMutation } from "./storage-wire";
 export type StorageTransport = (request: StorageRequest) => Promise<unknown>;
@@ -9,7 +10,13 @@ export declare class WorkspaceStorageClient {
     readonly installationId: string;
     private readonly transport;
     private readonly caller;
-    constructor(installationId: string, transport: StorageTransport, caller: () => Promise<OwnershipFence>);
+    private readonly helloTtlMs;
+    /** The authority's greeting (fence, capabilities, limits) is reused for a
+     * short window: every mutation used to pay a second round-trip for it, and a
+     * fence that goes stale within the window is refused before admission by the
+     * authority itself. Any transport failure discards it. */
+    private greeting?;
+    constructor(installationId: string, transport: StorageTransport, caller: () => Promise<OwnershipFence>, helloTtlMs?: number);
     static http(options: {
         installationId: string;
         url: string;
@@ -18,6 +25,33 @@ export declare class WorkspaceStorageClient {
         fetch?: typeof fetch;
     }): WorkspaceStorageClient;
     read<T>(request: Exclude<StorageRequest, StorageMutation>): Promise<T>;
+    /** The authority's current greeting, fetched at most once per TTL. */
+    hello(): Promise<StorageHello>;
+    /** Bytes per blob chunk: this client's ceiling, negotiated down to what the
+     * authority advertises (an authority predating the advertisement gets the
+     * legacy size). */
+    chunkBytes(): Promise<number>;
     mutate<T>(input: MutationInput): Promise<T>;
+    /** Uploads `bytes` as blob `blobId` in ordered, negotiated-size chunks; the
+     * last append seals it. Each chunk is its own durable operation
+     * (`<operationId>-chunk-<offset>`), so a repeated upload of the same bytes
+     * settles against the original receipts. */
+    appendBlob(bytes: Buffer, blobId: string, operationId: string): Promise<void>;
 }
+declare const StorageHello: z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    installationId: z.ZodString;
+    fence: z.ZodObject<{
+        installationId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        ownerId: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodString>;
+    limits: z.ZodOptional<z.ZodObject<{
+        chunkBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type StorageHello = z.infer<typeof StorageHello>;
 export {};

package/dist/types/runtime/workspace/storage-wire.d.ts

@@ -2,12 +2,19 @@ import { z } from "zod";
 /** Client-side v1 wire contract only. No server/control/catalog filesystem imports.
  * Keep matched to storage RPC; integration tests exercise the real authenticated parser.
  */
+/** `chunkBytes` is this client's ceiling; the size actually used is negotiated
+ * down to what the storage authority's `hello` advertises (`limits.chunkBytes`),
+ * so a newer worker keeps talking to an older authority. A blob's chunks are
+ * appended in order, one round-trip each: with 64 KiB chunks a 3 MB bundle
+ * cost 32 round-trips through the relay — minutes per publication. */
 export declare const STORAGE_LIMITS: {
     readonly chunkBytes: number;
     readonly blobBytes: number;
     readonly requestBytes: number;
     readonly treeEntries: 200000;
 };
+/** Chunk size assumed for an authority whose hello advertises no limits. */
+export declare const LEGACY_CHUNK_BYTES: number;
 export declare const StorageId: z.ZodString;
 export declare const GitOid: z.ZodString;
 export declare const BranchName: z.ZodString;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.166",
+  "version": "0.0.168",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,7 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.166",
+    "@ricsam/r5d-api": "^0.0.168",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"