@ricsam/r5d-worker 0.0.167 → 0.0.169

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.167",
+  "version": "0.0.169",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.167";
+  if (true) return "0.0.169";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.167" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.169" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.167" : "development"
+    true ? "0.0.169" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.167",
+  "version": "0.0.169",
   "type": "module"
 }

package/dist/mjs/personal/runtime.mjs

@@ -407,6 +407,8 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         if (command.method === "resize") return authority.resize(identity, ref, command.id, command.cols, command.rows);
         if (command.method === "cancel" || command.method === "processCancel") return authority.cancel(identity, ref, command.id);
       }
+      if (pausedForIncident && request.remediation !== true && ["hydrate", "publish", "reconcilePublication"].includes(String(command.method)))
+        throw new WorkspaceError("remediation_paused", "This worker's workspace is under remediation; synchronization resumes when it is confirmed", true);
       if (request.kind === "product") {
         if (command.method === "fileWrite") {
           await authority.ensureHydrated(identity);

package/dist/mjs/runtime/workspace/authority.mjs

@@ -1328,16 +1328,17 @@ class WorkspaceAuthority {
   async downloadBundle(storage, repositoryId) {
     const chunks = [];
     let offset = 0, snapshot = null, size = -1, hash = "";
+    const chunkBytes = await storage.chunkBytes();
     do {
       const chunk = await storage.read({
         method: "repository.bundle",
         repositoryId,
         snapshot,
         offset,
-        limit: STORAGE_LIMITS.chunkBytes
+        limit: chunkBytes
       });
       const bytes = Buffer.from(chunk.data, "base64");
-      if (chunk.data !== bytes.toString("base64") || bytes.length > STORAGE_LIMITS.chunkBytes || chunk.offset !== offset || chunk.nextOffset !== offset + bytes.length || !bytes.length || chunk.size > STORAGE_LIMITS.blobBytes || chunk.nextOffset > chunk.size || snapshot && (snapshot !== chunk.snapshot || size !== chunk.size || hash !== chunk.sha256))
+      if (chunk.data !== bytes.toString("base64") || bytes.length > chunkBytes || chunk.offset !== offset || chunk.nextOffset !== offset + bytes.length || !bytes.length || chunk.size > STORAGE_LIMITS.blobBytes || chunk.nextOffset > chunk.size || snapshot && (snapshot !== chunk.snapshot || size !== chunk.size || hash !== chunk.sha256))
         throw new WorkspaceError("invalid_bundle", "Chunk identity/size/offset changed; no checkout performed");
       snapshot = chunk.snapshot;
       size = chunk.size;
@@ -1350,18 +1351,7 @@ class WorkspaceAuthority {
     return bundle;
   }
   async uploadBundle(storage, bytes, blobId, operationId) {
-    for (let offset = 0; offset < bytes.length; offset += STORAGE_LIMITS.chunkBytes) {
-      const end = Math.min(bytes.length, offset + STORAGE_LIMITS.chunkBytes);
-      await storage.mutate({
-        method: "blob.append",
-        operationId: `${operationId}-chunk-${offset}`,
-        blobId,
-        kind: "blob",
-        offset,
-        data: bytes.subarray(offset, end).toString("base64"),
-        seal: end === bytes.length
-      });
-    }
+    await storage.appendBlob(bytes, blobId, operationId);
   }
   async unbundleInto(b, bytes) {
     const file = path.join(b.directory, `${randomUUID()}.bundle`);
@@ -1418,7 +1408,7 @@ class WorkspaceAuthority {
       if (options.bootstrapOnly) return { head: remote2, unchanged: true };
     } else if (options.bootstrapOnly) return { head: state.head, unchanged: true };
     if (state.conflict && !options.resolveConflict)
-      throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Workspace synchronization conflict awaits resolution", state.conflict.paths);
+      throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Workspace synchronization conflict awaits resolution", state.conflict.paths, true);
     const inners = await this.innerCheckouts(userId);
     let snapshot;
     try {
@@ -1438,7 +1428,7 @@ class WorkspaceAuthority {
           throw error;
         });
         if (bytes2 && marker.test(bytes2.toString("utf8")))
-          throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Conflict markers remain; resolve them before confirming", [file]);
+          throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Conflict markers remain; resolve them before confirming", [file], true);
       }
     } else if (state.blocked && state.blocked.code !== "publication_unknown") {
       state.blocked = null;
@@ -1481,7 +1471,7 @@ class WorkspaceAuthority {
         state.conflict = { ours: local, theirs: remote, tree: merge.tree, paths: merge.conflicts };
         state.blocked = { code: OUTER_CONFLICT_CODE, message: "The workspace diverged from another worker; conflict markers were written to the paths named", paths: merge.conflicts };
         await this.saveOuter(state);
-        throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, state.blocked.message, merge.conflicts);
+        throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, state.blocked.message, merge.conflicts, true);
       }
       await repo.apply(currentTree, merge.tree);
       currentTree = merge.tree;

package/dist/mjs/runtime/workspace/outer.mjs

@@ -33,8 +33,8 @@ const OUTER_EXCLUDES = [
   ".pypirc"
 ];
 class OuterSnapshotRefusal extends WorkspaceError {
-  constructor(code, message, paths) {
-    super(code, message);
+  constructor(code, message, paths, definite = false) {
+    super(code, message, definite);
     this.paths = paths;
     this.name = "OuterSnapshotRefusal";
   }

package/dist/mjs/runtime/workspace/storage-client.mjs

@@ -1,17 +1,24 @@
 import { z } from "zod";
 import { OwnershipFence } from "@ricsam/r5d-api/runtime-protocol";
-import { STORAGE_LIMITS, StorageRequest } from "./storage-wire.mjs";
+import { LEGACY_CHUNK_BYTES, STORAGE_LIMITS, StorageRequest } from "./storage-wire.mjs";
 import { WorkspaceError } from "./contracts.mjs";
 import { readBoundedBody } from "./http-body.mjs";
 class WorkspaceStorageClient {
-  constructor(installationId, transport, caller) {
+  constructor(installationId, transport, caller, helloTtlMs = 1e4) {
     this.installationId = installationId;
     this.transport = transport;
     this.caller = caller;
+    this.helloTtlMs = helloTtlMs;
   }
   installationId;
   transport;
   caller;
+  helloTtlMs;
+  /** The authority's greeting (fence, capabilities, limits) is reused for a
+   * short window: every mutation used to pay a second round-trip for it, and a
+   * fence that goes stale within the window is refused before admission by the
+   * authority itself. Any transport failure discards it. */
+  greeting;
   static http(options) {
     const url = new URL(options.url);
     if (url.username || url.password || url.search || url.hash || url.pathname !== "/internal/storage/v1/rpc" || url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(url.hostname)))
@@ -41,19 +48,60 @@ class WorkspaceStorageClient {
   read(request) {
     return this.transport(StorageRequest.parse(request));
   }
+  /** The authority's current greeting, fetched at most once per TTL. */
+  async hello() {
+    if (this.greeting && Date.now() - this.greeting.at < this.helloTtlMs) return this.greeting.value;
+    const value = StorageHello.parse(await this.read({ method: "hello" }));
+    if (value.installationId !== this.installationId) throw new WorkspaceError("wrong_installation", "Storage authority belongs to another installation");
+    this.greeting = { value, at: Date.now() };
+    return value;
+  }
+  /** Bytes per blob chunk: this client's ceiling, negotiated down to what the
+   * authority advertises (an authority predating the advertisement gets the
+   * legacy size). */
+  async chunkBytes() {
+    const advertised = (await this.hello()).limits?.chunkBytes ?? LEGACY_CHUNK_BYTES;
+    return Math.max(1, Math.min(STORAGE_LIMITS.chunkBytes, advertised));
+  }
   async mutate(input) {
-    const hello = z.object({
-      protocol: z.literal(1),
-      installationId: z.literal(this.installationId),
-      fence: OwnershipFence,
-      capabilities: z.array(z.string())
-    }).passthrough().parse(await this.read({ method: "hello" }));
+    const hello = await this.hello();
     const callerFence = OwnershipFence.parse(await this.caller());
     if (hello.fence.installationId !== this.installationId || callerFence.installationId !== this.installationId || callerFence.resourceType === "storage-authority")
       throw new WorkspaceError("wrong_installation", "Separate installation-bound caller ownership required");
-    return this.transport(StorageRequest.parse({ ...input, fence: hello.fence, callerFence }));
+    try {
+      return await this.transport(StorageRequest.parse({ ...input, fence: hello.fence, callerFence }));
+    } catch (error) {
+      this.greeting = void 0;
+      throw error;
+    }
+  }
+  /** Uploads `bytes` as blob `blobId` in ordered, negotiated-size chunks; the
+   * last append seals it. Each chunk is its own durable operation
+   * (`<operationId>-chunk-<offset>`), so a repeated upload of the same bytes
+   * settles against the original receipts. */
+  async appendBlob(bytes, blobId, operationId) {
+    const chunkBytes = await this.chunkBytes();
+    for (let offset = 0; offset < bytes.length; offset += chunkBytes) {
+      const end = Math.min(bytes.length, offset + chunkBytes);
+      await this.mutate({
+        method: "blob.append",
+        operationId: `${operationId}-chunk-${offset}`,
+        blobId,
+        kind: "blob",
+        offset,
+        data: bytes.subarray(offset, end).toString("base64"),
+        seal: end === bytes.length
+      });
+    }
   }
 }
+const StorageHello = z.object({
+  protocol: z.literal(1),
+  installationId: z.string(),
+  fence: OwnershipFence,
+  capabilities: z.array(z.string()),
+  limits: z.object({ chunkBytes: z.number().int().min(1).optional() }).passthrough().optional()
+}).passthrough();
 export {
   WorkspaceStorageClient
 };

package/dist/mjs/runtime/workspace/storage-wire.mjs

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { OwnershipFence, RuntimeId } from "@ricsam/r5d-api/runtime-protocol";
-const STORAGE_LIMITS = { chunkBytes: 64 * 1024, blobBytes: 128 * 1024 * 1024, requestBytes: 96 * 1024, treeEntries: 2e5 };
+const STORAGE_LIMITS = { chunkBytes: 1024 * 1024, blobBytes: 128 * 1024 * 1024, requestBytes: 1536 * 1024, treeEntries: 2e5 };
+const LEGACY_CHUNK_BYTES = 64 * 1024;
 const StorageId = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/);
 const GitOid = z.string().regex(/^[0-9a-f]{40}$/);
 const BranchName = z.string().min(1).max(150).refine((value) => value.split("/").every((part) => /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(part)));
@@ -49,6 +50,7 @@ function safeTreePath(value) {
 export {
   BranchName,
   GitOid,
+  LEGACY_CHUNK_BYTES,
   STORAGE_LIMITS,
   StorageId,
   StorageRequest,

package/dist/types/runtime/workspace/outer.d.ts

@@ -42,9 +42,14 @@ export type OuterTreeEntry = {
     oid: string;
 };
 /** A refusal that names the paths responsible, for the incident evidence. */
+/** A refusal whose outcome is definite: either nothing happened, or what
+ * happened (conflict markers written, state saved) is fully recorded in the
+ * durable outer state and re-running the same command refuses the same way.
+ * `definite` travels as the relay's `rejectedBeforeAdmission`, so a caller
+ * receives a typed error instead of an uncertain outcome that blocks its run. */
 export declare class OuterSnapshotRefusal extends WorkspaceError {
     readonly paths: string[];
-    constructor(code: string, message: string, paths: string[]);
+    constructor(code: string, message: string, paths: string[], definite?: boolean);
 }
 export declare class OuterRepository {
     readonly gitDir: string;

package/dist/types/runtime/workspace/storage-client.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { OwnershipFence } from "@ricsam/r5d-api/runtime-protocol";
 import { StorageRequest, type StorageMutation } from "./storage-wire";
 export type StorageTransport = (request: StorageRequest) => Promise<unknown>;
@@ -9,7 +10,13 @@ export declare class WorkspaceStorageClient {
     readonly installationId: string;
     private readonly transport;
     private readonly caller;
-    constructor(installationId: string, transport: StorageTransport, caller: () => Promise<OwnershipFence>);
+    private readonly helloTtlMs;
+    /** The authority's greeting (fence, capabilities, limits) is reused for a
+     * short window: every mutation used to pay a second round-trip for it, and a
+     * fence that goes stale within the window is refused before admission by the
+     * authority itself. Any transport failure discards it. */
+    private greeting?;
+    constructor(installationId: string, transport: StorageTransport, caller: () => Promise<OwnershipFence>, helloTtlMs?: number);
     static http(options: {
         installationId: string;
         url: string;
@@ -18,6 +25,33 @@ export declare class WorkspaceStorageClient {
         fetch?: typeof fetch;
     }): WorkspaceStorageClient;
     read<T>(request: Exclude<StorageRequest, StorageMutation>): Promise<T>;
+    /** The authority's current greeting, fetched at most once per TTL. */
+    hello(): Promise<StorageHello>;
+    /** Bytes per blob chunk: this client's ceiling, negotiated down to what the
+     * authority advertises (an authority predating the advertisement gets the
+     * legacy size). */
+    chunkBytes(): Promise<number>;
     mutate<T>(input: MutationInput): Promise<T>;
+    /** Uploads `bytes` as blob `blobId` in ordered, negotiated-size chunks; the
+     * last append seals it. Each chunk is its own durable operation
+     * (`<operationId>-chunk-<offset>`), so a repeated upload of the same bytes
+     * settles against the original receipts. */
+    appendBlob(bytes: Buffer, blobId: string, operationId: string): Promise<void>;
 }
+declare const StorageHello: z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    installationId: z.ZodString;
+    fence: z.ZodObject<{
+        installationId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        ownerId: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodString>;
+    limits: z.ZodOptional<z.ZodObject<{
+        chunkBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type StorageHello = z.infer<typeof StorageHello>;
 export {};

package/dist/types/runtime/workspace/storage-wire.d.ts

@@ -2,12 +2,19 @@ import { z } from "zod";
 /** Client-side v1 wire contract only. No server/control/catalog filesystem imports.
  * Keep matched to storage RPC; integration tests exercise the real authenticated parser.
  */
+/** `chunkBytes` is this client's ceiling; the size actually used is negotiated
+ * down to what the storage authority's `hello` advertises (`limits.chunkBytes`),
+ * so a newer worker keeps talking to an older authority. A blob's chunks are
+ * appended in order, one round-trip each: with 64 KiB chunks a 3 MB bundle
+ * cost 32 round-trips through the relay — minutes per publication. */
 export declare const STORAGE_LIMITS: {
     readonly chunkBytes: number;
     readonly blobBytes: number;
     readonly requestBytes: number;
     readonly treeEntries: 200000;
 };
+/** Chunk size assumed for an authority whose hello advertises no limits. */
+export declare const LEGACY_CHUNK_BYTES: number;
 export declare const StorageId: z.ZodString;
 export declare const GitOid: z.ZodString;
 export declare const BranchName: z.ZodString;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.167",
+  "version": "0.0.169",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,7 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.167",
+    "@ricsam/r5d-api": "^0.0.169",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"