@ricsam/r5d-worker 0.0.185 → 0.0.187

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.185",
+  "version": "0.0.187",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.185";
+  if (true) return "0.0.187";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.185" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.187" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>] [--initial-sync merge|reset]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.185" : "development"
+    true ? "0.0.187" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.185",
+  "version": "0.0.187",
   "type": "module"
 }

package/dist/mjs/runtime/executor.mjs

@@ -173,7 +173,7 @@ class HostExecutor {
     const request = ExecutorRequest.parse(input);
     const principal = this.authenticate(request);
     const command = request.command;
-    if (command.method === "adapter.register") return this.adapters.register(principal, command.grant, this.hello);
+    if (command.method === "adapter.register") return this.adapters.register(principal, command.grant, this.hello, this.authority()?.fence.ownerId);
     if (command.method === "adapter.retire") return this.adapters.retire(principal, command.principalId, this.authority()?.fence.ownerId);
     if (command.method === "status")
       return {

package/dist/mjs/runtime/releases/grants.mjs

@@ -8,6 +8,7 @@ import {
   EXECUTOR_CAPABILITY
 } from "../protocol.mjs";
 const digest = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
+const withoutArtifact = ({ artifactDigest: _, ...rest }) => rest;
 class AdapterGrantRegistry {
   constructor(db, config) {
     this.db = db;
@@ -48,7 +49,7 @@ class AdapterGrantRegistry {
       };
     });
   }
-  register(controller, input, keeperHello) {
+  register(controller, input, keeperHello, authoritativeOwner) {
     if (controller.role !== "controller") throw new ExecutorError("forbidden");
     const grant = AdapterGrant.parse(input), p = grant.principal;
     if (grant.installationId !== this.config.installationId || grant.workerId !== this.config.workerId)
@@ -64,8 +65,13 @@ class AdapterGrantRegistry {
       throw new ExecutorError("grant_scope_exceeded");
     const hash = digest(grant), rows = this.rows(), old = rows.find((row) => row.id === p.id);
     if (old) {
-      if (old.digest !== hash) throw new ExecutorError("grant_identity_conflict");
       if (old.state === "retired") throw new ExecutorError("adapter_retired");
+      if (old.digest !== hash) {
+        const prior = AdapterGrant.parse(JSON.parse(old.grant_json));
+        if (p.ownerId !== authoritativeOwner || canonicalJson(withoutArtifact(prior)) !== canonicalJson(withoutArtifact(grant)))
+          throw new ExecutorError("grant_identity_conflict");
+        this.db.query("UPDATE adapter_grants SET grant_json=?, digest=? WHERE id=?").run(canonicalJson(grant), hash, p.id);
+      }
       return this.list().find((r) => r.principalId === p.id);
     }
     if (this.config.principals.some((s) => s.id === p.id || s.ownerId === p.ownerId) || rows.some((row) => {

package/dist/mjs/runtime/workspace/outer.mjs

@@ -178,18 +178,19 @@ class OuterRepository {
         throw new OuterSnapshotRefusal(
           "too_large",
           `Unexplained workspace content exceeds the ${limit}-byte automatic publication limit`,
-          attribute(unexplainedPaths)
+          attribute(unexplainedPaths),
+          true
         );
     }
     for (const file of unexplainedPaths) {
       const bytes = await readRegular(path.join(this.workTree, file)).catch((error) => {
-        if (error instanceof WorkspaceError) throw new OuterSnapshotRefusal(error.code, error.message, [file]);
+        if (error instanceof WorkspaceError) throw new OuterSnapshotRefusal(error.code, error.message, [file], true);
         throw error;
       });
       try {
         sourceBytes(bytes, file);
       } catch (error) {
-        if (error instanceof WorkspaceError) throw new OuterSnapshotRefusal(error.code, error.message, [file]);
+        if (error instanceof WorkspaceError) throw new OuterSnapshotRefusal(error.code, error.message, [file], true);
         throw error;
       }
     }

package/dist/types/runtime/releases/grants.d.ts

@@ -11,6 +11,6 @@ export declare class AdapterGrantRegistry {
     find(id: string): AdapterGrant | undefined;
     hasOwner(owner: string): boolean;
     list(): AdapterRegistration[];
-    register(controller: Principal, input: AdapterGrant, keeperHello: RuntimeHello): AdapterRegistration;
+    register(controller: Principal, input: AdapterGrant, keeperHello: RuntimeHello, authoritativeOwner?: string): AdapterRegistration;
     retire(controller: Principal, id: string, authoritativeOwner?: string): AdapterRegistration;
 }

package/dist/types/runtime/workspace/outer.d.ts

@@ -44,12 +44,17 @@ export type OuterTreeEntry = {
     mode: string;
     oid: string;
 };
-/** A refusal that names the paths responsible, for the incident evidence. */
-/** A refusal whose outcome is definite: either nothing happened, or what
+/** A refusal that names the paths responsible, for the incident evidence.
+ *
+ * `definite` means the outcome is settled: either nothing happened, or what
  * happened (conflict markers written, state saved) is fully recorded in the
- * durable outer state and re-running the same command refuses the same way.
- * `definite` travels as the relay's `rejectedBeforeAdmission`, so a caller
- * receives a typed error instead of an uncertain outcome that blocks its run. */
+ * durable outer state and re-running the same command refuses the same way. It
+ * travels as the relay's `rejectedBeforeAdmission`, so a caller receives a
+ * typed error instead of an uncertain outcome that blocks its run. Every
+ * refusal raised while measuring the workspace qualifies, since it is thrown
+ * before anything is staged, committed or published; leaving them uncertain
+ * turned "your workspace is too large" into `action_unknown` for the caller
+ * (stage 2026-09-18 run 27). */
 export declare class OuterSnapshotRefusal extends WorkspaceError {
     readonly paths: string[];
     constructor(code: string, message: string, paths: string[], definite?: boolean);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.185",
+  "version": "0.0.187",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,7 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.185",
+    "@ricsam/r5d-api": "^0.0.187",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"