@ricsam/r5d-worker 0.0.186 → 0.0.188

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.186",
+  "version": "0.0.188",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.186";
+  if (true) return "0.0.188";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.186" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.188" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>] [--initial-sync merge|reset]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.186" : "development"
+    true ? "0.0.188" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.186",
+  "version": "0.0.188",
   "type": "module"
 }

package/dist/mjs/runtime/executor.mjs

@@ -173,7 +173,7 @@ class HostExecutor {
     const request = ExecutorRequest.parse(input);
     const principal = this.authenticate(request);
     const command = request.command;
-    if (command.method === "adapter.register") return this.adapters.register(principal, command.grant, this.hello);
+    if (command.method === "adapter.register") return this.adapters.register(principal, command.grant, this.hello, this.authority()?.fence.ownerId);
     if (command.method === "adapter.retire") return this.adapters.retire(principal, command.principalId, this.authority()?.fence.ownerId);
     if (command.method === "status")
       return {

package/dist/mjs/runtime/releases/grants.mjs

@@ -8,6 +8,7 @@ import {
   EXECUTOR_CAPABILITY
 } from "../protocol.mjs";
 const digest = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
+const withoutArtifact = ({ artifactDigest: _, ...rest }) => rest;
 class AdapterGrantRegistry {
   constructor(db, config) {
     this.db = db;
@@ -48,7 +49,7 @@ class AdapterGrantRegistry {
       };
     });
   }
-  register(controller, input, keeperHello) {
+  register(controller, input, keeperHello, authoritativeOwner) {
     if (controller.role !== "controller") throw new ExecutorError("forbidden");
     const grant = AdapterGrant.parse(input), p = grant.principal;
     if (grant.installationId !== this.config.installationId || grant.workerId !== this.config.workerId)
@@ -64,8 +65,13 @@ class AdapterGrantRegistry {
       throw new ExecutorError("grant_scope_exceeded");
     const hash = digest(grant), rows = this.rows(), old = rows.find((row) => row.id === p.id);
     if (old) {
-      if (old.digest !== hash) throw new ExecutorError("grant_identity_conflict");
       if (old.state === "retired") throw new ExecutorError("adapter_retired");
+      if (old.digest !== hash) {
+        const prior = AdapterGrant.parse(JSON.parse(old.grant_json));
+        if (p.ownerId !== authoritativeOwner || canonicalJson(withoutArtifact(prior)) !== canonicalJson(withoutArtifact(grant)))
+          throw new ExecutorError("grant_identity_conflict");
+        this.db.query("UPDATE adapter_grants SET grant_json=?, digest=? WHERE id=?").run(canonicalJson(grant), hash, p.id);
+      }
       return this.list().find((r) => r.principalId === p.id);
     }
     if (this.config.principals.some((s) => s.id === p.id || s.ownerId === p.ownerId) || rows.some((row) => {

package/dist/types/runtime/releases/grants.d.ts

@@ -11,6 +11,6 @@ export declare class AdapterGrantRegistry {
     find(id: string): AdapterGrant | undefined;
     hasOwner(owner: string): boolean;
     list(): AdapterRegistration[];
-    register(controller: Principal, input: AdapterGrant, keeperHello: RuntimeHello): AdapterRegistration;
+    register(controller: Principal, input: AdapterGrant, keeperHello: RuntimeHello, authoritativeOwner?: string): AdapterRegistration;
     retire(controller: Principal, id: string, authoritativeOwner?: string): AdapterRegistration;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.186",
+  "version": "0.0.188",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,7 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.186",
+    "@ricsam/r5d-api": "^0.0.188",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"