@schoolai/shipyard 3.9.1 → 3.10.0-rc.20260609.0

package/dist/{chunk-AVF7LE7Q.js → chunk-WMOR5Q6C.js}

@@ -2,13 +2,13 @@
 import {
   PUBLISHED_PREVIEW_KINDS,
   PUBLISH_TTL_CHOICES
-} from "./chunk-DGX2QR6G.js";
+} from "./chunk-4PBXNWJV.js";
 import {
   assertNever
 } from "./chunk-X3MULCV5.js";
 import {
   logger
-} from "./chunk-3SXIJEPM.js";
+} from "./chunk-QJP7JCIS.js";
 import {
   external_exports
 } from "./chunk-CNR7O5YH.js";
@@ -6417,6 +6417,14 @@ var CanvasRepository = class {
   #epoch;
   #storageAdapter;
   #canvasDocs = /* @__PURE__ */ new Map();
+  /**
+   * Live Loro-subscription refcount per task. `subscribe()` increments; the
+   * returned unsubscribe decrements (idempotently). `invalidate()` is a no-op
+   * while a task's count is > 0 because evicting a doc out from under a live
+   * subscription orphans the subscriber's callback against a dropped LoroDoc —
+   * a silent data-loss bug. The idle sweep only evicts zero-refcount docs.
+   */
+  #subscriberCounts = /* @__PURE__ */ new Map();
   constructor(repo, epoch, storageAdapter) {
     this.#repo = repo;
     this.#epoch = epoch;
@@ -6496,18 +6504,70 @@ var CanvasRepository = class {
   /** Subscribe to CRDT changes on a canvas document. Returns unsubscribe function. */
   subscribe(taskId, callback) {
     const doc2 = this.getOrCreateCanvasDoc(taskId);
-    return subscribe(doc2, callback);
+    const unsubscribe = subscribe(doc2, callback);
+    this.#subscriberCounts.set(taskId, (this.#subscriberCounts.get(taskId) ?? 0) + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      unsubscribe();
+      this.#releaseSubscriber(taskId);
+    };
+  }
+  #releaseSubscriber(taskId) {
+    const next = (this.#subscriberCounts.get(taskId) ?? 0) - 1;
+    if (next <= 0) this.#subscriberCounts.delete(taskId);
+    else this.#subscriberCounts.set(taskId, next);
+  }
+  /** Number of live Loro subscriptions held on this task's canvas doc. */
+  subscriberCount(taskId) {
+    return this.#subscriberCounts.get(taskId) ?? 0;
   }
   /**
    * Drop the cached `Doc` reference for this task so the next
-   * `getOrCreateCanvasDoc(taskId)` call returns a fresh doc from the
-   * underlying repo. Called by the corruption recovery service after
-   * `repo.delete(docId)` evicts the poisoned doc from the synchronizer
-   * model — without this, callers would keep getting back the dangling
-   * reference to the now-evicted (and still-poisoned) LoroDoc instance.
+   * `getOrCreateCanvasDoc(taskId)` returns a fresh doc from the repo.
+   *
+   * Refcount-gated: a no-op (returns false) while a live Loro subscription
+   * is held on the doc, because evicting it would orphan the subscriber's
+   * callback against a dropped LoroDoc. The idle-sweep leak fix and
+   * `removeTask` both route through here so neither can drop a doc a
+   * resolver/viz-watcher is still reading. Returns true if the doc was
+   * evicted (or was already absent).
+   *
+   * For the corruption-recovery path — where the doc is poisoned and its
+   * subscription is already dead — use `forceInvalidate` instead.
    */
   invalidate(taskId) {
+    if (this.subscriberCount(taskId) > 0) return false;
+    this.#evict(taskId);
+    return true;
+  }
+  /**
+   * Unconditionally drop the cached `Doc` reference, ignoring the
+   * subscription refcount. Used only by the corruption-recovery service:
+   * a poisoned doc's wasm methods throw, so its subscription is already
+   * dead and pinning the reference would re-hand the poisoned doc on the
+   * next `repo.get`. The refcount gate on `invalidate` must NOT block that
+   * recovery — hence this escape hatch.
+   */
+  forceInvalidate(taskId) {
+    this.#evict(taskId);
+  }
+  /**
+   * Eviction's remote-safety depends on every personal/canvas repo using
+   * `deletion: () => false`: `repo.delete` fans out a `channel/delete-request`
+   * that peers currently ignore, so dropping the local cache never propagates
+   * as a remote delete. If any repo's `deletion` ever becomes permissive,
+   * eviction here would tombstone the doc on peers — re-audit this call site.
+   */
+  #evict(taskId) {
     this.#canvasDocs.delete(taskId);
+    this.#subscriberCounts.delete(taskId);
+    const repoDelete = this.#repo.delete;
+    if (repoDelete) {
+      const docId = buildCanvasDocId(taskId, this.#epoch);
+      void repoDelete.call(this.#repo, docId);
+    }
   }
   /**
    * Number of cached canvas docs. Exposed for health metrics — see
@@ -6517,8 +6577,23 @@ var CanvasRepository = class {
   get cachedDocCount() {
     return this.#canvasDocs.size;
   }
+  /** Task ids with a currently-cached canvas doc. Drives the idle sweep's candidate set. */
+  cachedTaskIds() {
+    return [...this.#canvasDocs.keys()];
+  }
+  /**
+   * The repo-level docId this task's canvas maps to. Lets the daemon-side idle
+   * sweep ask the personal repo's synchronizer "is any peer syncing this doc?"
+   * (a browser viewer holds no daemon-side `subscribe()` refcount — it syncs
+   * over WebRTC — so a doc a viewer is editing must be excluded from eviction
+   * by its live peer subscription, not by the refcount).
+   */
+  docIdFor(taskId) {
+    return buildCanvasDocId(taskId, this.#epoch);
+  }
   dispose() {
     this.#canvasDocs.clear();
+    this.#subscriberCounts.clear();
   }
 };
 
@@ -17195,6 +17270,14 @@ var PlanRepository = class {
   #epoch;
   #planDocs = /* @__PURE__ */ new Map();
   #contentBridge;
+  /**
+   * Live Loro-subscription refcount per task. `subscribe()` increments; the
+   * returned unsubscribe decrements (idempotently). `invalidate()` is a no-op
+   * while a task's count is > 0 because evicting a doc out from under a live
+   * subscription orphans the subscriber's callback against a dropped LoroDoc —
+   * a silent data-loss bug. The idle sweep only evicts zero-refcount docs.
+   */
+  #subscriberCounts = /* @__PURE__ */ new Map();
   constructor(repo, epoch, contentBridge) {
     this.#repo = repo;
     this.#epoch = epoch;
@@ -17223,7 +17306,7 @@ var PlanRepository = class {
     try {
       this.#contentBridge.writeMarkdown(doc2, markdown);
     } catch (err) {
-      this.invalidate(taskId);
+      this.forceInvalidate(taskId);
       throw err;
     }
   }
@@ -17243,26 +17326,76 @@ var PlanRepository = class {
   /** Subscribe to CRDT changes on a plan document. Returns unsubscribe function. */
   subscribe(taskId, callback) {
     const doc2 = this.getOrCreatePlanDoc(taskId);
-    return subscribe(doc2, callback);
+    const unsubscribe = subscribe(doc2, callback);
+    this.#subscriberCounts.set(taskId, (this.#subscriberCounts.get(taskId) ?? 0) + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      unsubscribe();
+      this.#releaseSubscriber(taskId);
+    };
+  }
+  #releaseSubscriber(taskId) {
+    const next = (this.#subscriberCounts.get(taskId) ?? 0) - 1;
+    if (next <= 0) this.#subscriberCounts.delete(taskId);
+    else this.#subscriberCounts.set(taskId, next);
+  }
+  /** Number of live Loro subscriptions held on this task's plan doc. */
+  subscriberCount(taskId) {
+    return this.#subscriberCounts.get(taskId) ?? 0;
   }
   /**
    * Drop the cached `Doc` reference for this task so the next
-   * `getOrCreatePlanDoc(taskId)` call returns a fresh doc.
+   * `getOrCreatePlanDoc(taskId)` call returns a fresh doc from disk.
    *
-   * Local map clear is necessary but not sufficient: loro-repo maintains
-   * its own per-docId cache and `repo.get(docId, schema)` returns the
-   * same `RepoDoc` until it is also evicted there. When the repo
-   * implementation provides `delete`, fire it (no await — kept sync to
-   * preserve the existing call contract; microtask ordering guarantees
-   * eviction completes before the next `get` reaches the synchronizer).
+   * Refcount-gated: a no-op (returns false) while a live Loro subscription
+   * is held on the doc, because evicting it would orphan the subscriber's
+   * callback against a dropped LoroDoc. The idle-sweep leak fix and
+   * `removeTask` both route through here so neither can drop a doc a
+   * resolver/file-bridge is still reading. Returns true if the doc was
+   * evicted (or was already absent).
    *
-   * Without the repo-side eviction, the wasm-panic recovery path in
-   * `updateContent` re-hands the poisoned doc on the next write,
-   * triggering the same panic again — the 47s detection wait reappears
-   * on every subsequent attempt.
+   * For the corruption-recovery path — where the doc is poisoned and its
+   * subscription is already dead — use `forceInvalidate` instead.
    */
   invalidate(taskId) {
+    if (this.subscriberCount(taskId) > 0) return false;
+    this.#evict(taskId);
+    return true;
+  }
+  /**
+   * Unconditionally evict, ignoring the subscription refcount. Used by the
+   * corruption-recovery service and the `updateContent` bridge-throw path:
+   * a poisoned doc's wasm methods throw, so its subscription is already dead
+   * and pinning the reference would re-hand the poisoned doc on the next
+   * `repo.get` — re-triggering the panic. The refcount gate must NOT block
+   * that recovery.
+   */
+  forceInvalidate(taskId) {
+    this.#evict(taskId);
+  }
+  /**
+   * Drop the local Map ref AND loro-repo's `#docCache` + synchronizer entry.
+   *
+   * Local map clear is necessary but not sufficient: loro-repo maintains its
+   * own per-docId cache and `repo.get(docId, schema)` returns the same
+   * `RepoDoc` until it is also evicted there — so without `repo.delete` the
+   * `LoroDoc` is never released and its wasm linear-memory leaks. When the
+   * repo implementation provides `delete`, fire it (no await — kept sync to
+   * preserve the call contract; microtask ordering guarantees eviction
+   * completes before the next `get` reaches the synchronizer). The persisted
+   * on-disk chunks are NOT removed, so the next `get` rehydrates from disk.
+   *
+   * Remote-safety depends on every personal/plan repo using
+   * `deletion: () => false`: `repo.delete` fans out a `channel/delete-request`
+   * that peers currently ignore, so dropping the local cache never propagates
+   * as a remote delete. If any repo's `deletion` ever becomes permissive,
+   * eviction here would tombstone the doc on peers — re-audit this call site.
+   */
+  #evict(taskId) {
     this.#planDocs.delete(taskId);
+    this.#subscriberCounts.delete(taskId);
     const repoDelete = this.#repo.delete;
     if (repoDelete) {
       const docId = buildPlanDocId(taskId, this.#epoch);
@@ -17278,8 +17411,23 @@ var PlanRepository = class {
   get cachedDocCount() {
     return this.#planDocs.size;
   }
+  /** Task ids with a currently-cached plan doc. Drives the idle sweep's candidate set. */
+  cachedTaskIds() {
+    return [...this.#planDocs.keys()];
+  }
+  /**
+   * The repo-level docId this task's plan maps to. Lets the daemon-side idle
+   * sweep ask the personal repo's synchronizer "is any peer syncing this doc?"
+   * (a browser viewer holds no daemon-side `subscribe()` refcount — it syncs
+   * over WebRTC — so a doc a viewer is editing must be excluded from eviction
+   * by its live peer subscription, not by the refcount).
+   */
+  docIdFor(taskId) {
+    return buildPlanDocId(taskId, this.#epoch);
+  }
   dispose() {
     this.#planDocs.clear();
+    this.#subscriberCounts.clear();
   }
 };
 
@@ -21920,7 +22068,17 @@ var DaemonToBrowserControlMessageSchema = external_exports.discriminatedUnion("t
         connectionStatus: external_exports.enum(["connected", "failed", "needs-auth", "connecting", "disabled"]).nullable(),
         terminalReason: external_exports.literal("unsupported").optional(),
         error: external_exports.string().optional(),
-        toolCount: external_exports.number().optional()
+        toolCount: external_exports.number().optional(),
+        /**
+         * PROTOCOL_VERSION 130 (additive): data-driven error surface. `errorType`
+         * is the classified backend/gateway code (raw `error` still preserved,
+         * unmasked per #4475); `remediation` is an optional generic CTA the picker
+         * renders without per-connector branching; `sources` is the dedup
+         * provenance set. All optional — pre-v130 browsers drop them, MIN stays 129.
+         */
+        errorType: external_exports.string().optional(),
+        remediation: external_exports.object({ message: external_exports.string(), url: external_exports.string().optional() }).optional(),
+        sources: external_exports.array(external_exports.string()).optional()
       })
     )
   }),
@@ -27761,4 +27919,4 @@ export {
   toRecord,
   buildCursorUserPrompt
 };
-//# sourceMappingURL=chunk-AVF7LE7Q.js.map
+//# sourceMappingURL=chunk-WMOR5Q6C.js.map