@vincentt-xr/cli 0.17.0 → 0.18.1

package/dist/publish/manifest.js

@@ -11,13 +11,178 @@ import { normalizePath, validatePathSet } from "./paths.js";
 export class ManifestError extends Error {
     reason;
     offendingPath;
-    constructor(reason, offendingPath, message) {
+    paths;
+    stats;
+    constructor(reason, offendingPath, message, detail = {}) {
         super(message);
         this.reason = reason;
         this.offendingPath = offendingPath;
         this.name = "ManifestError";
+        this.paths = detail.paths ?? [];
+        this.stats = detail.stats;
     }
 }
+/** The only dotted names allowed, and only at the output root. Case-insensitive. */
+const ALLOWED_ROOT_DIR = ".well-known";
+const ALLOWED_ROOT_FILE = ".nojekyll";
+const LFS_POINTER_MAX_BYTES = 1024;
+const LFS_FIRST_LINE = "version https://git-lfs.github.com/spec/v1";
+function isInside(child, parent) {
+    const rel = path.relative(parent, child);
+    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function hasDottedSegment(rel) {
+    return rel.split(/[\\/]/).some((seg) => seg.startsWith("."));
+}
+/**
+ * The leak walk. Unlike `walkDist` it records what it does not upload: a dotted
+ * name is an offender (a folder once, with a trailing slash, never descended),
+ * and every symlink is resolved and judged against the real repo root.
+ */
+async function walkOutput(outReal, rootReal) {
+    const files = [];
+    const offenders = [];
+    const visit = async (dir) => {
+        const entries = await fs.readdir(dir, { withFileTypes: true });
+        entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            const rel = path.relative(outReal, full).split(path.sep).join("/");
+            const atRoot = dir === outReal;
+            const lower = entry.name.toLowerCase();
+            if (entry.name.startsWith(".")) {
+                const allowed = atRoot &&
+                    ((lower === ALLOWED_ROOT_DIR && entry.isDirectory()) ||
+                        (lower === ALLOWED_ROOT_FILE && entry.isFile()));
+                if (!allowed) {
+                    offenders.push({ path: entry.isDirectory() ? `${rel}/` : rel });
+                    continue;
+                }
+            }
+            if (entry.isSymbolicLink()) {
+                const target = await symlinkTarget(full);
+                if (!isInside(target, rootReal)) {
+                    offenders.push({ path: rel, target });
+                }
+                else if (hasDottedSegment(path.relative(rootReal, target))) {
+                    offenders.push({
+                        path: rel,
+                        target: path.relative(rootReal, target).split(path.sep).join("/"),
+                    });
+                }
+                // A symlink that resolves cleanly inside is not uploaded, as before.
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await visit(full);
+            }
+            else if (entry.isFile()) {
+                const stat = await fs.stat(full);
+                files.push({ rel, size: stat.size });
+            }
+        }
+    };
+    await visit(outReal);
+    return { files, offenders };
+}
+/** Where a symlink lands: its realpath, or its lexical target when it dangles. */
+async function symlinkTarget(link) {
+    try {
+        return await fs.realpath(link);
+    }
+    catch {
+        const raw = await fs.readlink(link).catch(() => link);
+        return path.resolve(path.dirname(link), raw);
+    }
+}
+/** A Git LFS pointer file: at most 1 KB, the spec's exact first line, and an oid line. */
+export async function isLfsPointer(absPath, size) {
+    if (size > LFS_POINTER_MAX_BYTES)
+        return false;
+    const head = await fs.readFile(absPath, "utf8");
+    const lines = head.split("\n");
+    if (lines[0] !== LFS_FIRST_LINE)
+        return false;
+    return lines.some((l) => l.startsWith("oid sha256:"));
+}
+/**
+ * The leak and LFS checks, in that order, before anything is hashed or sent.
+ * Throws ManifestError; returns nothing on a clean output.
+ */
+/**
+ * Folders an output must never be, or sit inside: the repository's history and
+ * the Vincentt binding. Compared case-insensitively, as a default macOS volume
+ * resolves `.GIT` to `.git`. Other dotted parents stay allowed (`.output/public`).
+ */
+const FORBIDDEN_OUTPUT_SEGMENTS = new Set([".git", ".vincentt"]);
+function forbiddenSegmentIn(rel) {
+    return rel
+        .split(/[\\/]/)
+        .find((seg) => FORBIDDEN_OUTPUT_SEGMENTS.has(seg.toLowerCase()));
+}
+/**
+ * The leak and LFS checks, in that order, before anything is hashed or sent.
+ * Returns the output-relative file list the checks passed, which is exactly the
+ * list the manifest is built from: what is checked is what is uploaded.
+ */
+export async function checkOutput(distDir, repoRoot) {
+    const rootReal = await fs.realpath(repoRoot).catch(() => path.resolve(repoRoot));
+    const lexical = path.resolve(distDir);
+    const lexicalRoot = path.resolve(repoRoot);
+    if (lexical === lexicalRoot) {
+        throw new ManifestError("output_is_repo_root", distDir, `${distDir} is the repo root`);
+    }
+    if (!isInside(lexical, lexicalRoot) && !isInside(lexical, rootReal)) {
+        throw new ManifestError("output_outside_repo", distDir, `${distDir} is outside the repo`);
+    }
+    let outReal;
+    try {
+        outReal = await fs.realpath(distDir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            throw new ManifestError("no_dist", distDir, `no dist at ${distDir}`);
+        }
+        throw err;
+    }
+    if (outReal === rootReal) {
+        throw new ManifestError("output_is_repo_root", distDir, `${distDir} resolves to the repo root`);
+    }
+    if (!isInside(outReal, rootReal)) {
+        throw new ManifestError("output_outside_repo", distDir, `${distDir} resolves outside the repo`);
+    }
+    const hiddenParent = forbiddenSegmentIn(path.relative(lexicalRoot, lexical)) ??
+        forbiddenSegmentIn(path.relative(rootReal, outReal));
+    if (hiddenParent !== undefined) {
+        throw new ManifestError("output_in_hidden", hiddenParent, `${distDir} is inside ${hiddenParent}`);
+    }
+    if (!(await fs.stat(outReal)).isDirectory()) {
+        throw new ManifestError("no_dist", distDir, `no dist at ${distDir}`);
+    }
+    const walk = await walkOutput(outReal, rootReal);
+    const stats = {
+        files: walk.files.length,
+        bytes: walk.files.reduce((n, f) => n + f.size, 0),
+    };
+    if (walk.offenders.length > 0) {
+        throw new ManifestError("secret_path", walk.offenders[0].path, "hidden paths in the output", {
+            paths: walk.offenders,
+            stats,
+        });
+    }
+    const pointers = [];
+    for (const f of walk.files) {
+        if (await isLfsPointer(path.join(outReal, f.rel), f.size))
+            pointers.push({ path: f.rel });
+    }
+    if (pointers.length > 0) {
+        throw new ManifestError("lfs_pointer", pointers[0].path, "Git LFS pointers in the output", {
+            paths: pointers,
+            stats,
+        });
+    }
+    return walk.files;
+}
 /** Recursively list files under `dir` as dir-relative POSIX paths. Symlinks are not followed. */
 export async function walkDist(dir, base = dir) {
     let entries;
@@ -54,8 +219,12 @@ export async function hashFile(absPath) {
  * hashed, so the string this returns is the string the API validates, signs, and
  * later lists — there is no second form anywhere.
  */
-export async function buildManifest(distDir) {
-    const raw = await walkDist(distDir);
+export async function buildManifest(distDir, opts = {}) {
+    // With a repo root, the list the leak and LFS checks passed IS the upload
+    // list. A second walk could see a file created after the checks ran.
+    const raw = opts.repoRoot !== undefined
+        ? (await checkOutput(distDir, opts.repoRoot)).map((f) => f.rel)
+        : await walkDist(distDir);
     const normalized = [];
     for (const rel of raw) {
         const result = normalizePath(rel);

package/dist/publish/prompt.d.ts

@@ -3,5 +3,9 @@ export type Confirm = (prompt: string, defaultYes: boolean) => Promise<boolean>;
 export declare function stdinConfirm(input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Confirm;
 /** Reads one free-text line. An empty answer takes the offered default. */
 export type Ask = (prompt: string, fallback: string) => Promise<string>;
+/** Input ended (Ctrl-D, a closed pipe) before a free-text question was answered. */
+export declare class PromptClosedError extends Error {
+    constructor();
+}
 export declare function stdinAsk(input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Ask;
 export declare function interpretAnswer(answer: string, defaultYes: boolean): boolean;

package/dist/publish/prompt.js

@@ -32,11 +32,25 @@ export function stdinConfirm(input = process.stdin, output = process.stdout) {
         }
     };
 }
+/** Input ended (Ctrl-D, a closed pipe) before a free-text question was answered. */
+export class PromptClosedError extends Error {
+    constructor() {
+        super("Input ended before the question was answered. Nothing more was done.");
+        this.name = "PromptClosedError";
+    }
+}
 export function stdinAsk(input = process.stdin, output = process.stdout) {
     return async (prompt, fallback) => {
         const rl = readline.createInterface({ input, output });
         try {
-            const answer = await new Promise((resolve) => rl.question(prompt, resolve));
+            // EOF is a refusal, not an empty answer: taking the fallback here would
+            // register a name or address the creator never agreed to.
+            const answer = await new Promise((resolve) => {
+                rl.question(prompt, resolve);
+                rl.once("close", () => resolve(undefined));
+            });
+            if (answer === undefined)
+                throw new PromptClosedError();
             return answer.trim() === "" ? fallback : answer.trim();
         }
         finally {

package/dist/publish/upload.d.ts

@@ -4,7 +4,23 @@ export declare class UploadFailed extends Error {
     readonly path: string;
     readonly status: number;
     readonly badDigest: boolean;
-    constructor(path: string, status: number, badDigest: boolean);
+    /** S3's own error code, when the response carried one. */
+    readonly s3Code?: string | undefined;
+    /** A transport error or 5xx outlasted every retry: re-running is the remedy. */
+    readonly retryable: boolean;
+    constructor(path: string, status: number, badDigest: boolean, 
+    /** S3's own error code, when the response carried one. */
+    s3Code?: string | undefined, 
+    /** A transport error or 5xx outlasted every retry: re-running is the remedy. */
+    retryable?: boolean);
+}
+/**
+ * A presigned URL was refused because it expired. The upload has to be
+ * re-opened for fresh URLs; nothing about the file is wrong.
+ */
+export declare class UploadExpired extends Error {
+    readonly path: string;
+    constructor(path: string);
 }
 export interface UploadProgress {
     filesDone: number;
@@ -19,12 +35,50 @@ export interface UploadOptions {
     concurrency?: number;
     onProgress?: (p: UploadProgress) => void;
     fetchImpl?: typeof fetch;
-    /** Per-file retries for a transient network/5xx failure. A BadDigest is retried once. */
+    /** Attempts per file for a transport error or 5xx. A BadDigest is retried once. */
     maxAttempts?: number;
+    /** Test seams for the backoff. */
+    sleep?: (ms: number) => Promise<void>;
+    random?: () => number;
 }
 /**
- * PUT every file. A re-run that finds files already landed simply uploads
- * fewer — resumption is silent, because the creator did not ask for a resume,
- * they asked to publish.
+ * One PUT's deadline: a minute, plus the time the file takes at 64 KB/s. A fixed
+ * deadline would fail every large file on a slow uplink; none at all lets a
+ * stalled connection hang the publish forever. The api sizes the upload window
+ * at the same rate, so a PUT this deadline still waits for is never refused by
+ * an expired link.
+ */
+export declare function putDeadlineMs(bytes: number): number;
+/** Exponential backoff with full jitter: uniform in [0, min(cap, base * 2^(n-1))). */
+export declare function backoffMs(attempt: number, random?: () => number): number;
+export type S3Outcome = {
+    kind: "ok";
+} | {
+    kind: "expired";
+} | {
+    kind: "bad_digest";
+    code: string;
+} | {
+    kind: "retry";
+    code?: string;
+} | {
+    kind: "fatal";
+    code?: string;
+};
+/**
+ * What a PUT's response means, read from S3's own error code rather than the
+ * status alone. A 400 is many things — S3 answers a stalled body with 400
+ * RequestTimeout — and only BadDigest means the bytes on disk are not the bytes
+ * that were hashed.
+ */
+export declare function classifyS3Response(status: number, body: string): S3Outcome;
+/**
+ * PUT every target. The api returns targets only for files not yet landed when
+ * it resumes an open upload, so a re-run simply uploads fewer — resumption is
+ * silent, because the creator did not ask for a resume, they asked to publish.
+ *
+ * On the first file that cannot land, no new PUT starts; the ones in flight
+ * finish, and the first failure is thrown (UploadExpired only when nothing
+ * worse happened, since re-opening cannot fix a changed file).
  */
 export declare function uploadAll(opts: UploadOptions): Promise<void>;

package/dist/publish/upload.js

@@ -7,35 +7,109 @@
 // makes every published index.html download instead of render in the other
 // (§2.7's contract traps 3 and 4).
 //
-// The CLI never synthesizes a MIME type and never parses the presigned URL.
-import { promises as fs } from "node:fs";
+// The CLI never synthesizes a MIME type and never parses the presigned URL. The
+// one header it adds is Content-Length, which S3 requires on a PUT and which a
+// streamed body does not carry on its own.
+import { createReadStream, promises as fs } from "node:fs";
 import path from "node:path";
+import { Readable } from "node:stream";
+import { withDeadline } from "../shared/http.js";
 export class UploadFailed extends Error {
     path;
     status;
     badDigest;
-    constructor(path, status, badDigest) {
-        super(`upload failed for ${path} (${status})`);
+    s3Code;
+    retryable;
+    constructor(path, status, badDigest, 
+    /** S3's own error code, when the response carried one. */
+    s3Code, 
+    /** A transport error or 5xx outlasted every retry: re-running is the remedy. */
+    retryable = false) {
+        super(`upload failed for ${path} (${status}${s3Code ? ` ${s3Code}` : ""})`);
         this.path = path;
         this.status = status;
         this.badDigest = badDigest;
+        this.s3Code = s3Code;
+        this.retryable = retryable;
         this.name = "UploadFailed";
     }
 }
+/**
+ * A presigned URL was refused because it expired. The upload has to be
+ * re-opened for fresh URLs; nothing about the file is wrong.
+ */
+export class UploadExpired extends Error {
+    path;
+    constructor(path) {
+        super(`the upload link for ${path} expired`);
+        this.path = path;
+        this.name = "UploadExpired";
+    }
+}
 const DEFAULT_CONCURRENCY = 6;
+const DEFAULT_MAX_ATTEMPTS = 5;
+const BACKOFF_BASE_MS = 500;
+const BACKOFF_CAP_MS = 15_000;
+/**
+ * One PUT's deadline: a minute, plus the time the file takes at 64 KB/s. A fixed
+ * deadline would fail every large file on a slow uplink; none at all lets a
+ * stalled connection hang the publish forever. The api sizes the upload window
+ * at the same rate, so a PUT this deadline still waits for is never refused by
+ * an expired link.
+ */
+export function putDeadlineMs(bytes) {
+    return 60_000 + Math.ceil(bytes / 64_000) * 1000;
+}
+/** Exponential backoff with full jitter: uniform in [0, min(cap, base * 2^(n-1))). */
+export function backoffMs(attempt, random = Math.random) {
+    const ceiling = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** Math.max(0, attempt - 1));
+    return Math.floor(random() * ceiling);
+}
 /**
- * PUT every file. A re-run that finds files already landed simply uploads
- * fewer — resumption is silent, because the creator did not ask for a resume,
- * they asked to publish.
+ * What a PUT's response means, read from S3's own error code rather than the
+ * status alone. A 400 is many things — S3 answers a stalled body with 400
+ * RequestTimeout — and only BadDigest means the bytes on disk are not the bytes
+ * that were hashed.
+ */
+export function classifyS3Response(status, body) {
+    if (status >= 200 && status < 300)
+        return { kind: "ok" };
+    const code = /<Code>([^<]+)<\/Code>/.exec(body)?.[1];
+    const message = /<Message>([^<]*)<\/Message>/.exec(body)?.[1] ?? "";
+    if (status === 403 && code === "AccessDenied" && /request has expired/i.test(message)) {
+        return { kind: "expired" };
+    }
+    if (code === "BadDigest")
+        return { kind: "bad_digest", code };
+    if (code === "RequestTimeout" || code === "IncompleteBody")
+        return { kind: "retry", code };
+    if (status >= 500 || status === 408 || status === 429)
+        return { kind: "retry", code };
+    return { kind: "fatal", code };
+}
+/**
+ * PUT every target. The api returns targets only for files not yet landed when
+ * it resumes an open upload, so a re-run simply uploads fewer — resumption is
+ * silent, because the creator did not ask for a resume, they asked to publish.
+ *
+ * On the first file that cannot land, no new PUT starts; the ones in flight
+ * finish, and the first failure is thrown (UploadExpired only when nothing
+ * worse happened, since re-opening cannot fix a changed file).
  */
 export async function uploadAll(opts) {
     const fetchImpl = opts.fetchImpl ?? fetch;
     const sizes = new Map(opts.manifest.map((f) => [f.path, f.size]));
-    const bytesTotal = opts.manifest.reduce((n, f) => n + f.size, 0);
+    const bytesTotal = opts.targets.reduce((n, t) => n + (sizes.get(t.path) ?? 0), 0);
     const queue = [...opts.targets];
-    const maxAttempts = opts.maxAttempts ?? 3;
+    const retry = {
+        maxAttempts: opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
+        sleep: opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+        random: opts.random ?? Math.random,
+    };
     let filesDone = 0;
     let bytesDone = 0;
+    let failed = false;
+    let failure;
     const report = () => opts.onProgress?.({
         filesDone,
         filesTotal: opts.targets.length,
@@ -44,11 +118,19 @@ export async function uploadAll(opts) {
     });
     report();
     const worker = async () => {
-        for (;;) {
+        while (!failed) {
             const target = queue.shift();
             if (!target)
                 return;
-            await putOne(target, opts.distDir, fetchImpl, maxAttempts);
+            try {
+                await putOne(target, opts.distDir, fetchImpl, retry);
+            }
+            catch (err) {
+                if (!failed || failure instanceof UploadExpired)
+                    failure = err;
+                failed = true;
+                return;
+            }
             filesDone += 1;
             bytesDone += sizes.get(target.path) ?? 0;
             report();
@@ -56,38 +138,64 @@ export async function uploadAll(opts) {
     };
     const workers = Array.from({ length: Math.min(opts.concurrency ?? DEFAULT_CONCURRENCY, queue.length || 1) }, () => worker());
     await Promise.all(workers);
+    if (failed)
+        throw failure;
 }
-async function putOne(target, distDir, fetchImpl, maxAttempts) {
+async function putOne(target, distDir, fetchImpl, retry) {
     const abs = path.join(distDir, ...target.path.split("/"));
-    const body = await fs.readFile(abs);
+    const { size } = await fs.stat(abs);
+    const put = withDeadline(fetchImpl, putDeadlineMs(size));
     let lastStatus = 0;
+    let lastCode;
     let sawBadDigest = false;
-    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    for (let attempt = 1; attempt <= retry.maxAttempts; attempt++) {
+        if (attempt > 1)
+            await retry.sleep(backoffMs(attempt - 1, retry.random));
+        // A fresh stream per attempt: a body cannot be replayed once read.
+        const stream = createReadStream(abs);
         let res;
+        let text;
         try {
-            res = await fetchImpl(target.url, {
+            res = await put(target.url, {
                 method: "PUT",
-                // VERBATIM. No key dropped, no key added, no key renamed.
-                headers: { ...target.headers },
-                body: new Uint8Array(body),
+                // VERBATIM. No key dropped, no key renamed; Content-Length is the one
+                // addition, required by S3 and absent from a streamed body.
+                headers: { ...target.headers, "content-length": String(size) },
+                body: Readable.toWeb(stream),
+                duplex: "half",
             });
+            text = res.ok ? "" : await res.text().catch(() => "");
         }
         catch {
             lastStatus = 0;
+            lastCode = undefined;
             continue;
         }
-        if (res.ok)
-            return;
-        lastStatus = res.status;
-        const text = await res.text().catch(() => "");
-        if (text.includes("BadDigest") || res.status === 400) {
-            // The bytes on disk differ from what was hashed. One silent re-PUT covers
-            // a torn read; a repeat means the file genuinely changed under us.
-            if (sawBadDigest)
-                throw new UploadFailed(target.path, res.status, true);
-            sawBadDigest = true;
-            continue;
+        finally {
+            stream.destroy();
+        }
+        const outcome = classifyS3Response(res.status, text);
+        switch (outcome.kind) {
+            case "ok":
+                return;
+            case "expired":
+                throw new UploadExpired(target.path);
+            case "bad_digest":
+                // The bytes on disk differ from what was hashed. One re-PUT covers a
+                // torn read; a repeat means the file genuinely changed under us.
+                if (sawBadDigest)
+                    throw new UploadFailed(target.path, res.status, true, outcome.code);
+                sawBadDigest = true;
+                lastStatus = res.status;
+                lastCode = outcome.code;
+                continue;
+            case "retry":
+                lastStatus = res.status;
+                lastCode = outcome.code;
+                continue;
+            case "fatal":
+                throw new UploadFailed(target.path, res.status, false, outcome.code);
         }
     }
-    throw new UploadFailed(target.path, lastStatus, sawBadDigest);
+    throw new UploadFailed(target.path, lastStatus, sawBadDigest, lastCode, !sawBadDigest);
 }

package/dist/publish/visibility.d.ts

@@ -0,0 +1,21 @@
+/** The longest the CLI waits for the address to serve the new version. */
+export declare const VISIBILITY_WAIT_MS = 90000;
+export interface VisibilityDeps {
+    fetchImpl: typeof fetch;
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+    /** Called once, before the first wait, and only if the first probe missed. */
+    onWaiting?: () => void;
+}
+export interface VisibilityResult {
+    visible: boolean;
+    waitedMs: number;
+}
+/**
+ * Probe `liveUrl` until its body hashes to `indexSha256` (std base64, as in the
+ * manifest) or `VISIBILITY_WAIT_MS` passes. Never throws: a failed probe is a miss.
+ *
+ * Elapsed time is the larger of the clock and the summed sleeps, so the bound
+ * holds under a frozen test clock as well as against slow probes.
+ */
+export declare function waitUntilServing(liveUrl: string, indexSha256: string, deps: VisibilityDeps): Promise<VisibilityResult>;

package/dist/publish/visibility.js

@@ -0,0 +1,68 @@
+// After commit, wait until the public address serves the version just committed.
+//
+// The api flips the slug pointer in CloudFront KeyValueStore, which is eventually
+// consistent: staging measured 13 to 36 s between "committed" and the edge serving
+// the new bytes. The marker is index.html itself. The CLI already holds its sha256
+// from the manifest, so a probe hashes the served body and compares; nothing new
+// has to be added to the bundle, the router or the api.
+//
+// Used by publish/command.ts. IO (fetch, clock, sleep) is injected for tests.
+import { createHash } from "node:crypto";
+import { withDeadline } from "../shared/http.js";
+/** The longest the CLI waits for the address to serve the new version. */
+export const VISIBILITY_WAIT_MS = 90_000;
+const FIRST_DELAY_MS = 1_000;
+const MAX_DELAY_MS = 5_000;
+const PROBE_DEADLINE_MS = 10_000;
+/**
+ * Probe `liveUrl` until its body hashes to `indexSha256` (std base64, as in the
+ * manifest) or `VISIBILITY_WAIT_MS` passes. Never throws: a failed probe is a miss.
+ *
+ * Elapsed time is the larger of the clock and the summed sleeps, so the bound
+ * holds under a frozen test clock as well as against slow probes.
+ */
+export async function waitUntilServing(liveUrl, indexSha256, deps) {
+    const probe = withDeadline(deps.fetchImpl, PROBE_DEADLINE_MS);
+    const startedAt = deps.now();
+    let slept = 0;
+    let delay = FIRST_DELAY_MS;
+    const elapsed = () => Math.max(deps.now() - startedAt, slept);
+    for (let attempt = 1;; attempt++) {
+        if (await serves(probe, liveUrl, indexSha256, attempt)) {
+            return { visible: true, waitedMs: elapsed() };
+        }
+        const left = VISIBILITY_WAIT_MS - elapsed();
+        if (left <= 0)
+            return { visible: false, waitedMs: elapsed() };
+        if (attempt === 1)
+            deps.onWaiting?.();
+        const step = Math.min(delay, left);
+        await deps.sleep(step);
+        slept += step;
+        delay = Math.min(delay * 2, MAX_DELAY_MS);
+    }
+}
+async function serves(probe, liveUrl, indexSha256, attempt) {
+    try {
+        const res = await probe(bustedUrl(liveUrl, attempt), {
+            headers: { "cache-control": "no-cache", pragma: "no-cache" },
+        });
+        if (!res.ok)
+            return false;
+        const body = Buffer.from(await res.arrayBuffer());
+        return createHash("sha256").update(body).digest("base64") === indexSha256;
+    }
+    catch {
+        return false;
+    }
+}
+function bustedUrl(liveUrl, attempt) {
+    try {
+        const u = new URL(liveUrl);
+        u.searchParams.set("vincentt-check", `${Date.now().toString(36)}-${attempt}`);
+        return u.toString();
+    }
+    catch {
+        return liveUrl;
+    }
+}

package/dist/relay/annotations.js

@@ -74,7 +74,7 @@ export class AnnotationStore {
         };
         this.items.push(annotation);
         await fs.appendFile(path.join(this.dir, STORE_FILE), JSON.stringify(annotation) + "\n");
-        this.wake(annotation);
+        this.wake();
         return annotation;
     }
     /** The first annotation with seq greater than `after`, if one is already held. */
@@ -113,12 +113,17 @@ export class AnnotationStore {
             this.waiters.push(waiter);
         });
     }
-    wake(a) {
+    // A waiter gets the LOWEST held seq past its cursor, not the annotation whose
+    // write just finished: concurrent adds can finish persisting out of seq order,
+    // and handing over the later one first moves the consumer's cursor past the
+    // earlier one for good.
+    wake() {
         const remaining = [];
         for (const w of this.waiters) {
-            if (a.seq > w.after) {
+            const next = this.peekAfter(w.after);
+            if (next) {
                 clearTimeout(w.timer);
-                w.resolve({ kind: "annotation", annotation: a });
+                w.resolve({ kind: "annotation", annotation: next });
             }
             else {
                 remaining.push(w);