[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_40":41,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_33":-7,"_34":35,"_36":37,"_38":39,"_40":41,"_42":31,"_43":31,"_44":31,"_45":31,"_46":31,"_47":31,"_48":49,"_50":49,"_51":31,"_52":-7,"_53":-7,"_54":55,"_56":57,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":14,"_22":23,"_24":-5,"_25":26,"_27":28,"_28":29,"_30":31,"_32":14},"ref","8328c88cc3beae1bb78e4e4c5849c0cffe35f8d4","path","apps/server/src/plan/service.ts","oid","963c964b5b542174c91272f99531beec14362d93","size",13298,"commit","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","/**\n * The plan, as a room offers it.\n *\n * Sits between sockets and the authoritative document: batches incoming\n * updates, decides whether they may be applied, acknowledges the sender and\n * relays to everyone else, and keeps the disk snapshot current.\n *\n * Acknowledgement is the contract worth being careful about. A client is told\n * its update was accepted only once the document has taken it and still\n * validates, because an ack is what lets the client stop holding the bytes.\n */\n\nimport * as Y from \"yjs\";\n\nimport * as presence from \"./presence\";\nimport * as room from \"./room\";\nimport * as snapshot from \"./snapshot\";\nimport * as Chat from \"../chat/service\";\nimport * as Comments from \"../comments/service\";\nimport * as Questions from \"../questions/service\";\nimport { broadcast, relay, reply, tell } from \"../wire\";\n\nimport type { Server } from \"bun\";\nimport type { Plan as Wire, Request } from \"@chopin/protocol\";\nimport type { Socket, SocketData } from \"../wire\";\nimport type { Presence } from \"./presence\";\nimport type { Document } from \"./room\";\nimport type { Block } from \"./edit\";\nimport type { Sink } from \"./snapshot\";\n\n/** Updates are grouped for this long before being applied together. */\nconst GROUP_MS = 5;\n\n/** Per-connection ceiling, generous enough that typing never reaches it. */\nconst RATE_LIMIT = 200;\nconst RATE_WINDOW_MS = 1_000;\n\n/** Invalid batches tolerated from one connection before it is disconnected. */\nconst INVALID_LIMIT = 3;\nconst INVALID_WINDOW_MS = 10 * 60 * 1_000;\n\n/** Close code for a client that keeps sending updates the document rejects. */\nconst ABUSIVE = 4003;\n\ntype Queued = {\n\tws: Socket;\n\trid: string;\n\tid: string;\n\tupdate: Uint8Array;\n};\n\ntype Meter = {\n\t/** Timestamps of recent updates, for the rate limit. */\n\trecent: number[];\n\t/** Timestamps of recent rejections, for the strike count. */\n\tinvalid: number[];\n};\n\nexport type Plan = {\n\tdocument: Document;\n\tpresence: Presence;\n\tsink: Sink;\n\t/** Open questionnaires and their shared answer drafts. */\n\tquestions: Questions.Questions;\n\t/** Resolutions in flight and who is typing. Nothing durable. */\n\tcomments: Comments.Threads;\n\t/** The conversation driving the agent. */\n\tchat: Chat.Chat;\n\t/**\n\t * Every questionnaire this plan has ever held, answered or not.\n\t *\n\t * Kept beside the document rather than in it: the plan shows a decision,\n\t * this owns it. An agent rewriting the prose cannot change what was decided.\n\t */\n\trecords: Map;\n\t/**\n\t * Every comment thread this plan has ever held.\n\t *\n\t * Beside the document for the same reason a questionnaire record is: a\n\t * comment must not be undoable with the plan, and the agent must not be\n\t * able to rewrite what somebody said about its work.\n\t */\n\tthreads: Map;\n\t/** Bumped on every committed change; the agent's concurrency token. */\n\trevision: number;\n\t/**\n\t * Block outlines by revision.\n\t *\n\t * Kept so a batch aimed at a revision that has moved can be told which\n\t * blocks moved, rather than only that it is too late.\n\t */\n\toutlines: Map;\n\tqueue: Queued[];\n\ttimer: ReturnType | undefined;\n\t/** Serialises commits so two batches cannot interleave. */\n\tflushing: Promise;\n\tmeters: WeakMap;\n};\n\nfunction decode(value: string): Uint8Array {\n\treturn new Uint8Array(Buffer.from(value, \"base64\"));\n}\n\nfunction encode(value: Uint8Array): string {\n\treturn Buffer.from(value).toString(\"base64\");\n}\n\nfunction recent(stamps: number[], window: number): number[] {\n\tlet cutoff = Date.now() - window;\n\treturn stamps.filter(at => at > cutoff);\n}\n\n/**\n * Bring a room's plan into being.\n *\n * Restores from disk when there is something to restore, and validates it on\n * the way in: unlike a database record, this file is one a person can open and\n * edit between runs, so it is not trusted just because we wrote it.\n */\nexport async function open(id: string, dir: string, server: Server): Promise {\n\tlet stored = await snapshot.load(dir);\n\n\tif (stored?.source) {\n\t\ttry {\n\t\t\troom.validate(stored.source);\n\t\t} catch (err) {\n\t\t\tlet message = err instanceof Error ? err.message : String(err);\n\t\t\tthrow new Error(`${dir}/plan.mdx is not a valid plan: ${message}`, { cause: err });\n\t\t}\n\t}\n\n\tlet document = await room.create(stored?.source ?? \"\", true);\n\n\tlet plan: Plan = {\n\t\tdocument,\n\t\tpresence: presence.create(),\n\t\tquestions: Questions.create(),\n\t\tcomments: Comments.create(),\n\t\tchat: Chat.restore(\n\t\t\t(stored?.state.transcript ?? []) as never[],\n\t\t\tstored?.state.session,\n\t\t),\n\t\toutlines: new Map(),\n\t\trecords: new Map(\n\t\t\t(stored?.state.questions ?? []).map(record => [record.id, record as Questions.Record]),\n\t\t),\n\t\tthreads: new Map(\n\t\t\t(stored?.state.threads ?? []).map(record => [record.id, record as Comments.Record]),\n\t\t),\n\t\trevision: stored?.state.revision ?? 0,\n\t\tqueue: [],\n\t\ttimer: undefined,\n\t\tflushing: Promise.resolve(),\n\t\tmeters: new WeakMap(),\n\t\tsink: snapshot.sink({\n\t\t\tdir,\n\t\t\t// Anchors and passages are expressed against the document, so they\n\t\t\t// are brought forward before being written rather than left to the\n\t\t\t// agent's next edit — which is what used to recover a moved block.\n\t\t\t//\n\t\t\t// A recovery nobody is told about is invisible: the highlight stays\n\t\t\t// dark until something else happens to broadcast. So the snapshot\n\t\t\t// is compared, and the room hears only when it actually moved.\n\t\t\tonFlush: () => {\n\t\t\t\tlet before = signature(plan);\n\t\t\t\tQuestions.rebase(plan);\n\t\t\t\tComments.rebase(plan);\n\t\t\t\tif (signature(plan) !== before) anchors(plan, server, id);\n\t\t\t},\n\t\t\tread: () => ({\n\t\t\t\tsource: room.project(plan.document),\n\t\t\t\tstate: {\n\t\t\t\t\trevision: plan.revision,\n\t\t\t\t\tquestions: [...plan.records.values()],\n\t\t\t\t\tthreads: [...plan.threads.values()],\n\t\t\t\t\ttranscript: plan.chat.entries,\n\t\t\t\t\t...(plan.chat.resume ? { session: plan.chat.resume } : {}),\n\t\t\t\t},\n\t\t\t}),\n\t\t\tonWrite(state, message) {\n\t\t\t\tbroadcast(server, id, {\n\t\t\t\t\tkind: \"plan:status\",\n\t\t\t\t\tts: 0,\n\t\t\t\t\tstate,\n\t\t\t\t\trevision: plan.revision,\n\t\t\t\t\t...(message ? { message } : {}),\n\t\t\t\t});\n\t\t\t},\n\t\t}),\n\t};\n\n\t// A restart is an epoch rotation: every position restored from disk was\n\t// expressed in a history this document does not have. Recovering them now\n\t// rather than on the first write is what lets the client that joins one\n\t// millisecond later resolve anything at all.\n\t//\n\t// Guarded because this is the last thing between a room and being open. A\n\t// plan whose highlights are stale is worth having; one that refuses to open\n\t// because a decision could not be placed is not.\n\ttry {\n\t\tQuestions.rebase(plan);\n\t\tComments.rebase(plan);\n\t} catch (err) {\n\t\tconsole.error(`[plan] could not carry anchors into ${id}:`, err);\n\t}\n\n\treturn plan;\n}\n\n/** Cheap identity of the whole relationship snapshot, for spotting a change. */\nfunction signature(plan: Plan): string {\n\treturn JSON.stringify([Questions.anchors(plan), Comments.anchors(plan)]);\n}\n\n/** Everything a joining client needs to start from. */\nexport function greet(plan: Plan, ws: Socket, msg: Request): void {\n\tlet resume = msg.epoch === plan.document.epoch && msg.vector ? decode(msg.vector) : undefined;\n\tlet hello = presence.snapshot(plan.presence);\n\n\treply(ws, msg.rid, {\n\t\tkind: \"plan:open\",\n\t\tts: 0,\n\t\tepoch: plan.document.epoch,\n\t\tseq: plan.document.seq,\n\t\tupdate: encode(room.sync(plan.document, resume)),\n\t\trevision: plan.revision,\n\t\tanchors: Questions.anchors(plan),\n\t\tthreads: Comments.anchors(plan),\n\t\tlimits: room.LIMITS,\n\t\t...(hello ? { awareness: encode(hello) } : {}),\n\t});\n}\n\nfunction meter(plan: Plan, ws: Socket): Meter {\n\tlet existing = plan.meters.get(ws);\n\tif (existing) return existing;\n\tlet created: Meter = { recent: [], invalid: [] };\n\tplan.meters.set(ws, created);\n\treturn created;\n}\n\n/** Accept an update for the next batch, or say why not. */\nexport function submit(plan: Plan, ws: Socket, msg: Request): void {\n\tif (msg.epoch !== plan.document.epoch) {\n\t\t// Nothing to correct: the client is describing a history that no longer\n\t\t// exists and needs to re-open, which the reset already told it to do.\n\t\treturn;\n\t}\n\n\tlet update = decode(msg.update);\n\tif (update.byteLength > room.LIMITS.update) {\n\t\treturn tell(ws, {\n\t\t\tkind: \"plan:reset\",\n\t\t\tts: 0,\n\t\t\tepoch: plan.document.epoch,\n\t\t\treason: \"rebuilt\",\n\t\t});\n\t}\n\n\tlet gauge = meter(plan, ws);\n\tgauge.recent = recent(gauge.recent, RATE_WINDOW_MS);\n\tif (gauge.recent.length >= RATE_LIMIT) return;\n\tgauge.recent.push(Date.now());\n\n\tplan.queue.push({ ws, rid: msg.rid, id: msg.id, update });\n\tschedule(plan);\n}\n\nfunction schedule(plan: Plan): void {\n\tif (plan.timer) return;\n\tplan.timer = setTimeout(() => {\n\t\tplan.timer = undefined;\n\t\tplan.flushing = plan.flushing.then(() => commit(plan), () => commit(plan));\n\t}, GROUP_MS);\n}\n\n/**\n * Apply one batch.\n *\n * On rejection the document is rebuilt from its last known-good state and\n * everyone re-opens. Yjs cannot undo a transaction, so there is no narrower\n * remedy — which is why the senders in the batch are the ones charged for it.\n */\nasync function commit(plan: Plan): Promise {\n\tlet batch = plan.queue;\n\tif (batch.length === 0) return;\n\tplan.queue = [];\n\n\tlet outcome = await room.apply(plan.document, batch.map(item => item.update));\n\n\tif (!outcome.ok) {\n\t\tconsole.warn(\"[plan] rejected batch:\", outcome.issues.join(\", \"));\n\n\t\tlet now = Date.now();\n\t\tfor (let item of batch) {\n\t\t\tlet gauge = meter(plan, item.ws);\n\t\t\tgauge.invalid = [...recent(gauge.invalid, INVALID_WINDOW_MS), now];\n\t\t\tif (gauge.invalid.length >= INVALID_LIMIT) {\n\t\t\t\titem.ws.close(ABUSIVE, \"repeated invalid plan updates\");\n\t\t\t}\n\t\t}\n\n\t\tlet rebuilt = await room.rebuild(plan.document);\n\t\tplan.document = rebuilt;\n\t\t// Cursors describe positions in a history that no longer exists.\n\t\tpresence.destroy(plan.presence);\n\t\tplan.presence = presence.create();\n\t\t// So do anchors and passages, and unlike a cursor nobody re-announces\n\t\t// them. Without this every highlight in the room stays dark until the\n\t\t// agent happens to edit.\n\t\t//\n\t\t// Guarded because the `plan:reset` below is what tells everyone to\n\t\t// re-open. A throw here would strand the whole room on an epoch that no\n\t\t// longer exists, to save some highlights that are already stale.\n\t\ttry {\n\t\t\tQuestions.rebase(plan);\n\t\t\tComments.rebase(plan);\n\t\t} catch (err) {\n\t\t\tconsole.error(\"[plan] could not carry anchors onto the rebuilt document:\", err);\n\t\t}\n\n\t\tfor (let item of batch) {\n\t\t\ttell(item.ws, { kind: \"plan:reset\", ts: 0, epoch: rebuilt.epoch, reason: \"rebuilt\" });\n\t\t}\n\t\treturn;\n\t}\n\n\tplan.revision++;\n\n\tfor (let item of batch) {\n\t\treply(item.ws, item.rid, {\n\t\t\tkind: \"plan:ack\",\n\t\t\tts: 0,\n\t\t\tepoch: plan.document.epoch,\n\t\t\tid: item.id,\n\t\t\tseq: outcome.seq,\n\t\t});\n\t\t// Peers need the bytes; the sender already applied them locally.\n\t\trelay(item.ws, {\n\t\t\tkind: \"plan:update\",\n\t\t\tts: 0,\n\t\t\tepoch: plan.document.epoch,\n\t\t\tupdate: encode(item.update),\n\t\t\tseq: outcome.seq,\n\t\t});\n\t}\n\n\troom.mark(plan.document);\n\tplan.sink.touch();\n}\n\n/**\n * Relay a change the server made, as an ordinary update.\n *\n * Agent edits and answer projections reach clients the same way a keystroke\n * does: as a delta against the document they already hold. That is what keeps\n * an agent rewriting a paragraph from costing everybody else their cursor.\n */\nexport function publish(\n\tplan: Plan,\n\tserver: Server,\n\troomId: string,\n\tmutation: { update: Uint8Array; source: string },\n): void {\n\tplan.document.seq++;\n\tplan.revision++;\n\tbroadcast(server, roomId, {\n\t\tkind: \"plan:update\",\n\t\tts: 0,\n\t\tepoch: plan.document.epoch,\n\t\tupdate: encode(mutation.update),\n\t\tseq: plan.document.seq,\n\t});\n\troom.mark(plan.document);\n\tplan.sink.touch();\n}\n\n/** Relay the current relationship snapshot to the whole room. */\nexport function anchors(\n\tplan: Plan,\n\tserver: Server,\n\troomId: string,\n): void {\n\tbroadcast(server, roomId, {\n\t\tkind: \"plan:anchors\",\n\t\tts: 0,\n\t\tepoch: plan.document.epoch,\n\t\twidgets: Questions.anchors(plan),\n\t\tthreads: Comments.anchors(plan),\n\t});\n}\n\n/** Relay presence verbatim, and remember it for whoever joins next. */\nexport function awareness(plan: Plan, ws: Socket, msg: Wire.Awareness): void {\n\tif (msg.epoch !== plan.document.epoch) return;\n\tpresence.track(plan.presence, ws, decode(msg.update));\n\trelay(ws, { kind: \"plan:awareness\", ts: 0, epoch: plan.document.epoch, update: msg.update });\n}\n\n/** Clear a departed member's cursors rather than leaving peers to time them out. */\nexport function departed(plan: Plan, ws: Socket): void {\n\tlet update = presence.drop(plan.presence, ws);\n\tif (!update) return;\n\trelay(ws, {\n\t\tkind: \"plan:awareness\",\n\t\tts: 0,\n\t\tepoch: plan.document.epoch,\n\t\tupdate: encode(update),\n\t});\n}\n\n/** Write anything outstanding and let go. */\nexport async function close(plan: Plan): Promise {\n\tif (plan.timer) clearTimeout(plan.timer);\n\tawait plan.flushing;\n\tawait plan.sink.flush();\n\tawait Chat.close(plan.chat);\n\tQuestions.shutdown(plan.questions);\n\tpresence.destroy(plan.presence);\n\tplan.document.doc.destroy();\n}\n\n/** Current canonical source. */\nexport function source(plan: Plan): string {\n\treturn room.project(plan.document);\n}\n\n/** Size of the Yjs history, for the idle compaction check. */\nexport function size(plan: Plan): number {\n\treturn Y.encodeStateAsUpdate(plan.document.doc).byteLength;\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_54":55,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_42":31,"_137":126,"_138":31,"_48":49,"_50":49},"branches",[73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"tags",[69,70,71,72],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","main","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":49,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_52":174,"_175":31,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_52":174,"_175":31,"_176":174,"_177":49},{"_168":169,"_170":171,"_15":169,"_172":173,"_52":174,"_175":31,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_52":174,"_175":31,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_52":174,"_175":31,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_52":174,"_175":31,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_52":31,"_175":31,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_52":31,"_175":31,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_52":31,"_175":31,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_52":31,"_175":31,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_52":31,"_175":31,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_52":31,"_175":31,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_52":31,"_175":31,"_176":31},{"_168":202,"_170":203,"_15":202,"_172":204,"_52":31,"_175":31,"_176":31},{"_168":199,"_170":200,"_15":199,"_172":201,"_52":31,"_175":31,"_176":31},{"_168":196,"_170":197,"_15":196,"_172":198,"_52":31,"_175":31,"_176":31},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794516814820,"sidebar","expanded"]