Skip to content

feat(runtime): offload oversized JSON through a content-addressed blob store - #36

Closed
dylnslck wants to merge 15 commits into
mainfrom
feat/blob-offload
Closed

dylnslck wants to merge 15 commits into
mainfrom
feat/blob-offload

Conversation

@dylnslck

Copy link
Copy Markdown
Contributor

Summary

  • Adds a content-addressed BlobStore and withBlobOffload. Strings over 64 KiB are replaced with a SHA-256 reference before the event and snapshot byte limits run. If an event is still over 1 MiB, its payload is stored as one blob.
  • Reads, live subscribers, folds, projections, and snapshot loads resolve those references, including references nested inside another blob. The stored log keeps the references. Trim deletes a body only when no retained event and no latest snapshot in any run still needs it.
  • createLooms({ blobStore }) and LoomsDurableObject / durableObjectEventStore blobs attach the store. Included implementations are memoryBlobStore, filesystemBlobStore, and r2BlobStore. Without a blob store, events over 1 MiB and snapshots over 8 MiB are still rejected.

Test plan

  • bun x tsc -p packages/core/tsconfig.build.json --noEmit
  • bun x tsc -p packages/runtime/tsconfig.build.json --noEmit
  • bun x tsc -p packages/cloudflare/tsconfig.build.json --noEmit
  • bun test src in packages/core, packages/runtime, and packages/cloudflare
  • oxlint --deny-warnings on the changed files
  • bun run verify was not run

Made with Cursor

dylnslck and others added 15 commits October 23, 2026 10:13
BREAKING CHANGE: POST /runs/:runId/effects/:effectId/:attempt/:action returns { status, cancelRequested } instead of the run state. createLooms().workerCallback and the HTTP client return the same shape. Heartbeats may carry details that the next attempt's task includes. failEffect and worker fail callbacks can mark an attempt non-retryable or set retryAfterMs.

Co-authored-by: Cursor <cursoragent@cursor.com>
Attributes are immutable labels on the start event, run state, and summary, and authorization can see them. Secrets stay in a side store for handlers and in-process dispatch, and are kept out of events, snapshots, and HTTP responses.

Co-authored-by: Cursor <cursoragent@cursor.com>
…b store

Strings over 64 KiB, and any event payload that would still exceed 1 MiB, are stored by SHA-256. Reads and snapshots resolve the references, and trim deletes a body once nothing retained points at it.

Co-authored-by: Cursor <cursoragent@cursor.com>
…full fold

Run attributes are immutable and recorded on runtime.run.started, so authorization reads seq 1 and only falls back to loading the run when the log is trimmed. Store failures now fail the request instead of authorizing without attributes. Also fixes the start-body attribute decode, which did not type-check.

Co-authored-by: Cursor <cursoragent@cursor.com>
… runs

Dropping a reference used to list and read every run's manifest, so each trim cost grew with the number of runs in the bucket. Each run now writes refs/<digest>/<run> markers, and collecting a body lists only that digest's markers.

The old scheme also lost bodies when two Durable Objects shared a bucket. retain now writes markers before checking that each new body exists and fails the append if one was deleted. collect lists markers again after deleting and restores the body if a reference appeared. BlobBytes gains exists, and R2BucketLike gains head, so the check does not download the body.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…text

A transport that persists tasks cannot carry secrets, so its worker needs another way to read them. POST /runs/:runId/effects/:effectId/:attempt/secrets returns the secret context only while that attempt is started and unsettled, and stale or cancelled otherwise. It uses worker access, so it stays closed until the host configures worker auth, and responses are not cacheable. client.workerSecrets wraps it.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The retry is scheduled from the wake's clock, which is read before the event timestamp, so comparing against the event could fail by a millisecond. The assertion also no longer skips when the payload is missing.

Co-authored-by: Cursor <cursoragent@cursor.com>
@dylnslck

Copy link
Copy Markdown
Contributor Author

Superseded by squash-merge of the stack tip (#46), which already includes this change set after #34 landed on main.

@dylnslck dylnslck closed this Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant